Privacy
Not ready to publish. 2 registration details in lib/legal.ts are still placeholders (taxId, address). This notice disappears when they are filled in, and npm run check:legal fails until then.
Most of this policy is a list of things that never reach us. That is not a stylistic choice — the analysis engine ships with the page and runs on your machine, so there is no step at which your fills could arrive here even if we wanted them.
Who operates this service
vexxsus.com is operated by Mariia Rudneva, Individual entrepreneur (ԱՁ), Republic of Armenia. Registration number TODO: ՀՎՀՀ / TIN. Registered address TODO: registered address, Yerevan, Armenia. For anything in this document, write to legal@vexxsus.com.
What never reaches us
The following are processed entirely in your browser or on your own machine and are never transmitted to us, in any form, at any tier:
- Instrument names — the set of pairs is the strategy, and even asking for their candles would give it away
- Individual fills, prices, sizes or timestamps
- Order identifiers
- Balances, open positions, leverage
- API keys — we never ask for one, at any tier
- Deposits, withdrawals, your name or jurisdiction
You do not have to take this on trust. Open your browser’s network tab, run an analysis, and watch: the page makes no request while it works. The site’s Content-Security-Policy names every host this page is allowed to contact and blocks the rest at the browser level.
What we do receive
| Data | When | Why | Kept |
|---|---|---|---|
| Server request logs | Every visit | IP address, user agent, requested path and timestamp, written by the web server. Used to count visitors and to investigate abuse. We run no analytics script and set no tracking cookie. | 14 days |
| Email address | If you create an account | To identify the account, to send the receipt and to reset access. | Until you delete the account |
| Sealed history | If you enable history | Ciphertext only. Encrypted in your browser with a key wrapped by 600,000 rounds of PBKDF2-SHA256 over your password. We cannot decrypt it — not on request, not under compulsion, not by mistake. | Until you delete the account |
| Pool payload | If you opt in to the benchmark | 8 rounded numbers plus a cohort label, under a pseudonym regenerated every period. Laplace noise at ε=0.5 per field. Nothing is returned to anyone until a cohort holds at least 20 distinct submitters. | 24 months, aggregated |
| Waitlist contact | If you ask to be told when the agent ships | An email address, a Telegram handle, or both, plus the optional note you typed. Stored on our own server — the form posts to this domain and to nothing else. No fill data is attached to it, and it is used for exactly one message. | Until you ask us to remove it |
| Payment details | On a paid plan | Handled entirely by the payment processor. We receive the last four digits and the billing country, never the card number. | 7 years (tax) |
What is stored in your browser
Your theme choice, under the key theme, in localStorage. It never leaves your device and is not a cookie. Clearing site data removes it, and the page falls back to your system preference. We set nothing else.
Lawful basis
Where the GDPR applies to you: account email and sealed history are processed to perform the contract you entered into (Art. 6(1)(b)); server logs are processed on our legitimate interest in operating and securing the service (Art. 6(1)(f)); the pool payload is processed on your consent (Art. 6(1)(a)), which is opt-in and which you can withdraw at any time. Under Armenian law the same processing is carried out under the Law on Protection of Personal Data.
Who else touches it
The hosting provider that runs the server, and the payment processor on paid plans. Both act on our instructions under a written agreement. We do not sell data, we do not share it with advertisers, and there are no advertisers.
Your rights
- Access and portability. Ask and we will send everything tied to your account. For sealed history this is ciphertext — we cannot open it, and neither can anyone who takes it from us.
- Deletion. Deleting the account removes the email and the sealed envelopes. Pool submissions cannot be withdrawn once aggregated, because they are not linked to the account in the first place.
- Objection and withdrawal. Pool participation can be turned off at any time and stops immediately.
- Complaint. You can complain to your local supervisory authority.
Security reports
If you find a vulnerability, write to security@vexxsus.com. Our disclosure terms are at /.well-known/security.txt. We do not pursue researchers acting in good faith.
Changes
If this policy changes in a way that affects what we receive, the date at the top changes and account holders are emailed before it takes effect.