Privacy Policy

Syferway operates the Service described in this notice. The legal entity name, registered address, and EU representative or data-protection contact, if required, must be confirmed before launch.

For a privacy request, email contact@syferway.com with “privacy request” in the subject, or use our Contact page.

• Account and authentication data. Email address, profile information you provide, internal account identifiers, authentication provider information, and security/session signals. Passkey private keys and biometric data remain with your authenticator and are not stored by Syferway.
• Trading and workspace content. Trades, imports, journal entries, notes, tags, playbooks, backtesting research, strategies, checklists, analytics inputs, and other content you choose to save.
• Files and media. Screenshots, notebook images, CSV files, attachments, Library documents (CSV and PDF files you choose to keep, on the Pro plan), filenames, and storage metadata needed to provide uploads and exports. Library files are stored privately and opened only through short-lived links for your own account.
• AI and support content. Messages, selected context, feedback, support conversations, and technical usage records when you choose to use an AI or support feature.
• Billing and subscription references. Plan, subscription, customer, invoice, payment-status, and billing-period references supplied by Stripe. Syferway does not need to store full card numbers.
• Broker connection information. Connection status, selected accounts/categories, sync history, and encrypted credentials or tokens for connectors you explicitly enable.
• Connected account identities. When you connect a sign-in provider such as Google, its account identifier and the name, email address and avatar it shares. Syferway asks only for identity scopes, not permission to post, message or manage anything for you.
• Discord community link. If you connect Discord in Settings: your Discord user ID, username and display name, which Syferway roles it holds on the Syferway Discord server, and when they were last updated. With your approval on Discord's own screen, connecting also adds you to that server: Syferway's Discord bot does this with Discord's access token, which is used only while you connect, never stored, and revoked straight after. Syferway cannot read your messages or your other servers.
• Accountability groups. Group membership, the trading accounts you include in a group, and the fields you choose to share with it. When two groups are linked, each sees only combined figures for the other group, computed from what members share with their own group; individual trades, notes and account names are not shared between groups.
• Affiliate and Partner Program data. For Affiliates: referral attribution, referral link clicks, commission and payout records. For Partner Program applicants: the application details you submit.
• Security and operational data. Request metadata, IP address, browser/device signals, authentication events, rate-limit events, and error diagnostics needed to operate, secure, and investigate the Service.
• Optional browser analytics. Cookieless page-use and performance telemetry from Vercel Web Analytics and Speed Insights only after you allow Analytics.

We use data to provide requested features, authenticate accounts, maintain security, process subscriptions, deliver support and transactional messages, troubleshoot failures, and meet legal obligations.

Optional browser analytics is used to understand aggregate product use and performance only after positive consent. You may reject it and continue using the Service. The final mapping of each purpose to contract, legitimate interests, consent, or legal obligation is a legal-review item.

When you deliberately ask Syferway AI or an AI-assisted review to respond, the server builds limited context from data you own and sends the request to the configured AI provider. AI output may be inaccurate and is not authoritative financial data, investment advice, or a trade signal. Deterministic analytics remain separate from AI commentary.

AI does not grant account access, change billing, place trades, or make decisions producing legal or similarly significant effects. Provider retention and model-training terms for the production account must be verified against the signed commercial terms before launch.

Depending on the features you use, current technical integrations can include:

• Supabase for authentication, PostgreSQL, storage, and platform logs.
• Vercel for hosting, functions, deployment, and consent-gated browser analytics.
• Cloudflare for DNS, proxy/security services, and Turnstile abuse protection.
• Stripe for checkout, subscriptions, invoices, and payment processing when billing is enabled.
• Anthropic (Claude) for server-side Syferway AI answers when you invoke an AI feature, with the context that answer needs (your question, the relevant trading facts, notes and conversation history, and any image you attach).
• OpenAI for voice dictation (speech to text), Backtesting research and other server-side AI requests when you invoke those features.
• Resend for transactional email when configured.
• Google when you choose Google OAuth.
• Discord when you connect Discord: to confirm your Discord account, add you to the Syferway server with your approval, and keep your community roles in step with your plan.
• Railway for running the Syferway Discord bot, which applies those community roles and adds you to the server when you connect; it handles Discord IDs and role changes only, with no access to your journal or billing data.
• Broker and market-data providers only when you enable a corresponding sync or research feature.

Feature availability and provider configuration can vary. Signed DPAs, processing regions, subprocessors, and international-transfer safeguards must be confirmed from the production accounts and contracts; this notice does not assume terms we cannot verify.

Necessary technology supports sign-in, account security, Staff Access, recovery, abuse prevention, and preferences you request. Cloudflare Turnstile is security technology and is not controlled by the Analytics preference. Optional Vercel browser analytics stays off until you allow it.

See our Cookie & Technology Policy for the measured inventory and controls. You can reopen Privacy choices at any time.

Account and workspace data currently remains while the account and relevant feature are active, unless you delete content using an available product control or ask Support to handle a verified request. Security, billing, audit, provider, and backup records may remain where required for fraud prevention, accounting, dispute handling, recovery, or legal obligations.

If you disconnect Discord, its Syferway roles are removed from your account on the Syferway server and a record of the disconnected link is kept until your Syferway account is deleted. Discord integration audit events are deleted after 180 days.

Syferway does not yet publish a formally approved record-by-record retention schedule or one-click account erasure flow. Exact periods, backup deletion windows, legal holds, and post-account-deletion handling require business and legal approval before launch; no fixed period is invented here.

Depending on applicable law, you may have rights of access, correction, erasure, restriction, objection, portability, and withdrawal of consent, and the right to complain to a supervisory authority.

• Access and portability: use the trade/CSV export controls where available (Import / Export or Trades) and download your Library files; request a copy of other data through Support.
• Correction: edit your profile, trades, notes and setups directly, or contact Support.
• Erasure: delete content where it lives, for example Library files, notebook entries, AI chats and import batches. Whole-account deletion is handled on a verified request. There is no one-click whole-account deletion control today. Account deletion requests include Library files.
• Restriction and objection: submit a verified privacy request by email or Contact.
• Consent withdrawal: use Privacy choices; withdrawal does not sign you out or remove necessary security state.

We may need to verify identity and clarify scope before acting. We will respond under the timeframes and exceptions required by applicable law. You may also contact the Hellenic Data Protection Authority or another competent supervisory authority where applicable.

Syferway uses safeguards designed to protect data, including server-side authorization, Supabase row-level security, private storage controls, encrypted broker secrets, secure cookies, rate limits, and abuse checks. No system can guarantee absolute security.

Some providers may process data outside the country where you live. The applicable processing locations and safeguards, such as adequacy decisions or standard contractual clauses, must be confirmed from the production contracts and provider settings.

We may update this notice as the product, providers, or law changes. Material changes to optional analytics purposes or vendors will not silently expand an older consent record; the consent-policy version will be reviewed and renewed where appropriate.