Privacy Policy
Last updated October 25, 2026
This policy explains what StratEngine (“we”) collects when you use stratengine.app, how we use it, and your choices. We collect only what the Service needs to work. We don't sell your information or use it for advertising.
What we collect
- Account details: your name (optional), email address and password. Passwords are stored only as a salted, one-way hash.
- Broker connection: if you connect Alpaca, either an access token from Alpaca's authorization or the API key and secret you enter, plus a masked account number (last four digits) and the connection date. Tokens and keys are encrypted before they are stored and are never shown back to you or anyone else.
- Settings and activity: your mode (alerts or auto-trading), risk and grade settings, watchlist, the bot's ledger and activity log, alerts sent to you, and records of trades the bot closed (symbols, orders, prices, times and results).
- Phone alert channel: a random channel name used to send notifications through ntfy, if you turn phone alerts on.
- Technical data: a session cookie that keeps you signed in, and limited request information (such as IP address) used to limit repeated sign-in attempts. Your browser also saves some preferences (like your watchlist and display choices) on your own device.
Information from Alpaca
With your authorization, we read from your Alpaca paper account: account number (stored masked), buying power, options approval level, positions, orders and market data. We use it only to run the features you turn on. We don't receive your Alpaca password.
How we use it
- To run scans, grade setups, send your alerts, place and manage paper orders when you've turned on auto-trading, and show your trade history.
- To keep the Service secure, prevent abuse and fix problems.
- To contact you about your account or important changes.
Who we share it with
We don't sell or rent personal information. We share it only as needed to run the Service:
- Alpaca, to retrieve market data and account information and to send the orders you've authorized.
- Cloudflare, which hosts the Service and its database.
- ntfy (ntfy.sh), only if you turn on phone alerts: the alert text is sent to your private channel. Anyone who knows that channel name can read its alerts, so keep it private.
- When required by law, or to protect the rights and safety of users and the Service.
How long we keep it
We keep your information while your account is open. When you delete your account from the Account page, we delete your account, saved broker credentials, settings, alerts and trade history from our database. Copies in routine backups may persist for a short period before they are overwritten. Disconnecting Alpaca deletes your saved broker credentials right away.
Security
Connections use HTTPS. Broker tokens and keys are encrypted at rest, passwords are hashed, and session cookies are HttpOnly and Secure. No system is perfectly secure; if we learn of a breach affecting your information, we'll notify you as required by law.
Your choices
- Change your settings, turn phone alerts on or off, or pause the bot at any time.
- Disconnect Alpaca from the Account page, or revoke StratEngine's access in your Alpaca dashboard.
- Delete your account from the Account page, or email us to ask for a copy of your data or for deletion.
Children
The Service isn't for anyone under 18, and we don't knowingly collect information from them.
Changes
We'll post changes here and update the date above. If changes are significant, we'll let you know in the Service or by email.