Security and your data
What we store, where it lives, and how your broker logins are protected.
Updated
Your broker logins
Your broker logins never leave your computer. Our server never sees them.
- Tradovate: you log in on Tradovate's own page, inside the app. We never see your password. The session stays in memory while the app runs and is never written to disk.
- Rithmic: your username and password are kept in the system keychain on your computer.
- TopstepX: your username and API key are kept in the system keychain on your computer.
- Your Telegram bot token, if you use Telegram alerts, is kept in the system keychain too.
The system keychain is the encrypted store your operating system keeps for passwords.
Orders
Orders go from your computer straight to your broker. Our servers never place orders, and your trades are not sent to us.
What our server keeps
- Your email, a password hash (never the password), your plan and your computer.
- Payment data stays at Stripe.
- Crash reports are off unless you turn them on in Settings › App.
Full details: privacy policy.
The app itself
- Download the app only from our site or your account page. We never send installers by email or chat.
- The first time you open it, macOS asks you to confirm in System Settings. That is a one-time step.
- The app tells you when a new version is out. You choose when to install it.
Protect yourself
- Use a strong, unique password for us and for your broker. Turn on two-factor login at your broker.
- Download the app only from /download.
- We will never ask for your broker password, API key or 2FA code by email, chat or Discord.
Report a problem
Email [email protected]. This mailbox is only for security reports. Please do not include passwords or keys.