exoprop
Privacy Policy
exoprop ("exoprop", "we", "us") is a dashboard for futures traders that lets you link accounts held at third-party trading platforms, view your trade history, keep a journal and track prop-firm rules. This policy explains what personal data we process when you use exoprop.com and the exoprop web application, why, and what rights you have.
1. Who is responsible
The controller responsible for your data is:
[Legal entity name]
[Street and number]
[Postcode, City, Country]
Email: privacy@exoprop.com
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email address, display name and profile picture (Google sign-in only), a user ID, sign-in timestamps | You / Google |
| Linked platform credentials | Tradovate OAuth tokens; TopstepX username and API key; Rithmic username, password and system name | You / the platform |
| Trading data | Account names, IDs and balances; fills, orders, positions and the closed trades derived from them (symbol, size, prices, times, profit and loss, fees) | The platforms you link |
| Journal and settings | Notes, tags, chart layouts, indicator and theme preferences | You |
| Technical data | IP address, browser type, pages requested, error logs | Automatically, by our hosting provider |
3. Why we process it and on what legal basis
- Providing the service (Art. 6(1)(b) GDPR): creating your account, connecting to the platforms you choose, retrieving and displaying your accounts and trades, computing statistics, saving your settings.
- Security and abuse prevention (Art. 6(1)(f) GDPR): authentication, rate limiting, error logging.
- Communication (Art. 6(1)(b) and (f) GDPR): answering support requests, notifying you about changes to the service.
- Consent (Art. 6(1)(a) GDPR): where you actively link a trading platform, you consent to us accessing that platform on your behalf. You can withdraw this at any time by disconnecting the account.
4. Platform credentials and tokens
Linking a platform gives exoprop read access to your accounts and trade history on that platform. Credentials are encrypted at rest (AES-256-GCM) with a key that is never stored alongside the data and are only decrypted inside our server functions when talking to the platform. We do not display them to anyone, including you, after you enter them. Disconnecting an account deletes its credentials, tokens and the trades synced from it.
5. Where your data is stored and who helps us
We use the following processors under data processing agreements:
- Google Firebase / Google Cloud (Google Ireland Ltd.) — authentication and database. Data is stored in the EU region (Frankfurt).
- Vercel Inc. — hosting of the website and the server functions, including request logs.
- Trading platforms you link — Tradovate LLC, Topstep / ProjectX, Rithmic LLC. We send them your credentials or tokens to retrieve your data. Their own privacy policies apply to data held on their side.
Some of these providers process data in the United States. Transfers rely on the EU–US Data Privacy Framework or standard contractual clauses.
6. Cookies and local storage
We do not use advertising or tracking cookies. We store a sign-in session and your interface preferences (theme, chart layout, time zone) in your browser's local storage so the app works and remembers how you set it up. Clearing site data in your browser removes them.
7. How long we keep data
- Account data: until you delete your account.
- Platform credentials and tokens: until you disconnect the account or delete your exoprop account.
- Trading data and journal: until you disconnect the account, delete entries, or delete your exoprop account.
- Server logs: up to 30 days.
8. Your rights
Under the GDPR you can ask us for access to, correction of, deletion of, or a portable copy of your personal data, and you can object to or restrict certain processing. You can disconnect platforms and delete your account yourself inside the app, or email privacy@exoprop.com. You also have the right to complain to a data protection authority.
9. Children
exoprop is not directed at persons under 18 and we do not knowingly collect their data.
10. Changes
We will post any changes to this policy on this page and update the date above. Material changes will be announced in the app.