Privacy Policy

Last updated: October 13, 2026

The principle: almost everything stays with you

On your own computer or on a VPS you provide, the app keeps its configuration there, and your broker account credentials and your Telegram login never reach our servers — not with any setting turned on, not ever. On a VPS provided for you they are kept on that VPS, which exists only to run your app. Remote sync is the one exception to the rest. Your trading activity, your settings and the original text of the signal messages are synced by default, each on its own switch you can turn off at any time in the app (an app with no window of its own keeps them on, as the Desk is the only way to manage it). With the settings switch off, your settings are kept only on the computer your app runs on and we store none of them. What each switch sends is listed below.

What we process on our servers

• Account data: name, email, password (stored irreversibly hashed).
• Signing in with Google, if you use it: we receive your name and email address from Google, plus the Google account's identifier so we recognise you the next time. Nothing else.
• Licence state: your Stripe customer and subscription references, status, and expiry.
• Sparks and in-app items: the balance, its ledger (purchases, earnings, spending, with date and reason) and the items held — the record the account and the invoices rest on.
• Your progress in the app: XP, level, seasons, badges, cards and looks. Unless you hide yourself in your account, the public boards and your public profile show your board name — "Trader #" and four characters until you choose one — with your level, season place and looks.
• Security records: recent sign-ins with IP address, approximate country and device, and a log of changes to your account and, with remote sync, to your app's settings, kept for up to a year.
• Support: the tickets you open and our answers, with the part of the app log you attach from the app, and the error reports the app sends when something fails (the error, the app and system versions, and the log lines around it).
• The emails we send you — which one, its subject and when — so support can see what you were told.
• Invitations and coupons: who invited you, the friends who joined through your link, and the coupons you redeemed.
• Invoicing data: your billing name and address (collected at checkout by Stripe) appear on the fiscal invoices we are legally required to issue.
• Payments: for each payment and each failed attempt, the amount, the date, what it paid for, the invoice, any discount, and a refund or dispute; and what Stripe tells us about the card — its brand, last four digits, country and type (credit, debit, prepaid), an identifier Stripe computes for the card (not its number), the postal code, city and country of the billing address, Stripe's risk assessment and, for a failed attempt, the reason. We never receive the full card number or its security code.
• Strictly necessary technical data (session cookie, security logs). No marketing trackers and no outside analytics service. We count the site's visits ourselves, without cookies and without keeping your IP address: the pages opened, the site that linked here, the country and the kind of device, under a code that changes every day and cannot be linked to you; if you open an account or browse while signed in, the visit is kept with your account. Opens and clicks in product news are measured only if you allow it (see "Product news").
• While remote sync is on (the default, until you switch parts of it off): your trading activity (orders placed, fills, closes) and the signals behind it; the app's state, which includes your MetaTrader account number and broker server so support can tell which account a problem is on; snapshots of your settings; and the original text of the signal messages, while that switch is on. Never your MetaTrader password — we do not have it.
• The broker server directory: after your MetaTrader logs in to your broker, the app sends us the name of the broker's server, the broker's company name and, when we do not have it yet, the file in which MetaTrader keeps its list of broker servers. It lets the next person with the same broker log in without looking the broker up by hand. Your account number and your password are not part of what is sent here. We note which account sent a server first, and a person checks the file before it is given to anyone else. This does not depend on the remote sync switches.

Processing inside the app

To interpret a signal, the app may send the text of a message from a group you configured to an AI model, strictly to extract the trade details: first one we run on our own hardware, and when it is unavailable or busy, DeepSeek through OpenRouter (on hosts that do not keep what is sent) or Anthropic's Claude. That transmission starts from where your app runs, for groups you chose. Parsing itself keeps no text. The text is kept with the synced signal while the "sync original messages" switch is on — which it is by default — so that you and our support can see what the app read; with it off, a synced signal carries only the details the parser extracted, never the message text.

Preventing abuse of offers

Welcome discounts, free periods, coupons and invitation rewards are meant once per person. To find one person holding several accounts, or payments made to try out cards, we compare accounts by: the email address (including variants of one mailbox), the name, the IP addresses of sign-ins and of acceptances of the terms, the identifier of the computer the app runs on, the MetaTrader account number, the card identifier and the billing address. No decision is automated: a person looks at what the comparison shows before an offer is withheld or an account is closed, and you can ask for a review (Terms, section 9).

Legal bases and purposes

Contract performance (providing the licence), legal obligations (invoicing and fiscal archiving, for the period required by accounting law — currently 5 years), and legitimate interest (service security, preventing fraud and the abuse of offers, and honouring a request or a bounce not to email an address). Product news and measuring them rest on your consent. Nothing is sold or shared for advertising.

Processors

Stripe (payments), our email provider, our hosting provider, and the AI services that read signal messages when our own model cannot (OpenRouter with DeepSeek, and Anthropic) — each processing only on our instructions.

Your rights

Access, rectification, erasure (within legal retention limits), restriction, portability, objection — write to delvarom@delvarom.com. Your account page also lets you download everything we hold about you, as a zip of plain JSON files. You may also complain to ANSPDCP (dataprotection.ro), the Romanian supervisory authority.

Account deletion

You can delete your account directly from your account page. Deletion permanently removes your login, licence and personal data from the app, cancels any active subscription immediately, and anonymizes your customer record in our invoicing system. Invoices already issued cannot be deleted: accounting and fiscal law requires us to archive them — that legal obligation is the basis for keeping them (GDPR art. 17(3)(b)).

Product news

Only if you tick the box at sign-up or in your account, we email you occasional product news and offers, on the basis of your consent, in your account's language. We keep when and where you gave or withdrew that consent. Each of those emails has an unsubscribe link, and you can turn them off in your account at any time. We keep which newsletter we sent you and when, and your account lists them. If an email to your address bounces for good, or you ask us, we stop sending newsletters to it and keep the address on a do-not-email list for that purpose only.

Measuring opens and clicks is a separate choice in your account, off until you turn it on: with it on, each newsletter carries an image that tells us when you open it, and its links tell us which ones you clicked. With it off, a click only adds to that link's total and is not tied to you. A link to our site carries the newsletter's name, so an account opened from it counts for that newsletter.

Emails about your account and subscription — invoices, renewal reminders, security notices — are part of the service and are sent regardless.

Launch list

The launch list no longer exists. Before launch we kept the email address and language of people who asked to be told when the app went live, based on consent, solely for the confirmation message and the launch announcement. After the launch in September 2026 and the announcement, the list and the addresses on it were deleted.

Cookies

Only strictly necessary cookies (session, CSRF, language preference). These need no consent, and we set no others. Full details in the Cookie Policy.