Privacy policy
What we collect, why, how long we keep it, and the choices you have.
Summary
We collect what we need to run a trading terminal and bill for it: your e-mail, your rules, the orders you place through Turtle Terminal, and the positions, balances and fills your exchange reports. We do not sell personal data. On the website we measure which pages and which ads bring people in, with your consent where the law asks for it first (see the cookie policy).
Who we are
Turtle Terminal (the legal entity named in the footer of turtleterminal.com) is the controller of the personal data described here. Contact: privacy@turtleterminal.com.
What we collect
Account data. E-mail address, password hash (managed by our authentication provider), display name if you set one, appearance preferences, the time you acknowledged the beta terms, your role.
Exchange connections. The name of your exchange, an account identifier, whether the account is paper or live, and the API keys you connect. Keys are encrypted at rest in a vault and are never shown again after you enter them.
Trading records. Every order you place through Turtle Terminal, the rule evaluation that ran on it, the exchange's response, and the account snapshots, positions, fills and balances your exchange reports during synchronisation. Also the rules you write, every change to them, blocks, overrides and cooldowns.
Audit log. Sign-ins, rule changes, connections, disconnections, kill switch actions and role changes, with timestamps.
Billing. A Stripe customer identifier and subscription state. Your card details are collected by Stripe directly and never reach our servers.
Website forms. What you type into the contact or newsletter form, a salted hash of your IP address for rate limiting (the address itself is not stored), and your browser's user agent string.
Technical logs. Request paths, timings and error messages, with identifiers rather than payloads.
Website analytics and advertising. Which pages you view, for how long, how far you scroll, what you click, where you arrived from (the ad, campaign or site), and whether you opened an account. With analytics consent, PostHog may record your session to show how pages are used; everything you type is masked. Advertising tags (Google Ads, Meta, Reddit, X) tell those platforms that someone who saw their ad visited or opened an account. None of this includes your email, name or trading records. Where the law asks for consent first (the EU, the EEA, the UK and Switzerland), none of it runs until you choose; elsewhere it runs by default and Cookie settings at the foot of every page turns it off.
Why we collect it
- To run the service you signed up for (contract).
- To enforce your rules and reconstruct history when you ask why something happened (contract, legitimate interest).
- To bill you (contract, legal obligation).
- To keep the service secure and prevent abuse (legitimate interest).
- To answer your messages (legitimate interest, consent).
- To send release notes if you subscribed and confirmed (consent; unsubscribe in any e-mail).
- To understand how the website is used and which advertising works (consent where required, otherwise legitimate interest; you can object at any time through Cookie settings).
Who sees it
Sub-processors that run parts of the service on our behalf: our database and authentication provider, our hosting provider, our payment processor, our e-mail provider, analytics and advertising measurement providers, and error tracking. The current list is on the subprocessors page. Each is bound by contract to process data only on our instructions.
Your exchange sees the orders you send through Turtle Terminal exactly as it would see any order. We do not share your data with exchanges otherwise.
We disclose data when the law requires it or to protect the rights and safety of users and the service.
How long we keep it
Trading records and the audit log are append-only by design and are kept for the life of your account and for five years after it closes, which is within the period financial record-keeping rules commonly require. Account data is deleted within 30 days of closure. Exchange keys are deleted immediately when you disconnect an account. Contact form messages are kept for two years. Newsletter addresses are kept until you unsubscribe.
Where it is stored
Servers in the United States. If you are outside the United States your data is transferred there; we rely on our providers' standard contractual clauses for those transfers.
Your rights
Depending on where you live you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to complain to a supervisory authority. You can export your trading history from the terminal, change your account details in settings, and delete your account from the account page. For anything else, write to privacy@turtleterminal.com. We answer within 30 days.
Children
The service is not for anyone under 18. We do not knowingly collect data from children.
Changes
We will post changes here with a new effective date and, for material changes, notify you by e-mail.