Privacy Policy / Data handling overview

Privacy for strategy builders, broker data sessions, and self-hosted exports.

Stockey is designed to help users structure, test, review, and export their own strategy packages while keeping broker credentials, raw market data, and exported package control as user-controlled as possible.

Start strategy builderRead terms
Privacy boundary

Privacy, retention, payment, AI-processing, and jurisdiction language should be reviewed by qualified counsel before legal reliance.

Session-limited by default
Secrets user-controlled
Exports self-hosted
Legal review needed
Privacy data-flow console
strategy inputs / sessions / exports
policy aware
broker_secret_storefalse

No permanent broker-secret storage by default

historical_sessionstemporary

Broker and CSV data stay session-limited by default

exported_packageuser_local

Downloaded packages remain user-controlled

Data governance path

A product-specific map of where user material enters, which work is temporary, and where saved records or cleanup rules apply.

session aware
01
User-controlled

User input

Strategy rules, scripts, CSV files, prompts

02
Temporary

Processing

Historical testing, AI-assisted review, conversion

03
Saved when needed

Saved records

Account, project, report, billing, audit records

04
Exported to user

User output

Reports, downloads, self-hosted package

05
Cleanup policy

Cleanup

Temporary sessions and short-lived artifacts

Inputs stay reviewable
Temporary work is labeled
Retention exceptions are visible
Storage posture
Broker secrets
Not permanently stored by default
Raw market data
Temporary/session-limited by default
Generated package
Short-lived download artifact
StrategySchema
Stored when user saves strategy
Logs
Security and audit limited
No permanent broker-secret storage by defaultTemporary historical-data sessionsUser-controlled exportsClear retention rulesPolicy may be updated

Privacy policy for Stockey users

This page explains how Stockey may handle account data, strategy material, broker historical-data sessions, CSV uploads, AI-assisted review inputs, support messages, billing records, and exported package artifacts. It should be reviewed by qualified counsel before legal reliance and may be updated as the product, providers, and legal obligations evolve.

Broker secrets are not stored permanently by default
Temporary data is handled for requested workflows
Payment data is handled through payment providers
AI-assisted review may process user-submitted material
Users control exported packages and local configuration
Legal review still required before reliance

Privacy posture board

A compact view of the data posture: collect what the product needs, avoid permanent broker-secret storage by default, and keep exported package control with the user.

Broker secrets

Broker credentials are intended for temporary historical-data sessions or user-local exported packages. Stockey does not permanently store broker secrets by default.

Temporary sessions

Broker historical data and CSV processing should be session-limited by default unless saved or needed for an export/report flow.

AI-assisted review

AI features may process prompts, strategy rules, scripts, reports, and review notes. Users must review output before use.

Restricted data

Do not upload confidential, unlawful, restricted, third-party, or market-data content you are not allowed to process.

Self-hosted output

Generated Python packages are downloaded and self-hosted by the user. Users handle local credentials, servers, logs, and environment security.

Legal review

This page is product guidance and should be reviewed by qualified counsel before legal reliance.

Data collection index

The table keeps the existing privacy meaning, but organizes it as an operational data map for account, strategy, upload, testing, package, payment, support, and security data.

Account and strategy records

Account data

storage posture

Examples: Name, email, login event metadata, session identifiers, user ID, account status.

Use: Account access, authentication, support, billing, and security.

Posture: Stored while account is active or where legally required.

Strategy data

storage posture

Examples: Strategy name, rules, parameters, assumptions, risk settings, StrategySchema.

Use: Build, test, review, version, and export strategy packages.

Posture: Stored when the user saves a strategy or export flow requires it.

Uploaded scripts

storage posture

Examples: Pine scripts, pasted strategy logic, notes.

Use: Conversion review, assumption extraction, and StrategySchema generation.

Posture: Stored temporarily or with saved project depending on user action.

Historical testing inputs

CSV uploads

storage posture

Examples: OHLCV data, instrument data, custom market data files.

Use: Historical testing.

Posture: Temporary/session-limited by default unless saved/exported by user.

Broker historical-data session data

storage posture

Examples: Broker account connection metadata, selected instruments, historical candles, data availability results.

Use: Fetch historical data and run tests.

Posture: Temporary/session-limited by default.

Historical test data

storage posture

Examples: Test configuration, metrics, logs, reports, charts, result summaries.

Use: Historical testing, review, export, and user records.

Posture: Stored when user saves or package/report flow requires it.

AI and package artifacts

AI interaction data

storage posture

Examples: Prompts, strategy summaries, AI outputs, review notes, generated explanations.

Use: AI-assisted review, debugging, optimization ideas, and product quality.

Posture: Stored according to account/project settings and policy.

Generated package data

storage posture

Examples: Package manifest, generated files, example configuration values, export logs, download status.

Use: Create and deliver user-owned package artifacts.

Posture: Short-lived download artifact unless retained for account/export records.

Commercial and support records

Payment data

storage posture

Examples: Plan, invoice, payment status, processor references, tax/billing records.

Use: Billing, unlocks, refunds, disputes, and tax/accounting.

Posture: Handled with payment processor and retained as required.

Support data

storage posture

Examples: Messages, screenshots, issue descriptions, contact details.

Use: Answer support requests and troubleshoot issues.

Posture: Retained as needed for support, audit, and legal records.

Security/audit data

storage posture

Examples: IP-related metadata, device/session metadata, login events, abuse indicators, system logs.

Use: Security, fraud prevention, abuse detection, reliability, and audit.

Posture: Retained according to security/legal needs.

Boundary vault

Stockey is not designed as a permanent raw market-data warehouse or broker-secret vault. Users must not upload data they are not allowed to process.

Not stored by default

The boundary is a single product posture, not eight separate features.

Broker passwords and API secrets
Raw broker historical data as permanent product storage
Full self-hosted package credentials
User-local .env values
Order-capable credentials inside the SaaS app
Client-money information
Portfolio custody information
Third-party confidential data unless user submits it
storage boundary
broker secretsnot stored by default
Stockey SaaS ordersnot placed
historical datatemporary session
exported .envexample values
package environmentuser-controlled

Broker historical-data session timeline

Users may choose to connect broker access to fetch historical data. Access is for user-requested historical-data sessions, and exported packages use user-local configuration values.

1

Connect

User authorizes access for a specific historical-data setup flow.

2

Fetch

Stockey may request selected instruments and historical candles for the user-requested test.

3

Test

Data is processed for historical testing and report generation.

4

Export

Generated packages use example values such as .env.example.

5

Cleanup

Temporary session data should be cleaned up under the final retention policy.

Stockey does not place, modify, or cancel orders from the SaaS app, and it does not permanently store broker secrets by default. Broker authentication, tokens, permissions, rate limits, and availability are controlled by the broker. Users must follow broker terms and data-use rules.

CSV data checks

CSV uploads may be checked for missing rows/candles, format errors, and availability issues. Results are diagnostic and not predictive.

csv_inspector.preview
timestampRequiredTimezone and candle alignment checked
instrumentRequiredSymbol/instrument naming checked
open high low close volumeExpectedOHLCV format and missing rows checked
custom columnsOptionalUsed only when strategy logic requires them

Market-data file boundary

Users may upload CSV files for historical testing. Users must have rights to use uploaded data. Stockey is not a permanent raw market-data warehouse. Cleanup and retention depend on final product policy and account settings.

Do not upload restricted, confidential, licensed, third-party, or unlawfully obtained market data.

Strategy-to-package pipeline

Stockey may process user strategies into StrategySchema, reports, AI summaries, package manifests, and generated Python files. Users are responsible for reviewing all generated artifacts before relying on them.

step 01

Strategy rules

User defines logic, parameters, and assumptions.

step 02

StrategySchema

Rules are structured for testing and export.

step 03

Historical report

Metrics, costs, slippage, and warnings are reviewed.

step 04

Package artifact

Generated package uses example values and dry-run-first guidance.

step 05

User environment

Self-hosted environment remains user-controlled.

Generated packages should default to dry-run-first configuration unless deliberately changed by the user in their own environment.

AI boundary

AI-assisted processing can help explain, review, and summarize user-provided material, but users must review AI output before use.

AI inputs

AI features may process prompts, strategy rules, scripts, reports, test outputs, assumptions, and review notes.

AI outputs

AI may generate explanations, summaries, risk reviews, optimization ideas, documentation drafts, and package notes.

AI limits

AI output may be inaccurate, incomplete, unsuitable, or outdated. It is not investment advice, legal advice, tax advice, broker advice, portfolio advice, or a recommendation to trade.

Payments and billing data

Stockey may use payment processors for plans, exports, credits, support, or deployment handoff services. Payment providers may process payment details under their own terms.

Processor role

Payment processors may collect and process payment method details under their own terms.

Stockey records

Stockey may store payment status, invoice references, plan status, refund status, tax records, and billing support records.

Payment provider role

Payment privacy details may be updated as billing providers and policies evolve.

Audit event stream

Stockey may collect limited logs and audit records for security, reliability, support, legal, billing, and abuse-prevention needs.

authenticationabuse preventiontroubleshootingsystem reliabilityfraud preventionsecurity monitoringlegal and compliance needsbilling disputespackage export historysupport investigations
Security logs may be retained longer where needed to protect the platform, investigate abuse, resolve disputes, or meet legal obligations.

How data may be used and shared

Use categories

  • Provide and operate the platform
  • Build and save user strategies
  • Run historical tests
  • Generate reports
  • Support AI-assisted review
  • Generate packages
  • Process payments
  • Provide support
  • Improve reliability and security
  • Prevent misuse
  • Comply with legal obligations

Limited sharing categories

  • hosting/cloud infrastructure
  • authentication/email providers
  • AI model providers
  • payment processors
  • analytics/security tools
  • support systems
  • legal/accounting/compliance advisors
  • authorities where legally required
Stockey should not sell user strategy content, broker credentials, or uploaded market data as a data product.

Responsibilities and choices

Users remain responsible for account protection, data rights, generated artifact review, and self-hosted environment security.

User responsibility rail

Users must not submit restricted data and must review AI output, generated packages, broker permissions, and self-hosted environments before use.

Users must

  • provide accurate account information
  • protect their account
  • avoid uploading restricted/confidential data
  • ensure they have rights to uploaded scripts/data
  • review AI output
  • review generated packages
  • secure self-hosted environments
  • configure broker credentials locally
  • follow broker, data, exchange, tax, and legal obligations
  • request deletion/export where available and legally permitted

Rights and choices

  • access account data where available
  • update account details
  • delete saved projects where available
  • request support for deletion/export
  • manage communications
  • avoid submitting optional data
  • disconnect broker access where supported
  • control exported packages outside Stockey

Retention lifecycle

Deletion may not remove records required for legal, tax, security, billing, audit, backup, or dispute purposes.

phase 1

Input

User submits strategy, script, CSV, broker session request, or support message.

phase 2

Temporary processing

Files and historical data may be processed for the requested workflow.

phase 3

Review/export

Reports, AI-assisted review, and package artifacts may be produced.

phase 4

Cleanup or saved record

Temporary data should be cleaned up unless saved or needed for account/export records.

phase 5

Required retention

Payment, tax, security, legal, audit, backup, and dispute records may remain longer.

Compact legal grid

These policy areas explain how privacy choices, updates, and support routing may work.

User rights and choices
Specific rights depend on applicable law and the locations where Stockey operates.
Children and restricted users
Stockey is intended for users who can legally use strategy engineering, historical testing, and trading-related software in their jurisdiction.
International processing
Stockey and service providers may process data where infrastructure, support, AI, payment, or security providers operate.
Policy changes
The updated version should show an effective date. Where required, users may be notified of material changes.
Contact
Privacy and account data questions can be routed to [email protected] or [email protected].
Legal review
Contact details, entity details, vendor terms, retention periods, and jurisdiction language should be reviewed by qualified counsel before legal reliance.
Build with privacy boundaries

Build with privacy boundaries, not hidden data assumptions.

Use Stockey with clear awareness of broker data sessions, AI-assisted processing, uploaded files, generated packages, and self-hosted environment responsibility.

Start strategy builderRead terms