Privacy Policy

Last updated October 27, 2026

This policy explains what Backtest Vault ("we", "us") collects when you use the website and the backtesting service, why, who else handles it, and what you can ask us to do with it.

1. What we collect

• Account details: your email address (from checkout), your plan, your account status and when things happened (signup, trial, payments).
• Billing references: Stripe and Link process your payment. We receive your email, Stripe's customer and subscription IDs, whether payments succeeded, and a card fingerprint, which is a code Stripe derives from your card so we can enforce one free trial per person. We never receive or store your card number. Your name and billing address go to Stripe and Link for tax purposes; we do not keep them.
• Your connector URL: we store only a one-way hash of the key in it, so we cannot read or show it again.
• Your strategies and results: the strategy specs your AI client sends, the results, any names, notes and tags you add, and how many backtests and credits you used each month.
• Request logs: the time, the kind of request, the last 4 characters of your key and the result, for troubleshooting. We do not keep logs of the IP addresses that call the service, though an error log can occasionally contain one.
• Website: the pages of our site and the page you see after checkout load Google's advertising tag and Reddit's pixel, which use cookies to measure whether a visit from one of our Google or Reddit ads led to a click on a plan, a signup or a payment. The site also loads fonts from Google. This means your browser sends Google and Reddit your IP address and browser details.
• Visit counts: we count visits to our site and clicks on the plan buttons: the page, the campaign or site that sent you (kept in your browser's storage for 30 days so a later signup is credited to it), and the country your IP address belongs to. The IP address of a visit is not stored. To count visitors per day we keep a code made from your IP address, browser and a random value that changes every day and is deleted after two days, so you can't be recognised across days. When you start a checkout, the click's reference goes to Stripe so the account it creates records its source and country.
• Reddit ad measurement: if you arrive from one of our Reddit ads, our site stores Reddit's click ID in a cookie on our own domain for 90 days. When you click a plan button, we record that click ID and the ID of Reddit's pixel cookie with the click, and keep the click's IP address and browser details for two days. When a checkout starts your trial or plan, we send Reddit a signup conversion: a SHA-256 hash of your email address (Reddit can only match it to an address it already knows), the click's IP address and browser details, and Reddit's IDs if there are any. When a payment succeeds, we send Reddit the amount, the hashed email and Reddit's IDs. Reddit uses this to tell us which of our ads led to signups and payments.

2. How we use it

• To run the service: backtests, your vault, credits and your trial.
• To bill you, apply the one-trial-per-person rule, and pause or end access when a payment fails or a subscription ends.
• To answer support requests, keep the service secure and prevent abuse.
• To measure how visitors and signups arrive: which ads, sites and countries.

We do not sell your data. We do not share your strategies or results, and we do not use them to train AI models. We do not send you marketing emails.

3. Who else handles it

• Stripe and Link process payments as merchant of record and send your receipts, trial reminders and payment emails, under Stripe's privacy policy.
• Hetzner hosts our servers in Nuremberg, Germany.
• ntfy.sh relays the operator's own phone alerts about signups and payments. They carry the plan, amount, country and a shortened email (like j***@icloud.com), never a full address.
• Google provides the ad measurement and fonts described above, under Google's privacy policy.
• Reddit receives the pixel data and the conversions described above, under Reddit's privacy policy.
• Your AI provider (for example Anthropic, OpenAI or Cursor): when you use the service through your AI client, your requests and our results pass through that client under its provider's own terms and privacy policy.

We may also disclose information when the law requires it.

4. Where it is stored

Our database and servers are in Germany (EU). Stripe, Google and Reddit may process data in other countries under their own safeguards.

5. How long we keep it

• Account and vault data stay while your account exists. A run you delete leaves the live database at once.
• The IP address and browser details of a plan button click are deleted from the live database after two days.
• Database backups are kept for up to 30 days, so deleted data disappears from them within that time.
• If you ask us to delete your account, we delete your account, keys and vault. We keep your normalized email and card fingerprint only to apply the one-trial-per-person rule, plus any records we must keep by law. Stripe and Link keep their payment records under their own policies.

6. Your choices and rights

• Contact us (see section 10) to see, correct, export or delete your data, or to close your account. We answer within 30 days.
• You can block or delete cookies in your browser, manage Google's ad personalisation at adssettings.google.com, and manage Reddit's in your Reddit privacy settings.
• If you are in the EU or UK, you also have the right to object to or restrict how we use your data, and to complain to your data protection authority.

7. Security

All traffic uses HTTPS. Keys are stored only as hashes, and every vault query is limited to the account that owns it. No system is perfectly secure, so keep your connector URL private and tell us at once if it leaks.

8. Children

The service is for adults. It is not meant for anyone under 18, and we do not knowingly collect data from them.

9. Changes

We may update this policy. If a change materially affects you, we will tell you before it takes effect.

10. Contact

A contact address for privacy questions and requests will be listed here. Until then, use your billing link to manage payments or cancel. See also our Terms of Service.