What we can see


Every tool that touches trading data promises to be careful. That promise is worth nothing, which is why this is architecture instead. Three layers, three different guarantees, each one checkable rather than stated — and each labelled with what is running today.

Why market comparison does not break this

Comparing your fills against the mid needs public candles. Those requests go from your machine directly to your own exchange— the venue you already trade on, which already knows every order you have ever sent it. We never make that request, so we never learn which instruments you trade. If we fetched candles on your behalf, the list of pairs we asked for would be your strategy. The site’s Content-Security-Policy names those venue hosts explicitly and allows nothing else, so the set of places this page can reach is a closed list you can read.

Your fills

Never sent

The engine ships with the page and runs in your browser. Drop a file and the parsing and the arithmetic happen on your machine, with no request to anyone — the network panel stays at zero while it works.

We hold none of it. Not encrypted — absent, because there is no endpoint that accepts it.

Your history

Sealed

Crypto shipped · sync in build

Per-instrument and per-hour detail is encrypted in your browser before it is stored anywhere: a random AES-GCM key, wrapped by a key derived from your password with 600,000 rounds of PBKDF2-SHA256. We would hold ciphertext and could not open it, including if someone required us to.

You get a recovery key at signup — the only other way in. We hold neither it nor your password, and cannot make a copy of either.

The pool

Pseudonymous

Schema shipped · pool opens at 20

A closed list of 8 rounded numbers with no instrument names, sent under an identifier that is derived fresh each period from a secret your browser never transmits, with Laplace noise at ε=0.5 per field.

Nothing is returned until at least 20 accounts sit in a cohort — and the rounding is what makes a stolen database useless: no row can be traced back to an account, including by us.

Everything the agent sendsper period
cohort              "10-50M/perps"
fills               1100
maker_rate_bps      3.6
taker_rate_bps      7.4
taker_share         0.71
fee_bps             6.3
leak_per_million    264
frag_share          0.38
top8_share          0.80

What is never sent

  • Instrument names — the set of pairs is the strategy, and even asking for their candles would give it away
  • Individual fills, prices, sizes or timestamps
  • Order identifiers
  • Balances, open positions, leverage
  • API keys — we never ask for one, at any tier
  • Deposits, withdrawals, your name or jurisdiction

The agent is closed source — it is the product. What replaces reading the source is narrower and harder to fake: the schema above is the whole schema, the agent refuses to send a payload carrying any key outside it, and --dry-run prints the exact bytes without sending them. It reports its own errors to a local file rather than to us: if something breaks, you decide whether to share it, after seeing what it contains.

How the recovery key works

  1. Your browser generates the key that encrypts your history. It never travels.
  2. It is wrapped twice — once by your password, once by the recovery key you save at signup. Each wrap has its own salt, so changing one never invalidates the other. We would store both sealed envelopes and can open neither.
  3. Either one lets you in. Forget the password, use the recovery key. Change your password and only that envelope is rewritten, not your data.