Privacy Policy

The short version

Zen Trader reads your trading history so it can show you your own behaviour. It cannot trade or move money. We do not sell your data and we do not run advertising trackers. You can delete your key, your accounts or everything at any time.

What we collect

• Account: your email address, and your Google account name and picture if you sign in with Google.
• Bybit connection: a read-only API key and secret that you paste in. They are encrypted before they are stored and are never sent back to your browser.
• Hyperliquid connection: your public wallet address. No key, no signature.
• Trading data fetched from the venues you connect: fills, closed P&L, funding payments, deposits and withdrawals, open positions and balances.
• What you write: your rules, journal entries, notes, tags and screenshots you upload.
• AI usage: when you use an AI feature, the text you send and a log of the request (time and feature) for rate limiting.
• Alerts: your Telegram chat ID if you link Telegram.
• Technical data: our hosting provider sees your IP address and browser details when you load the site, and we see aggregate visit statistics (page, referrer, country, device type).

Why we use it

• To run the service you asked for: syncing your history, checking it against your rules, and showing reports and alerts (performance of a contract).
• To keep the service secure and prevent abuse, such as rate limits and key checks (legitimate interest).
• To meet legal obligations where they apply.

We do not use your trading data for advertising and we do not use it to train AI models.

Who processes it for us

• Lovable Cloud (Supabase): database, sign-in and file storage.
• Cloudflare: hosting and network security.
• AI model providers, currently Google and OpenAI, reached through Lovable's AI gateway: they receive the text, statistics or screenshot needed to answer the specific AI request you make.
• Bybit and Hyperliquid: we call their APIs with your key or address to read your data.
• TradingView and CoinGecko: chart widgets and market data shown in the app.
• Telegram: only if you link it, to deliver alerts.

Some of these providers may process data outside the European Economic Area. Where they do, they rely on the safeguards they publish, such as standard contractual clauses.

How long we keep it

Until you delete it. Deleting a connected account removes that connection and, if you choose, its stored history. "Delete my account and all data" in Settings removes everything we hold about you, including your sign-in.

Your rights

If you are in the EU or the UK you can ask for access to your data, a copy of it, correction, deletion, restriction, and you can object to processing. You can also complain to your data protection authority. Most of this you can do yourself in the app; for anything else, contact us.

Cookies and local storage

We keep your sign-in session in your browser's local storage. Cloudflare may set a security cookie to tell people from bots. We set no advertising or cross-site tracking cookies.

Changes

If this policy changes in a way that matters, we will say so in the app before the change takes effect.

Who operates Zen Trader

VR Express OOD (company number 203447777, VAT BG203447777)

ul. Strandzha 58, 1303 Sofia, Bulgaria

hello@vrexpress.io