Security & Data Protection

Privacy Policy & Data Security

Last updated: October 2026 · We uphold strict data isolation and zero third-party monetization.

🔒 COMMITMENT TO PRIVACY & TENANT ISOLATION

Your broker API credentials and trading data belong strictly to you. Autotrade operates on strict multi-tenant isolation. We never sell, rent, or commercialize your personal data, API keys, or trading history to any broker, advertiser, or third party.

1. Information We Collect

We collect only the essential information necessary to provide authentication and broker routing services:

Account Identifiers: Your email address and full name to create and manage your login session.
Device Identifiers: A pseudorandom browser/device token (device_id) used exclusively to enforce single-active-session security and prevent unauthorized account hijacking across multiple phones or PCs.
Broker API Configurations: Client codes, App IDs, API secrets, and temporary session tokens entered by you to connect your chosen broker.
Trading Logs: Execution timestamps, symbol names, quantities, and simulated or live order statuses strictly for your dashboard display and audit trail.

2. How We Secure Your Data

We deploy defense-in-depth architectural safeguards to protect sensitive credentials:

Password Hashing: User account passwords are never stored in plain text. They are hashed using robust cryptographic hashing algorithms (bcrypt).
Stateless JWT Authentication: Active sessions are authenticated via signed JSON Web Tokens (JWT) with strict expiration limits.
Strict Multi-Tenant Isolation: All database queries require verified user identity (current_user.id). It is impossible for one authenticated user to view or modify another user's broker keys or trades.
TLS Encryption: All data transmitted between your device and the server is encrypted using Transport Layer Security (HTTPS / TLS 1.3).

3. Third-Party Broker Integrations

When you connect a broker (FYERS, Zerodha Kite, Kotak Neo, Groww), our backend communicates directly with your broker's official API endpoints using the API credentials you provided. Your interactions with your broker remain governed by the respective broker's Privacy Policy and Terms of Use.

4. User Rights & Account Purging

You maintain complete control over your stored data:

You can disconnect or delete any saved broker profile or API key at any time directly in the Account & Broker settings.
You can request complete deletion of your account and associated trading logs by contacting platform administration.