Privacy Policy

In short

• We do not sell data, show ads or embed third-party trackers.
• We do not have your exchange API keys: in ACARO Terminal they stay in your computer's system keychain, in ACARO Reflex — on your own server.
• The applications never take deposits, never withdraw funds and never hold your crypto.
• We collect what an account, a subscription and support cannot work without — plus the logs needed to protect the service from abuse.

Who processes the data

The data is processed by ACARO — the website and the ACARO Terminal and ACARO Reflex applications that we develop and operate.

For any question about data processing, including a request for a copy or for deletion, write to support@acaro.xxx. Security questions and vulnerability reports go to security@acaro.xxx.

What we collect

We only collect data you provide yourself or that the service produces while you use it.

• Account: name, email address, password hash, interface language, two-factor authentication settings.
• Subscription and payment: the chosen plan, amounts, invoice status, blockchain address and transaction hash. We never take or store card details — payment is made by crypto transfer.
• Devices and applications: device identifier, its name and platform, application version, IP address and time of the last request. This lets you see your sessions and revoke access.
• Trading terminal activity: session events — the exchange, the mode (demo or live), your exchange account identifier, an aggregate USD balance, the last characters of a key so it can be recognised, the list of running instruments and the accumulated result. This is shown back to you in the cabinet and used to prevent subscription bypass.
• Strategy configurations ("Lab"): the parameters and metrics of the runs you chose to save.
• Optional, at your request: your TradingView username, to grant indicator access; a Telegram link, to send you notifications.
• Technical logs: IP address, client details, request time and error codes.

What we do not have

A note on ACARO Reflex: the application contacts our servers only for sign-in, subscription status and saved configurations. Trading commands travel directly from the application to your own server, bypassing our infrastructure.

• Your exchange API keys. In ACARO Terminal they are stored in your computer's system keychain; in ACARO Reflex — in the daemon's storage on your own server. They are never sent to our servers.
• Access to your funds. We do not take deposits, do not initiate withdrawals and do not operate your exchange account.
• Plain-text passwords, card details, wallet seed phrases or private keys.

Why we process data

• To perform our contract with you: access to the cabinet and the applications, subscription handling, support.
• Legitimate interest: service security, error diagnostics, protection against subscription bypass and abuse.
• Your consent: the optional TradingView and Telegram links. Consent can be withdrawn at any time by removing the link.
• Legal obligations: accounting for received payments.

Who we share data with

We do not sell data and never pass it to advertising networks. Sharing happens only to the extent the service requires.

• The hosting and infrastructure provider that runs the website and the database.
• Blockchain networks — a crypto payment is public by its very nature.
• Telegram — only if you connected notifications yourself.
• TradingView — only the username you supplied, in order to grant indicator access.
• Public authorities — upon a lawful and justified request.

How long we keep data

Account data and saved configurations are kept while your account exists. Payment records are kept for as long as applicable accounting law requires. Technical logs and session events are kept for the limited period needed for diagnostics and security.

After an account is deleted we erase or anonymise the data, except what we are legally required to retain.

Your rights

To exercise these rights, write to support@acaro.xxx from the address registered on the account. We reply within a reasonable time and no later than 30 days.

Account deletion: on request to support@acaro.xxx we delete the account, its linked devices and saved configurations. An active subscription ends with it and cannot be transferred.

• Obtain a copy of your data and learn how it is processed.
• Correct inaccurate data — much of it you can edit yourself in profile settings.
• Delete your account together with its data.
• Withdraw consent for the optional links.
• Lodge a complaint with the supervisory authority in your country.

Cookies

We use functional cookies only: the session identifier, the selected language, the interface appearance and cross-site request protection. There are no advertising or analytics trackers on the site.

Security

Connections to the website and the applications are protected by TLS. Passwords are stored as irreversible hashes and a second factor is available. Application tokens can be revoked from the cabinet. Staff access to data is limited to what the job requires.

No measure is a hundred-per-cent guarantee. If you notice signs that your account has been compromised, write to security@acaro.xxx immediately.

Age of users

The service is intended for adults. We do not knowingly collect children's data. If we learn that an account was created by a minor, we delete it together with its data.

International transfers

Our servers and infrastructure providers may be located outside your country. By using the service you agree to such transfers to the extent the service requires.

Changes to this policy

We may update this policy. The current version is always available at /privacy and the date of the last update is shown at the top of the page. We announce material changes in the cabinet or by email.

Contact

Data processing questions, copy or deletion requests — support@acaro.xxx. Vulnerability reports — security@acaro.xxx. General enquiries — hello@acaro.xxx.