Privacy Policy

Effective August 25, 2026.

The short version. We store the minimum — a revocable broker token, your broker account ID, your strategy settings, and your email — and we encrypt broker credentials before they touch a database. We never see your broker password, your bank details, or your card number. We don't sell or share your data with advertisers.

1. What we collect

We store	We never store
Your email address and, if you give one, a display name (account sign-in and service email).	Your broker username or password.
Broker credential — encrypted: the access token your broker issues when you sign in there, or the API credential you pasted.	Answers to broker security questions.
Your broker account ID (needed to route orders).	Bank or funding account details.
The strategy configuration you chose, and the orders, fills, and positions the software manages for you.	Social Security or tax identifiers.
Subscription/billing status (card data lives with our payment processor, never on our servers).	Card numbers.
Device and session details for signed-in devices (browser or phone, app version, push-notification token if you enable notifications), and standard server logs (IP address, request time) kept for security and abuse prevention.

If you join the waitlist we store your email and where the signup came from (a campaign tag or referring site) for measurement only.

2. How we use it

To run the Service: place and manage orders in your brokerage account under the rules you chose, and show you what it is doing.
To sign you in, secure your account, and send service email (sign-in, password reset, waitlist and build updates, notifications you turned on).
To keep the Service reliable and detect abuse.

We do not sell your personal information, and we do not share it with advertisers or data brokers. We make money from subscriptions only — not from your trades, order flow, or data.

3. Your broker connection

When you connect a broker by signing in on the broker's own website, the broker hands us a limited access token; we never receive your password. That token can manage trades in your account and cannot move money out of it. Broker credentials are encrypted before they are stored, with the encryption key kept separately from the data, so the data alone is useless. You can revoke our access at any time from your broker's website, without asking us first.

4. Who else sees it

Your broker — receives the orders the Service places, under the broker's own privacy policy.
Service providers that host the Service, deliver email, deliver push notifications, and process payments, each bound to use the data only to provide that service to us.
Legal — if required by law, subpoena, or to protect the Service and its users.

5. Retention and deletion

We keep your data while your account is open. Delete your account (or email us) and we delete your broker credentials immediately and the rest of your account data within 30 days, except records we must keep for legal or security reasons. Revoking our access at your broker also makes any stored token useless.

6. Security

Encrypted credentials at rest, HTTPS everywhere, hashed passwords and session tokens, per-device sessions you can revoke, and rate limits on sign-in. No system is perfectly secure; if we learn of a breach affecting your data we will notify you promptly.

7. Your choices and rights

You can view and update your account details, sign out other devices, turn notifications off, and disconnect your broker at any time from the Service or from your broker. Depending on where you live you may have rights to access, correct, export, or delete your personal information — email us and we will honor them. The Service is intended for adults (18+) in the United States.

8. Changes and contact

We may update this policy; material changes will be announced on the Service or by email. Questions or requests: support@optionbug.com.