Privacy

The controller of this website and of the NexoTrade app for iPhone and Android is TRADEAUDIT SLU, an Andorran company (NRT L-721380-S, registered office: Antic Carrer Major 26, 2n 2a, AD500 Andorra la Vella, Andorra).

You need an account to use the tools. Without an account we don’t ask you for any personal data, unless you sign up for the Monday newsletter or report something in the community (we explain this below).

Your account

If you create an account, we store your email address, the date you signed up and the date of your last access. If you sign in with Google or Apple, they give us your email address; Google also gives us your name and profile picture, and Apple your name if you choose to share it. With Apple you can hide your email: we then get an Apple address that forwards what we send you. We use them only so you can sign in to your account: we don’t sell them or use them for advertising.

For each open session we store when it started, when it was last used, the IP address and the browser or app you signed in from. We use this for security and to show you in Settings › Your sessions which devices your account is signed in on (“Chrome on Windows”, “Android app”), without the IP, so you can sign out of the others.

With your account we also store what you create in it: your alerts, your calculator templates, your notifications, your notification preferences and the coins you choose to see on Home.

When you create your account we ask you a few optional questions: your trading level, how often you trade, what you trade, what you are looking for here and how you heard about us. You can skip them or choose not to answer, and change your answers whenever you like. We store them with your account and use them only to understand who uses the app and to improve it: we look at them added up, not one by one.

If you link the UID of your account on an exchange, we store the exchange, the UID and whether it has been verified, and we use that UID’s trading volume to calculate your rank. For the rank we don’t store your balances, your trades or any key to your exchange. To prevent abuse, all we keep of your email address is a fingerprint (a digest from which the address cannot be recovered) that helps us see whether two accounts are too similar.

We get the trading volume and whether your UID is opened with the code from CryptoBruj’s commissions panel, since CryptoBruj is the one who receives the commissions from the exchanges. If you’ve just opened your account on the exchange and the panel doesn’t have your UID yet, we ask the exchange itself at that moment: we only send it your UID and we don’t store its answer. For Bitget, the question goes through a server of the panel, which doesn’t store anything either. For each account, that panel reads from our database the sign-up date, the language, the channel it came through, the email fingerprint, the linked UIDs and the rank, never the email address or the name, in order to match each UID with its account and count sign-ups on the exchanges. Of the rest (the sign-up questions, the steps we measure) it only receives added-up figures.

To get into the app you need at least 100 USDT in your exchange account opened with the code. The commissions panel tells us, or we ask the exchange itself, sending only your UID. From its answer we only use whether you have them or not: we don’t store your balance or the amount, only the day we first saw you had them, which is when your account was activated. If your exchange doesn’t give us the balance, we store instead the day we saw you trade with the code.

If you connect an exchange account for TradeAudit (the analysis of your trading), we store its read-only API key, encrypted (only its last four characters can be seen), the futures positions you’ve already closed on that account, the status of the last sync and the notes and tags you add to those trades. We use this only to show you your analysis, which nobody else sees. If you create a liquidation alert, we also read your open positions on those accounts every few minutes and store only the ones close to liquidation (the pair, the side, the price and the liquidation price), to notify you: each reading replaces the previous one, and they’re deleted when you delete or pause the alert. Only our service on Cloudflare decrypts the key, while it uses it, and it signs each request to the exchange. The requests go out to the exchange from a server in the European Union with a fixed IP address, which only forwards them and stores nothing. If the exchange tells us the key can trade, transfer or withdraw, we don’t store it. When the exchange doesn’t tell us, as with Bitunix, we ask you to confirm that you created it as read-only. We only connect accounts opened with the code: when you connect it, the exchange tells us which account it belongs to (its UID) and we check it against your linked UIDs or the commissions panel and, if the panel doesn’t have it yet, with the exchange itself, just as when you link a UID. We don’t store that UID. Bitunix doesn’t tell us: to connect Bitunix you need a linked Bitunix UID opened with the code. When you delete the connection or your account, the key, those trades and their notes and tags are deleted immediately.

We write to you to send you the access code when you request it and, by email, your account notifications (your rank, your UID, your alerts and moderation decisions about your content) and team announcements. Product news and what happens in the community (a mention, a reply) arrive by default only inside the app, and promotions only if you turn them on. Each type of notification can be turned off in Settings or with the link at the end of each email.

In the mobile app, if you accept notifications, we store the identifier your phone gives us to send them to you. You can turn them off in your phone’s settings or in the app’s settings. On the website, if you turn on notifications in a browser, we store the address that browser gives us to send them to it, with the keys to encrypt them, whether it’s a phone and which session you turned them on with. You turn them off in Settings › Notifications or in your browser’s settings. If you connect Telegram in Settings › Notifications, we only store the number of your chat with our bot, to send your alerts there: we don’t store your phone number, your name or what you write in that chat. You disconnect it in Settings › Notifications, by sending /stop to the bot or by blocking it.

If the mobile app closes by itself or a screen fails, it sends us a crash report: what failed in the code, on which screen, the app version, the phone’s model and system and a random number for that installation. It doesn’t include your email address, your account or your IP, or what you had on the screen. We use it only to fix the app.

Cloudflare, which serves the website, sees your IP address and your country in order to deliver the page to you and choose the offer that applies to your country. We don’t store them. When you request the sign-in code or sign up for the newsletter, Cloudflare Turnstile also looks at some data from your browser and your device to check that you’re a person and not a program. Cloudflare doesn’t use it to identify or profile you, and we don’t store it.

If you ask Robin, the website’s help assistant, what you write, the page you’re on, your country and your language are sent to Anthropic so it can generate the answer. We don’t keep the conversation: it stays in your browser while the tab is open. Before sending it, we remove anything that looks like a key or a seed phrase. So that nobody can ask endless questions, we count how many arrive each day from the same connection using a code we derive from your IP address with a key of ours and the date, so it is only valid for that day, never the IP itself. Only the current day’s count is useful to us: the counts of earlier days are deleted with the first question that arrives afterwards.

If you request a TradeAudit AI analysis, we send Anthropic the already-calculated figures of your closed trades in the period you choose (the result, the win rate, the fees, the pairs, the days and the hours, and a few trades with their pair, side, date and result) and your language, so it can write the report. Never your key, your UID, your email address, your accounts or your journal notes. We store the report and those figures in your account so you can read it again and compare it with the next one: only you see it, we keep the 30 most recent and you can delete any of them whenever you like. So that spending has a limit, we record when you request each one, and that’s deleted after 40 days.

If you report a bug with the button in the top bar, we store what you write, linked to your account, the page you were on, the name of your device (for example, “Chrome on Windows”: neither your IP nor other details of your browser) and your language. Before storing it, we remove anything that looks like a key, and if it looks like a seed phrase we don’t store it. We use it only to look into the bug, fix it and answer you in your notifications. The team reviews it with the help of an AI assistant from Anthropic, which reads the report. You can see it in “Download my data”, it is deleted with your account and, otherwise, one year after we answer you.

When you tap an exchange button, we record the exchange, the channel you came through, your country and the time. If you’re not signed in, none of that identifies you; if you are, it’s linked to your account by an internal number, like what’s described in the next paragraph.

To know what works, we record some steps within the website and the app: which tool you open, whether you come across a locked section, whether you start signing in or unlocking and, with your account, whether you link a UID or move up a rank. We store this with the channel you came through and your region, without your email address, your UID or your IP. If you have an account, it’s linked to it by an internal number, and once you delete the account it no longer is. In your account we also store the first channel you came through and the last one.

If you enter a giveaway, we store your entry with a code specific to that giveaway and the tickets you get. So that anyone can verify the giveaway, we publish the list of codes with their tickets, never your email address. If you win, we use your account’s email address to give you the prize. If you enter the code from a live stream, we record that you were at that live stream.

If you play, we store your points (which action earned you each one and when: opening the app, using a tool, finishing a guide, completing a mission, joining a live stream or playing the weekly prediction and getting close to the price) and your badges. In the tournament we store the price you predict each week, when you entered or changed it and, once the round is settled, your position and your points. Nobody else sees your prediction until the round is settled. Then the public ranking shows your position, your price and your points under a player name that comes from an internal number and doesn’t identify you, never with your email address.

The community

The community (profiles, posts, comments and the chat) can only be seen by members who are signed in: it isn’t open to people without an account and doesn’t appear in search engines.

When you create your account we give you a profile with a random @username, which you can change, just like your name, your photo and your bio. If you want, you can add a trader card (your style, your markets, your experience, what you’re looking for and which exchanges you trade on, by name only), a background and a color from the ones we offer, and up to 3 featured badges. On your profile, other members see your @username, your name, your photo, your bio, whatever you’ve added, when you joined, your rank, your roles, your level title, your badges and how many people follow you and how many you follow. You can hide your rank and your level title from them, as well as how many people you follow. They never see your email address, your UIDs or your trading volume.

What you post in the feed (the text, an image and, if you share a result, its percentage and, if you add them, the pair and whether it was long or short), your comments and your chat messages are seen by the members who can read that part. Of your reactions, others only see how many there are of each type, not who reacted. If you mention someone or reply to them, we let them know. Only you can see the posts you save to read later.

If you delete a post, a comment or a chat message, it disappears straight away, but we keep it for 30 days in case a report or an appeal about it needs to be reviewed. After 30 days we delete it completely: a post goes with the comments under it, including other people’s, and with its image, which is deleted one or two days later. If a report or an appeal is still open by then, we wait until it’s closed; and if the team moderated one of those comments, the post is kept for as long as the moderated content is kept. The image in a chat message you delete is deleted straight away, unless someone has reported the message: then it’s kept with it.

We store who you follow and who you block. Nobody can see the list of who each person follows, not even the team. We don’t tell the person you block: from that moment on, neither of you sees the other’s profile or what the other posts.

Photos (your profile picture and those in the feed and the chat) are kept in private storage and can only be opened with a link that expires after a few hours and doesn’t include your account. If you change or remove your profile picture, the previous one is deleted immediately. Images that are uploaded but never published are deleted within one or two days.

Before what you write is saved, an automatic filter stops sign-up links for other exchanges, links to Telegram, WhatsApp or Discord chats that aren’t the official ones, wallet addresses, the usual scam messages, words filtered by the team and links from recent accounts or accounts without a verified UID. Whatever the filter stops isn’t stored. To stop people who pump a coin or paste the same thing everywhere, it also looks at what you’ve written in the community in the last 24 hours: whether you’ve mentioned the same coin many times, or put the same text in three places, in which case it’s posted, but the team gets an automatic report with what you wrote so it can review it.

If you report something in the community, we store what you report, the reason and your explanation. The team sees who made the report; the reported person doesn’t: they only know that another member reported them.

If the team hides or deletes something of yours, changes something on your profile or sanctions you (a mute or a ban), we store what was done, why, under which rule or law, how it started and who on the team did it, and we send you a notice, also by email, with the reason and how to appeal within 14 days. If you appeal, we store your appeal and the response. While a ban lasts, nobody else sees your profile or what you posted. Whatever is hidden or deleted stays stored, visible to nobody but the team, until you delete your account: that way it can be reviewed if you appeal.

If you report content in the community without an account, we store the address of the content, the reason, your explanation, the language of the page and, if you enter them, your name and your email address, which are optional. We use them only to review the report, to make sure the form can’t be used to flood anyone’s inbox and, if you leave your email address, to confirm that we received it and tell you what we decided. So that nobody can send endless reports, we also store a digest of your IP address made with a key of our own, never the IP itself: it only serves to count how many reports come from the same connection in a day, and we delete it after 24 hours (sooner, if we close the report). The whole report, including your name and email address, is deleted six months after it is closed.

The newsletter

If you sign up for the Monday newsletter without an account, we keep your email address, the language of the page, your time zone (to give you the calendar times in yours), the country you connect from, the page where you signed up, the channel through which you reached the website, and when you ticked the box and with what text. Before sending you anything, we write to you so you can confirm that the address is yours; if you don’t confirm it within 7 days, we delete it. So that the form can’t be used to flood anyone’s inbox, we also keep a summary of your IP address made with a key of ours, never the IP: it only serves to count how many sign-ups come from the same connection, and we delete it when you confirm.

We use it only to send you the newsletter every Monday, the same for everyone: the week’s data on the calendar, the Fear & Greed Index and the tournament, with no advertising and no exchange codes. Every email has an unsubscribe link at the bottom, and your email app’s unsubscribe button works too. When you unsubscribe, we delete your email address and everything we keep with it; of the newsletters we already sent you, all that remains is that they went out, with nothing linking them to you.

What we use your data for and on what legal basis

To give you what you ask for when you create and use your account (signing in, your sessions, what you store in it, the UID and the rank, activation, TradeAudit, the game, the tournament, giveaways, the community and your account notifications), the basis is the contract: the terms of use you accept when you create it.

To protect the website and the people who use it (the IP and browser of each session, the email fingerprint, the anti-fraud notes, blocks, the community filter, the report limit, the newsletter sign-up limit and the limit on questions to Robin), to answer you when you ask Robin, to know what works (the steps we measure and the exchange buttons), to fix the app’s crashes (the crash reports), so that the commissions panel can match each UID with its account and to send you team announcements, the basis is our legitimate interest. You can object by writing to us, and team announcements can be turned off in Settings.

With your consent, which you can withdraw whenever you want: the Monday newsletter, the sign-up questions, mobile and browser notifications, alerts on Telegram, promotions, signing in with Google and YouTube videos.

To comply with the law: reviewing content reports, explaining each moderation decision to the person it affects and keeping a record of it, as required by the European Union’s Digital Services Act, and responding to requests from an authority.

How long we keep your data

We keep almost everything in your account (your email address, your profile, what you store and post, your UIDs, your rank, your points, your notifications, your sign-up answers and your community content) for as long as you have the account, and it’s deleted the moment you delete the account. Whatever you delete yourself before that (an alert, a template, a TradeAudit connection) is deleted immediately, except what you delete in the community, which is kept for 30 days, as explained above.

Some data lasts less: the newsletter email address, until you unsubscribe, or 7 days if you don’t confirm it; each session, until you sign out, sign it out from another device in Your sessions or delete the account; each phone’s identifier, until you sign out of the app on it; each browser’s address, until you turn them off, sign out, the session you turned them on with is closed or 90 days go by without you opening the website in it; the Telegram chat, until you disconnect it; the code to connect it, 10 minutes; notification receipts, about 24 hours; failed attempts with a live stream code, one day; the app’s crash reports, 30 days; and the database’s technical logs, with the IP of each request, one week.

And some data stays after you delete the account, for security and so we can defend ourselves against a claim: the record of what the team did with your account, the anti-fraud note if another account tried to link your same UID and the block if the team blocked your account, your email address or your UID. The record is deleted three years after each action; the anti-fraud note, three years after it was made or, if the team reviewed it later, after that review; and the block, one year after it’s lifted or expires (while it’s still in place, it stays). The steps we measure and your tickets from giveaways that have already closed also stay, but with nothing linking them to you. This is explained in “Delete your account”.

The database makes a backup every day, and each backup lasts one week: whatever is deleted also disappears from the backups within that time.

Who else processes your data and where

We don’t sell your data. Apart from the commissions panel, which we’ve already told you about above, only these providers process it, on our behalf and for the purposes stated on this page:

Supabase stores the database and the photos, in London (United Kingdom). Resend sends the emails, from the United States. Cloudflare serves the website, the captcha and TradeAudit from its network, spread around the world. Expo, in the United States, passes mobile notifications on to Apple and Google, which are the ones that deliver them to your phone. Browser notifications are delivered, encrypted, by the service of whoever made your browser (Google, Mozilla, Apple or Microsoft): it can’t read them. Telegram delivers the alerts you choose to get on Telegram and sees their text, like that of any message you get there; it processes data outside the European Union (its group is in Dubai and the British Virgin Islands). Sentry receives the app’s crash reports and stores them in the European Union (Germany). Google also lets you sign in with your Google account, if you choose to. Anthropic, in the United States, generates the answers of Robin, the help assistant, writes the TradeAudit AI analyses and helps the team review the bugs you report to us.

The videos in the guides are from YouTube, which belongs to Google, and nothing loads until you tap “Watch the video”. When you tap it, YouTube receives your IP address and your browser data, and may store data in your browser under its own policy (we explain this in Cookies).

The chart doesn’t go through our servers: as soon as you open it, your browser requests the prices directly from Binance, Bitget or Bybit (if one doesn’t have the pair, from the next one) and stays connected to that exchange while the page is open, so the candle moves live. That’s why that exchange receives your IP address and your browser data, and handles them under its own policy. We don’t see or store any of it. What you draw and choose on the chart stays in your browser.

That’s why some data leaves the European Economic Area. To the United Kingdom, because the European Commission acknowledges that it protects data as the European Union does (an adequacy decision). To the United States, with providers certified under the EU-U.S. Data Privacy Framework or with the European Commission’s standard contractual clauses.

Your rights

You can download a copy of your data in Settings › Download my data, and delete the account in Settings › Delete account, on the website or in the app: it’s deleted immediately, with everything in it except what’s explained in “Delete your account”.

For anything else about your data (finding out what we hold, correcting it, restricting or objecting to any use, or withdrawing your consent), write to us at hola@nexotrade.app. If we don’t answer you properly, you can lodge a complaint with the Agència Andorrana de Protecció de Dades or with the data protection authority in your country.