Privacy Policy

Last updated: 2026-08-28

1. What we collect

We collect your username, email, and exchange API credentials you provide. Protected withdrawals are off by default. If an operator separately approves and enables them, a dedicated OKX Live credential may include Withdraw, and the service records withdrawal parameters, approvals, audit and notification references, and exchange results. We do not custody or collect your on-chain assets.

2. How API keys are stored

The managed SaaS deployment uses envelope encryption (Fernet with a KMS-managed or environment-managed master key), and credentials are decrypted only when an authorized operation needs them. Self-hosted operators must configure key management before storing exchange credentials.

3. How data is used

Data is used only for authorized exchange execution, notifications, plan billing and service improvement. Product analytics uses random identifiers and one-way HMACs of usernames, and records only product events such as entry points, backtests, trials, paywalls and checkout. It does not record IP addresses, browser fingerprints, trading parameters or account data. We never sell your data.

4. Your rights

You can delete exchange API keys under Accounts / Exchanges. Product-account deletion and personal-data export currently require an authenticated request to the service operator through the channel stated in your service agreement. Do not include passwords, exchange secrets or API credentials in a privacy request.