Read the TraderSpy privacy policy: what we collect, how the AI agent, routines and connectors use your data, what a share link makes public, and how we protect it.
Effective Date: October 10, 2026
Introduction
This Privacy Policy explains how TraderSpy ("we," "us," or "our") collects, uses, shares, and protects your personal information when you use our website at traderspy.app, our mobile applications, our MCP connector for AI assistants such as ChatGPT and Claude, and any related services (collectively, the "Service").
By accessing or using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.
Who We Are
TraderSpy is a crypto futures market research platform: we provide an AI agent and market data. The Service includes AI-generated market signals, smart money tracking, custom strategy alerts, an AI research agent with scheduled routines, and paper trading with virtual funds. Where you connect other services to the agent through MCP connections you add (connectors), the functions and data those connections provide come from the services you connect. TraderSpy is operated by T1M LLC. We operate the website traderspy.app and companion mobile apps for iOS and Android.
Data We Collect
We collect the following categories of personal data:
Account Information: Email address, display name, and authentication credentials (password hash, or OAuth tokens from Google/Apple sign-in). If you enable two-factor authentication, we store your TOTP secret.
Strategy and Alert Settings: Strategy configurations, alert rules and preferences, watchlists, AI alert preset settings, and automation settings.
Smart Money Preferences: Followed trader selections and follow notification preferences.
Usage & Signal Data: AI signal history, strategy alert history, notification history, auto-trade position history, and agent chat session history.
AI Agent Content: Your conversations with the AI agent (your messages and its answers), the custom instructions, default model and default effort level you set for it, and the routines you create — their instructions, schedules and delivery settings — with the reports they produce.
Projects: The projects you create to group your conversations: their names and instructions, and which conversations belong to each.
Memory Notes: While memory is on, the short notes the agent saves about what you tell it about yourself and your preferences (for example a preferred timeframe or the coins you follow), and the notes you add yourself.
Share Links: For each answer you publish with a share link, a snapshot of that answer (its title and text), the conversation it came from and when you created the link.
Uploaded Files: Images and documents you attach to a message for the AI agent.
Connectors (previously called data sources): For each third-party MCP server you connect, its address and name, the tools it offers, the permission you chose for each tool, and any credential you give us for it (stored encrypted). When the agent asks for your approval before using a tool, the request (the connector, the tool and the inputs it would send) and your answer are kept in the conversation.
Connector Orders: When you confirm a trading action on a venue you connected, we keep a record of it: the venue, the order as you confirmed it (for example the market, side, amount, leverage, take-profit and stop-loss), what TraderSpy found when it checked the order with the venue, whether TraderSpy first changed a setting on the venue to carry it out (for example the leverage you asked for), the result, the venue's message and order reference, and the reference TraderSpy sent with the order. We keep this record to show what was sent on your instruction, to prevent duplicate orders and to answer your questions about an order. It never contains your connector credential.
AI Usage and Credit Records: For each AI request, when it was made, which feature made it, the AI model, the number of tokens processed, its cost and the credits charged, how long it took and whether it succeeded; and your credit balance with its movements (allowances, credits used, packs and adjustments). These records never contain the text of your questions, the answers or your files.
Device & Technical Data: Device type, operating system, push notification tokens (Firebase Cloud Messaging), IP address, and browser user agent.
Payment Data: Your plan and subscription status, payment and customer identifiers from Stripe (including your Stripe customer ID), credit pack purchases, and Solana blockchain transactions. We do not store full credit card numbers — card payment processing is handled entirely by Stripe, our Merchant of Record.
MCP Connector Data: When you use TraderSpy through an AI assistant connected to our MCP server, we receive your tool queries (e.g., signal lookups, trader searches). We log these requests for rate-limiting and abuse prevention.
How We Use Your Data
We use the data we collect for the following purposes:
Service Operation: To authenticate your account, deliver signals and alerts, run the routines you set up, sync your settings across devices, and — for accounts that still have live trading — carry out the orders they place.
Notifications: To send you push notifications (FCM), Telegram alerts, email notifications, and in-app notifications based on your configured alert preferences and routines.
AI Features: To evaluate AI alert presets against market data, generate and score signals, answer you in the AI agent at the effort level you choose, run your routines, read the files you attach, personalise answers with your memory notes and project instructions, publish the answers you choose to share, and use the tools of the connectors you add, as you allow.
Credits and Billing: To measure AI usage, charge and show your credits, apply the limits of your plan, and process payments and refunds.
Service Improvement: To monitor system performance, debug issues, and improve the accuracy of signals and features.
Security & Abuse Prevention: To detect and prevent unauthorized access, rate-limit API usage, and protect the integrity of the platform.
Customer Support: To respond to your inquiries and resolve issues related to your account.
Legal Basis for Processing
We process your personal data based on the following legal grounds:
Contract Performance: Processing necessary to provide the Service you signed up for (account management, alerts, AI features, billing).
Legitimate Interest: Processing for security, fraud prevention, service improvement, and analytics, where our interests do not override your rights.
Consent: Where required by law, such as for marketing communications or optional analytics. You may withdraw consent at any time through your account settings.
Data Sharing & Third Parties
We share your data only with the following categories of service providers, and only to the extent necessary to operate the Service:
Cloud Infrastructure: MongoDB Atlas (database hosting, including the files you upload), Redis/cloud hosting (caching and real-time data).
Authentication: Google OAuth, Apple Sign-In, and Firebase Authentication for secure sign-in.
Payment Processing: Stripe, Inc. and its affiliates, our Merchant of Record for card payments for plans and credit packs, operating through Link (link.com). Stripe receives your payment details directly — we only store subscription, payment and customer identifiers. Subscriptions taken out under a previous card processor are still billed by that processor under the same terms.
Push Notifications: Firebase Cloud Messaging (FCM) for mobile and web push notifications.
Messaging: Telegram Bot API for optional Telegram alert delivery; Amazon SES and SendGrid for emails.
AI Services: Amazon Web Services (AWS), through Amazon Bedrock, runs the AI models behind the AI agent, routines and AI signal reviews. The models are made by Anthropic (Claude), OpenAI (GPT) and DeepSeek; which model handles a request depends on the feature, your plan and, where you can choose a model, your choice. Requests are processed in AWS data centres in the United States. For each request we send what the model needs to answer it: your message and the conversation so far, files you attach, your custom instructions, the instructions of the project the conversation belongs to, your memory notes while memory is on, the market data the agent looks up, account data it reads to answer you (for example your strategies, followed traders, watchlist or paper-trading account), and results from connectors you added. Under AWS's terms for Amazon Bedrock, this content is not used to train AI models and is not shared with the model's maker. AWS may check requests automatically to detect abuse; for some models, OpenAI's among them, it may keep a request that these checks flag, with its answer, for up to 30 days for that purpose.
Connectors You Add: When the AI agent uses a connector you added — with a tool set to "Always allow", or a call you approved — our servers send that server the request the agent chose: the tool's name and the inputs it filled in, which can include words from your question and the details of what you asked the agent to do there. For a trading action, that is the order you confirmed, with the reference TraderSpy gives it; to check the order before showing it to you and again before sending it, our servers also ask the venue for the account and market data that check needs (for example your balance, your open positions and the leverage set there). The credential you gave us for that connector goes with every request. We do not send it your email address or your conversation history. The connector is run by a third party you chose: the functions its tools perform and the data they return come from that service, which handles what it receives under its own terms and privacy policy.
Share Links: When you publish an answer with a share link, anyone who has the link can read that snapshot (its title and text), and we ask search engines not to index it. A share page never shows your question, the rest of the conversation, your name or your email address.
Exchange APIs: Binance, Hyperliquid, Bybit, and OKX APIs for market and smart money data, and Hyperliquid for carrying out the orders of accounts that still have live trading.
News: We read public news feeds (such as CoinDesk and Cointelegraph) to show market headlines; nothing about you is sent to them.
We do not sell your personal data to any third party. We do not share your data with advertisers.
AI Agent, Routines, Memory, Share Links, Your Connectors & Our MCP Connector
AI agent and routines: Your conversations — your messages, the agent's answers and the steps it took — are stored in your account so you can return to them, and routines store their instructions and the reports they produce. Requests are processed by the AI models described under "AI Services" above. Custom instructions, project instructions and memory notes shape the agent's answers but cannot change its research-only rules.
Staff access: Authorized TraderSpy staff can open your conversations with the AI agent when that is needed to give you support, to investigate abuse or a security issue, or to comply with the law. Every such access through our admin tools is recorded in an audit log.
Uploaded files: Files you attach to a message are stored in our database, can be opened only from your own account, are sent to the AI model when it answers, and are deleted automatically 30 days after upload.
Projects: A project's name and instructions are stored in your account. Its instructions are sent to the AI model as context with each message in that project's conversations. Deleting a project keeps its conversations: they return to your chat list.
Memory: Memory is on unless you turn it off in Settings. When memory is on, the agent can save short notes about what you tell it about yourself and your preferences — for example a preferred timeframe or the coins you follow — and uses them to personalise later answers; the chat shows when a note was saved. While memory is on, your notes are sent to the AI model as context with each chat message. In Settings you can see every note, add one, delete one or all of them, and turn memory off; while memory is off, notes are neither used nor saved. The agent is instructed never to save passwords, API keys or similar secrets, and we refuse to store a note that looks like one. You can keep up to 50 notes.
Share links: You can publish one answer of your own conversation as a read-only page with its own link. We store a snapshot of that answer — its title and text — as it was when you shared it, and anyone with the link can read it. The snapshot never includes your question, any other message of the conversation, your name or your email address. Only answers built from TraderSpy's public market data can be shared: an answer that used your own data (such as your watchlist, strategies, routines, paper account or memory notes), a connected service or attached files cannot be. Neither can a later answer of a conversation in which the agent did so, because it was written with that conversation in front of it. An answer written with your memory notes, your project instructions or your custom instructions is shared only after you confirm that you checked it, and never when it repeats one of them word for word. You can delete a link at any time in Settings; deleting the conversation or your account deletes its links.
Connectors (previously called data sources): A connector is an MCP connection you add to another service; the functions its tools perform and the data they return come from that service. A credential you give us for a connector — an API key, a header value or a sign-in token — is stored encrypted, used only to call that server for you, never shown back to you or given to the AI model, and deleted when you remove the connector. When you sign in to a connector, we ask that server for every permission it offers; you can narrow them on the server's own sign-in or consent page, if it lets you. Whatever the server grants, the agent can use only the tools described next. The agent can use a connector's tools that only read data and, on a trading venue TraderSpy has integrated, its trading actions (opening or closing a position, setting a take-profit or stop-loss, cancelling an order); every other tool that could change something there stays off, and tools that deposit, withdraw or transfer funds are never available. For each tool you can use, you choose whether the agent may use it without asking ("Always allow"), only after you approve each call in the chat ("Ask first"), or never ("Off"); a trading action can only be set to "Ask first" or "Off". To tell a tool that only reads data from one that could change something, the names and descriptions of the server's tools are analysed automatically, including by an AI model; a tool that could not be confirmed to only read data stays off unless it is one of the venue's trading actions. For a tool set to "Ask first", nothing is sent until you approve the request shown in the chat; for a trading action, TraderSpy first checks the order with the venue and shows you what it found. Routines do not use connectors. We do not keep the raw results a connector returns: what remains is the agent's answer in your conversation.
AI usage records: We record usage metadata for every AI request (see "Data We Collect") to charge credits, show you your usage, prevent abuse and keep the Service running. These records never contain the text of your questions or of the answers.
Research pages: The research reports we publish at traderspy.app/research are written by TraderSpy — they may be prepared with the help of AI and are reviewed by our staff before they are published — and are never made from your conversations.
MCP connector: TraderSpy also offers a Model Context Protocol (MCP) connector that lets AI assistants such as ChatGPT and Claude query our platform on your behalf. We receive your tool queries (e.g., "get signals for BTCUSDT," "show top traders") and process them to return the requested data, and we log request metadata (timestamp, user identifier, tool name) for rate-limiting and abuse prevention. Data returned through the connector is read-only — no trades are executed and no account settings are modified through this channel. Authentication uses either OAuth 2.0 tokens or API keys. Every request is verified against a SHA-256 hash of the key; the key itself is additionally stored encrypted, so you can display it again from your settings instead of regenerating it.
We do not use your conversations, files, memory notes, project instructions, routine reports or connector results to train AI models.
Data Retention
We retain your data for as long as your account is active and as needed to provide the Service:
Account Data: Retained until you request account deletion.
Trading Signal & Alert History: Retained for up to 12 months for historical analysis, then archived or deleted.
AI Agent Conversations: Kept while your account is active so you can return to them; archiving a conversation only hides it. If you delete a conversation, it is removed for good, together with its share links; you can also ask privacy@traderspy.app to delete specific conversations.
Routine Runs and Reports: Kept for up to 90 days. The first line of each report is also the text of its in-app notification, which stays in your notification history while your account is active.
Uploaded Files: Deleted automatically 30 days after upload.
Projects: Kept until you delete the project or your account; deleting a project keeps its conversations.
Memory Notes: Kept until you delete them or your account; deleting a conversation does not delete them.
Share Links: Kept until you delete the link; deleting its conversation or your account deletes it.
Connector Credentials: Kept until you remove the connector or delete your account.
Connector Orders: Kept for up to 400 days, then deleted automatically; deleting your account deletes them sooner.
AI Usage and Credit Records: Kept for 400 days, then deleted automatically.
Technical Logs: Server and access logs are retained for up to 90 days.
Candle Market Data: Stored in Redis as transient cache data (up to 1,000 candles per trading pair) and automatically rotated.
After account deletion, we remove your personal data within 30 days, except where retention is required by law.
Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
Access: Request a copy of the personal data we hold about you.
Correction: Request correction of inaccurate personal data.
Deletion: Request deletion of your account and associated personal data.
Data Portability: Request your data in a structured, machine-readable format.
Restriction: Request that we restrict processing of your data under certain conditions.
Objection: Object to processing based on legitimate interest.
Withdraw Consent: Where processing is based on consent, withdraw it at any time.
To exercise any of these rights, contact us at privacy@traderspy.app. We will respond within 30 days. You may also delete your account directly from the Settings page in the app, which will initiate removal of all associated personal data. In Settings you can also see, add and delete the agent's memory notes, turn memory off, and delete your share links.
International Data Transfers
Your data may be processed in countries outside your country of residence, including the United States and the European Union, where our infrastructure providers operate. Requests to AI models are processed by AWS in the United States. A request to a connector you add goes to wherever its operator runs that server. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses where applicable.
Cookies & Analytics
Our website uses essential cookies required for authentication and session management. We use Firebase Analytics for basic usage tracking in the mobile app (screen views, feature usage).
We do not use third-party advertising cookies or tracking pixels. We do not serve ads on the platform.
Security
We implement industry-standard security measures to protect your data:
Platform wallet keys and connector credentials are encrypted at rest.
Requests to connectors leave only from our servers and only to public internet addresses, and a connector's tool is called only when it is set to "Always allow" or you approved that call.
All data in transit is encrypted via TLS/HTTPS.
Authentication uses JWT tokens with short expiration and refresh token rotation.
Two-factor authentication (TOTP) is available for additional account security.
Access to production systems is restricted to authorized personnel.
While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We encourage you to use a strong, unique password and enable two-factor authentication.
Children's Privacy
The Service is not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 18, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at privacy@traderspy.app.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Effective Date" at the top of this page and, where appropriate, through in-app notifications or email. Your continued use of the Service after changes become effective constitutes your acceptance of the updated policy.
Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:
Email: privacy@traderspy.app
You may also use the Help & Support page within the app to reach our support team.
RSI, Stochastic, Stochastic RSI, Williams %R, CCI, MFI, ADX, ROC, ATR, OBV, MACD, EMA, SMA, VWAP, Bollinger Bands, SuperTrend, Parabolic SAR, Ichimoku Cloud, golden and death crosses, divergences, volume spikes, breakouts and 17 candlestick patterns
BTCUSDT, ETHUSDT, SOLUSDT, BNBUSDT, HYPEUSDT, XRPUSDT, DOGEUSDT, ADAUSDT, AVAXUSDT, LINKUSDT, LTCUSDT, DOTUSDT, NEARUSDT, ATOMUSDT, SUIUSDT and 500+ more crypto perpetuals on Binance futures and Hyperliquid