1. What we collect

Account data

Email address and a password hash (bcrypt). That's it for authentication.

Exchange API keys

Encrypted with AES-256-GCM at rest. Decryption keys live in a separate KMS. We never log API keys. We log what the engine did with them: timestamps, symbols, sides, prices, quantities.

Trade history

Stored as long as your account is active, plus 90 days for regulatory and operational reasons. After that, deleted from production.

Aggregate analytics

Page views, referrer, screen size, country (not city). Via Plausible Analytics — privacy-first, no cookies, no IP storage.

2. What we do not collect

Cookies for advertising or tracking
Session replay or heatmap data
Cross-site tracking pixels
Anything from third-party advertising networks

3. Your rights

Access — request a copy of all data we hold
Deletion — request account deletion (we comply within 30 days)
Portability — export trade history as CSV

Email privacy@killbot.cash. We respond within 5 business days.