Privacy policy

This policy covers the Cloud9Trader app at www.cloud9trader.com, its API, and these docs. It says what we hold about you, why, who else handles it and for how long, and what you can ask us to do with it.

Who is responsible

Cloud9Trader is responsible for the personal data described here. For anything about your data, write to support@cloud9trader.com from the address on your account.

What we hold, and why

What	Why we hold it	Legal basis
Your account: username, email address, a hash of your password (never the password itself), your plan, and when you signed up, last signed in and last used the app	To give you an account and keep it secure	Our contract with you
Google sign-in: if you sign in with Google, the profile Google sends us: your Google account id, name, email address and picture	To recognise you when you sign in with Google again	Our contract with you
Your work: your algorithms, indicators, backtests, optimisations, trading sessions, and the orders and positions they produce	To run what you build	Our contract with you
Your broker connections: the accounts you connect and their keys, encrypted before they are stored	To trade and read balances on your behalf, when you ask us to	Our contract with you
Payments: your Stripe customer reference and what you bought. Stripe holds your card; we never see it	To bill you and handle refunds	Our contract with you, and the law on keeping tax records
API use: for each minute in which you call the metered API, the credits you used. Calls made before 11 November 2026 were recorded one by one, with their path and calling IP address	To count your credits and stop abuse	Our contract with you, and our legitimate interest in keeping the service available
Server logs: requests to our servers, which can include your IP address and user id	To keep the service running and find faults and attacks	Our legitimate interest in running a secure service
Your picture: looked up at Gravatar from your email address	To show your picture in the app	Our legitimate interest in a recognisable account, which you can avoid by having no Gravatar
Page views: each page you open, in the app or on these docs, sends one page view: the page’s address without its query, the campaign tags in the link you followed (such as `utm_source`) and the name of the site that linked to it. They are kept as daily counts for 400 days, with nothing that identifies you or your device. No cookie or browser storage is used for them	To see which pages and channels bring people to Cloud9Trader	Our legitimate interest in knowing what brings people to the service
Where you came from: when you create an account, Cloud9Trader stores with it the campaign tags and the referring site of the page you signed up on	To see which channels bring people who go on to use the platform	Our legitimate interest in knowing what brings people to the service
Days you use the app: the days you are signed in and open a page	To see whether new accounts come back	Our legitimate interest in improving the service
Getting-started emails: in your first week, which of up to three emails about running a first backtest we sent you, and when. They stop once you complete a backtest, and the link in each one stops them	To help you use the service you signed up for	Our legitimate interest in helping new accounts get started, which you can end with the link in any of them
The Desk early-access list: if you join the early-access list, your email address, the date you asked, the date you confirmed and the version of the consent wording you agreed to	To email you about The Desk only. An address nobody confirms is deleted after 7 days, and unsubscribing deletes it	Your consent

We do not sell your data, and we do not use it for advertising.

Who else handles it

These companies handle personal data for us, only to provide the service:

Google Cloud hosts the app, its database and its logs, in the United States (us-central1).
Google Workspace sends our emails, such as verification and password reset.
Stripe takes card payments.
Gravatar (Automattic) serves profile pictures.
OpenAI answers questions you type into the in-app assistant, if you use it. Your question is sent to OpenAI; your keys and account details are not.

We use no analytics or advertising trackers from other companies: page views are counted by Cloud9Trader itself. The app used to load Google’s Universal Analytics, which Google stopped processing in 2024; it has been removed.

Your broker or exchange receives what it needs to carry out what you ask: your orders and requests for your balances, made with the keys you gave us. Your broker handles that data under its own privacy policy.

Because our servers are in the United States, your data is processed there. Where the law of your country requires it, we rely on the transfer safeguards our providers offer, such as the standard contractual clauses.

Cookies

The app sets three cookies when you sign in: sid and token keep you signed in, and username holds your username so the page can show it. They are needed for the app to work. The docs site sets no cookies.

How long we keep it

Your account and your work: until you ask us to delete your account. Deleting it removes your account, your work, your broker connections and keys, your API keys and your indicators.
Payment records: kept after your account is deleted, because tax law requires us to keep them.
Database backups: a deleted account stays in our backups for up to 7 days, until those backups expire.
Server logs: 30 days.
Page views: 400 days, as daily counts.
Where you came from, and the days you use the app: with your account, and deleted with it.
API use records: 31 days. The older per-call records are deleted 60 days after each call.

What you can ask us to do

You can ask us to:

give you a copy of the personal data we hold about you
correct anything that is wrong
delete your account and your data
stop using your data where we rely on our legitimate interest

Email support@cloud9trader.com from the address on your account. We answer within one month. You cannot yet export or delete your data yourself in the app.

If you are unhappy with how we handle your data, tell us first. You can also complain to the data protection authority where you live. In the UK, that is the Information Commissioner’s Office.

Children

Cloud9Trader is not for anyone under 18, and we do not knowingly hold data about children.

Changes

When this policy changes, the date at the top of this page changes. If a change affects how we use data you have already given us, we will email you before it takes effect.