Privacy Policy

1. Information We Collect

At TechMalak, we collect information that you directly provide and data seamlessly integrated via APIs, including:

• Account Information: Name, email address, password, avatar, location, bio, and UI preferences.
• Optional Demographic Information: If you choose to provide it, we may store a coarse age range and country to improve our anonymized business records. This is optional and is not collected automatically.
• Financial Exchange Data: Order history, execution times, trade sizes, PnL, portfolio balances, and asset allocations via read-only API connections to supported exchanges (Coinbase, Bybit, KuCoin, Bitget, Kraken).
• Exchange API Credentials: Read-only API keys, secrets, and passphrases required to connect your exchange accounts. These are encrypted at rest using AES-256-GCM encryption and are never stored in plaintext.
• Behavioral & Psychological Data: Psychological assessment responses, profile classifications (e.g., cognitive style, risk tolerance, emotional regulation), behavioral observations generated by our AI engine, profile history snapshots, and disciplinary score histories.
• AI Chat Data: All conversations with TechMalak AI are stored, including your messages and AI responses. Chat sessions are retained for continuity and personalization.
• Engagement & Gamification Data: Interactions with training modules, XP events, level progression, trader archetype classifications, and achievement data.
• Client-Side Storage: We use browser IndexedDB to cache market data locally for performance, and localStorage for your UI preferences. No sensitive data is stored client-side.
• Anonymized Retention Records: When you delete your account, we generate a single anonymized summary row containing bucketed demographic and usage data (country, age range, archetype, engagement level, account lifetime, exchanges used). This row contains no information that identifies you and cannot be linked back to your account by any reasonable means. It is retained indefinitely for our internal business analytics.
• Security & Audit Logs: We maintain limited audit logs containing user ID, IP address, event type, severity, and event metadata to detect fraud, investigate security incidents, and prevent abuse. These logs are retained for up to 12 months and are accessed only when investigating a specific incident. When you delete your account, the direct identifiers (your user ID and IP address) are removed; only de-identified event records remain until the 12-month purge, as described in Sections 7 and 8.

2. How We Use Your Information

Our goal is to hold up a mirror to your trading psychology. We use your data securely to:

• Calculate metrics, win rates, and populate your personalized trading journal dashboard.
• Power our proprietary Behavioral Engine to deliver real-time psychological nudges (via Yahsuke, the AI coach) specifically triggered by your unique execution patterns.
• Personalize AI chat responses based on your psychological profile and trading history.
• Aggregate portfolio balances across your connected exchanges.
• Deliver curated news intelligence with AI-generated sentiment analysis.
• Maintain, debug, and secure the TechMalak platform infrastructure.

3. Third-Party Service Providers (Subprocessors)

We share data with the following providers only as needed to run TechMalak. We never sell your data, and we never share identifiable trading data for advertising.

• Supabase — database, authentication, file storage, and backend functions (hosted in Canada, ca-central-1).
• Google (Gemini), OpenAI, and Anthropic — AI models powering chat, behavioral analysis, and news sentiment. We send only the content needed for the analysis, including the display name you chose for your profile — never your email or exchange credentials.
• CoinGecko and CoinMarketCap — cryptocurrency market and price data.
• Firecrawl — extracts the text of public news articles. We send article URLs only, never your personal data.
• OneSignal — delivers web push notifications; receives your user ID to register your device for push.
• OpenSea — read-only NFT market data.
• Reown / WalletConnect — client-side wallet connection, only if you choose to link a wallet.
• Netlify — website hosting.
• Google Analytics — aggregate usage statistics on our production site (pages visited, device type, approximate region) so we can understand how TechMalak is used and improve it. We do not send it your name, email, trades, or behavioral data, and we do not use it for advertising.
• Cryptocurrency exchanges (Coinbase, Bybit, KuCoin, Bitget, Kraken) — we use your read-only API keys to import trade history. Keys are encrypted (AES-256-GCM) and are never used to trade or move funds.

We require these providers to protect your data and use it only to deliver the service. We do not sell, rent, or trade your personal information to any third party for marketing or commercial purposes.

4. AI Profiling & Automated Analysis

TechMalak uses AI-powered automated profiling to analyze your trading behavior. This includes:

• Classifying your trader archetype based on psychological assessment responses.
• Detecting behavioral patterns such as revenge trading, stop-loss modifications, and emotional decision-making.
• Generating behavioral insights, trader stats, and AI coaching feedback based on your trading activity.
• Providing personalized coaching nudges based on your behavioral patterns.

These automated analyses are advisory only and do not result in any decisions that produce legal or similarly significant effects. You may contact us to request human review of any automated assessment.

You can opt out of behavioral analysis at any time — see “Your Rights & Data Control.”

5. Data Aggregation and Anonymization

We may aggregate and anonymize trading and behavioral data for analytical refinement and to improve our behavioral models. Any such aggregated data is stripped of all personally identifiable information and cannot be tied back to your specific exchange account or identity.

6. Data Security & Storage

• Encryption at Rest: Exchange API credentials are encrypted using AES-256-GCM before storage. All other data is stored in Supabase with platform-level encryption.
• Encryption in Transit: All data transmitted between your browser and our servers uses HTTPS/TLS encryption.
• Access Control: Row-level security policies ensure that each user can only access their own data. Administrative access is restricted to essential platform operations.
• Read-Only API Keys: We only accept read-only exchange API keys. We never request trading or withdrawal permissions.

While we implement rigorous security measures, no system is completely immune to all threats. You agree to utilize our service with an understanding of this inherent risk.

7. Data Retention

We retain your data for as long as your account is active. Specifically:

• Account & Profile Data: Retained until you delete your account.
• Trade History: Retained until you delete your account or manually remove trades.
• AI Chat History: Retained until you delete your account.
• Behavioral Profiles: Retained with historical snapshots until you delete your account.
• Exchange Credentials: Retained until you disconnect the exchange or delete your account, at which point they are permanently destroyed.
• Anonymized Retention Records: Retained indefinitely after account deletion. Cannot be linked back to you. See Section 8 for details.
• Security Audit Logs: We keep de-identified security event metadata for up to 12 months for fraud detection and incident investigation, after which it is automatically deleted. When you delete your account, we remove the direct identifiers (your user ID and IP address) from these logs at deletion, keeping only de-identified event records.

8. Your Rights & Data Control

You have the following rights regarding your personal data:

• Right to Access & Export: You can download a complete copy of your data at any time from Settings. It is generated on our servers and covers every record we hold that is linked to you — your profile, trades, positions, connected wallets, behavioral assessments and history, chat history, gamification progress, imports, and saved reports. For your security, platform secrets are redacted (exchange API keys and wallet signatures). Purely operational and security records that are not your personal data — such as rate-limit counters and security audit logs — are not included, and the export documents what it leaves out. The export either completes in full or fails visibly; we never hand you a partial file described as complete.
• Right to Rectification: You can update or correct your personal information through your profile settings.
• Control over behavioral analysis: You can turn behavioral analysis on or off at any time in Settings → Privacy. While it is off, we stop generating and storing new behavioral observations and psychological insights from your activity. Insights already generated remain until you delete your account; to remove them, delete your account (see Right to Erasure).
• Right to Erasure: You can request deletion of your account from Settings. When you delete your account, we permanently remove every piece of information that identifies you — your name, email, exchange credentials, chat history, trade details, behavioral assessments, and personal profile. We retain a separate anonymized summary of platform usage (such as country, age range, account lifetime, engagement level, and trader archetype) for our internal business records. This summary cannot be linked back to you by any reasonable means. Separately, any messages you sent us through the contact form and any feedback you submitted in-app are retained after deletion with your name, email, and account link removed — we keep the substance of what you told us for our business records, but can no longer tie it to you. Deletion of your identifying information is irreversible. Our security audit logs keep only de-identified event metadata — your user ID and IP address are removed at the time of deletion — and that metadata is automatically purged after 12 months.
• Right to Data Portability: Your exported data is provided in standard JSON format for easy portability.
• Right to Object: You may object to automated profiling by contacting us at info@techmalak.com.

9. International Data Transfers

Your data may be processed in jurisdictions outside your country of residence. Specifically: our database infrastructure (Supabase) is hosted in Canada (ca-central-1 region), and our AI model providers operate primarily in the United States. We ensure appropriate safeguards are in place for all international data transfers in accordance with applicable data protection laws.

10. Age Restrictions

TechMalak is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us immediately at info@techmalak.com and we will promptly delete such information.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you via email or through a prominent notice within the platform at least 30 days before the changes take effect. Your continued use of TechMalak after the effective date constitutes acceptance of the updated policy.

12. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the Province of Ontario, Canada, and the federal laws of Canada applicable therein. Any disputes arising from this policy shall be resolved in accordance with our Terms of Service.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise any of your data rights, or need to report a privacy concern, please visit our Contact Us page via the side menu or email us directly at info@techmalak.com.