DeskPilot — Privacy Policy

1. Who is responsible

The controller for the personal data described here is Alexander Fell, 5242 S. Hyde Park Blvd, Apt. 714, Chicago - 60615, contactable at support@deskpilot.trade. See the Imprint for full details.

2. What we collect, why, and on what legal basis

An account is identified by an email address. We never ask for your real name, your date of birth, a phone number or an address — if you buy a paid plan, Paddle collects what it needs for the invoice and we do not receive it.

Data	Why	Legal basis (GDPR Art. 6)
Email address, password (hashed), organisation name	To create and operate your account and to contact you about it	(1)(b) performance of the contract
Whether your email address has been confirmed, and when	So that password recovery reaches you and nobody can occupy someone else's address. Confirming is not required to use the Service	(1)(b), and (1)(f) legitimate interest in account security
If you sign in with Google: your Google account identifier and the email address Google reports	To recognise you on your next sign-in. Detailed under Signing in with Google	(1)(b) performance of the contract
Trading data reported by your add-on: account balances, PnL, open positions, working orders, running strategies, executed fills	To display your accounts back to you — the purpose of the Service	(1)(b) performance of the contract
Your VPS records: the name you gave each machine, the credential we issued it (stored encrypted), the add-on and NinjaTrader version it reports, and when we last heard from it	To tell your machines apart, to authenticate them, and to be able to tell you that one has gone quiet or is running an out-of-date build	(1)(b), and (1)(f) legitimate interest in a diagnosable system
The settings you configure: which accounts you follow, max-loss limits, session-close times, strategy schedules	To act on them — they are instructions, and the ones enforced on your VPS keep working while your browser is closed	(1)(b) performance of the contract
Instructions you issue, and their outcome	To relay them, to show you what happened, and to be able to show later what was asked for and when	(1)(b), and (1)(f) our legitimate interest in an accurate record
Security log: sign-ins, failed sign-ins, credential changes, IP address	To detect and investigate unauthorised access to accounts that can place orders	(1)(f) legitimate interest in the security of the Service
Sign-in and link tokens: the optional "remember me" token, password-reset and email-confirmation links, and the short codes that pair a VPS with your account — each stored only as a hash	To keep you signed in if you asked, to let you recover a password, and to get credentials onto your VPS without you copying them by hand	(1)(b), and (1)(f) legitimate interest in account security
Which version of the Terms you accepted, when, and from which IP	To evidence the contract	(1)(b), and (1)(c) legal obligation
Billing records	To take payment and meet tax and accounting obligations	(1)(b) and (1)(c)
Your display preference (which colour theme you chose)	To render your pages the way you asked	(1)(b) performance of the contract
Waitlist email address, if you joined one	To tell you when a plan becomes available	(1)(a) consent — withdrawable at any time
Server logs (IP address, request, user agent)	To operate the servers and investigate faults and abuse	(1)(f) legitimate interest

We do not use your data to train models, we do not sell it, we do not use it for advertising or profiling, and there is no automated decision-making within the meaning of Art. 22 GDPR. Your trading data is used to show you your own accounts, and for nothing else — it is not aggregated into a product, published as statistics, or passed to anyone as a signal.

3. What we never receive

DeskPilot does not ask for, does not receive, does not store and does not need:

your NinjaTrader login,
your broker or prop-firm login, or any API key belonging to either,
your market-data provider's credentials,
your card or bank details — those go to Paddle, never to us (see Who else sees it).

This is not a promise we have to keep by being careful; it is how the Service is built. The add-on runs inside the NinjaTrader you already signed in to, on your own machine, and it only ever makes outbound requests to us. We hold no route back: we cannot open a session on your VPS, we cannot reach your broker, and there is nothing in our database that would let us.

The one credential we do hold is one we issued — the key your VPS uses to prove it is yours when it contacts us. It is stored encrypted, it means nothing outside this service, and it is not a trading credential: an instruction can only ever be carried out by the add-on running inside your own NinjaTrader, which is also why nothing happens at all while that machine is switched off.

If one of those credentials ever reaches us by accident — pasted into a support email, or legible in a screenshot — tell us. We will delete it, and you should treat it as exposed and change it.

4. Signing in with Google

Using Google to sign in is optional; an email address and a password works exactly the same way. If you do use it, you sign in at Google — we never see your Google password or your second factor.

What we send to Google. Our application's public id, the permissions we are asking for — openid email profile, meaning your email address and basic profile and nothing further — and a one-time value that protects the round trip. We request no access to Gmail, Drive, Calendar, contacts or anything else in your Google account, and we ask for online access only, so Google issues us nothing that would let us reach your account later or while you are away.
What Google returns. A stable identifier for your Google account, your email address, whether Google treats that address as verified, and your display name. We use the access token once, immediately, to read exactly that, and then discard it.
What we keep. The identifier and the email address — the identifier because it is what still recognises you if you later change your address. Your display name is shown on the confirmation screen and is not stored.
It counts as confirming your address. Google has already proved you hold the mailbox, so we do not send you a confirmation link and never ask you to confirm what Google has confirmed.

Google's own role is not ours. For its side of the sign-in Google acts as its own controller, not as a processor on our instructions: it knows that you signed in to DeskPilot and when, and records it in your Google account's activity. That processing is governed by Google's Privacy Policy, and you can review or revoke DeskPilot's connection at any time under your connections to third-party apps. The legal basis on our side is Art. 6(1)(b) — you chose this method to create or reach your account.

If you started with Google and would rather not use it, set a password in Account settings and sign in with that instead; write to support@deskpilot.trade if you want the Google link removed from your account altogether.

5. How long we keep it

Automatic housekeeping deletes data on the schedule below. The periods shown are read from this installation's live configuration, so this table always states what the system actually does.

Data	What it is	Kept for
Account and login details	Email address and whether it has been confirmed, password hash, the Google account identifier if you sign in with Google, organisation name, your colour-theme choice.	For as long as the account exists; erased when you delete it.
VPS records	The name you gave each VPS, the credential it uses to authenticate to us (encrypted), the add-on and NinjaTrader versions it reports, and when it was last heard from.	Until you remove that VPS, or delete the account.
Current account state	One row per NinjaTrader account holding the figures the dashboard shows you right now. Overwritten on every push rather than accumulated.	Overwritten continuously; erased with the account.
Account snapshots	Balances, PnL, open positions, working orders and running strategies, as reported by your NinjaTrader.	30 days, or sooner where your plan cannot display them (never less than 7 days)
Diagnostic copy of a snapshot	The raw push payload, kept to answer "why did that snapshot look like that?".	24 hours, then discarded while the snapshot itself stays
Executed fills	The individual executions your add-on reports, which the trade journal is matched from.	365 days — except a fill still holding an open position, which is kept until it closes
Closed trades	Your matched fills — the trade journal.	365 days; deliberately not shortened by your plan
Commands	Actions you asked us to relay to NinjaTrader, and their outcome.	90 days
Risk limits and strategy schedules	The max-loss limit, the session close and the on/off rules you set up. These are instructions rather than history.	Until you change or delete them, or delete the account. They are never expired by age, because a rule is still meant to fire.
Security log	Sign-ins, failed sign-ins, credential changes, commands issued, with IP address.	365 days
Sign-in and link tokens	The optional "remember me" token, password-reset and email-confirmation links, and the short codes that pair a VPS with your account. Only a hash of each is stored, never the value itself.	"Remember me": 30 days, rotated on every use. A reset link lives 10 minutes and a confirmation link 24 hours; both rows are removed about two days after being used or expiring, so that "did my link work?" is still answerable. A setup code lives 15 minutes.
Waitlist entry	The address you gave us to be told when a plan opens, and the IP it was submitted from.	Until that plan opens and you have been told, or until you ask to be removed — whichever comes first.
Acceptance of these documents	Which version you accepted, when, and from which IP address.	For as long as the account exists, and afterwards only where we must keep it to evidence the contract.

Deleting your account deletes all of it in one step — the accounts, their history, the trade journal, the command log and your VPS credentials — and it is not reversible. Where our hosting provider holds backups, a copy can survive in them until that backup rotates out on its own schedule.

Longer periods apply only where a statutory retention duty requires it — notably invoices and accounting records, which tax law requires us to keep for several years regardless of your deletion request.

6. Who else sees it

We use a small number of service providers, each under a data processing agreement where they act on our instructions, and only to the extent needed:

Hosting provider — runs the servers this application and its database sit on. Named in the Imprint.
Paddle (Paddle.com Market Ltd) — payment processing as Merchant of Record. Paddle is the seller of record for paid plans and acts as its own controller for the payment transaction; we receive a subscription status and never see your card details.
Email delivery — for account email such as password resets and notifications.

Separately from that, a few pages ask your browser to fetch a file from somebody else's server, which lets them see your IP address. There is no analytics, no advertising, no tag manager and no session recording anywhere in this application, and the fonts are served from our own domain deliberately rather than from a font CDN:

cdn.jsdelivr.net — the chart library, on the dashboard only, and only once you are signed in. If you would rather it did not, the library can be served from our own domain instead — ask us.
cdn.paddle.com — the checkout, on the billing page only. The checkout itself runs in Paddle's own frame and may set cookies of its own, under Paddle's policy rather than this one.
accounts.google.com — only if you press "Continue with Google", and only for that sign-in.

Your VPS is yours. We do not access your VPS, your NinjaTrader installation or your broker account. Data reaches us only because the add-on you installed sends it.

We otherwise disclose data only where we are legally obliged to, or where it is necessary to establish or defend a legal claim.

7. Transfers outside the EU/EEA

We aim to keep processing within the EU/EEA. Where a provider processes data outside it, that transfer is covered by an adequacy decision or by the European Commission's Standard Contractual Clauses with additional safeguards — Google LLC, for the optional Google sign-in, is certified under the EU-US Data Privacy Framework. You can ask us for details of the mechanism relied on for any particular provider.

8. Cookies and local storage

We set no advertising or analytics cookies and use no third-party trackers. Only these are used, all strictly necessary for the Service to work:

Cookie	Purpose	Lifetime
Session cookie	Keeps you signed in during a visit, and carries the token that protects forms against cross-site request forgery. It is set on the public pages too, because the waitlist form needs that protection.	Until you close the browser
`dp_remember`	The optional "remember me" sign-in. Only set if you tick it.	30 days, rotated on each use

The dashboard also uses your browser's local storage to remember display preferences (which cards are expanded, chart windows, the sort order of the strategy list, whether disconnected accounts are hidden, and which notices you have dismissed). That never leaves your browser and is not personal data we receive.

9. Your rights

Under the GDPR you have the right to:

Access (Art. 15) — a copy of the personal data we hold about you.
Rectification (Art. 16) — correction of anything inaccurate.
Erasure (Art. 17) — deletion. You can do this yourself at any time from Account settings, which cancels any subscription and erases your data; it is not reversible.
Restriction (Art. 18) and portability (Art. 20) — there is no self-service export yet, so write to us and we will send you your data in a machine-readable form.
Objection (Art. 21) to processing based on legitimate interest.
Withdraw consent at any time where consent is the basis — for example by asking to be removed from the waitlist.

Write to support@deskpilot.trade to exercise any of these. You also have the right to complain to a data protection supervisory authority — in the country where you live or work.

10. Security, and its limits

Passwords are stored only as hashes. The credentials your add-on uses are encrypted at rest, and every machine request is signed in both directions so neither side acts on an unauthenticated message. Sessions use strictly-scoped, HTTP-only cookies, and "remember me" tokens are rotated on each use and revoked wholesale if one is replayed. Actions that hand out credentials or destroy data require your password again, even if you are already signed in, and are written to the security log.

No system is perfectly secure. If we discover a breach affecting your data we will notify the supervisory authority within 72 hours where required, and notify you where the breach is likely to present a high risk to you.

11. Changes

We update this policy when what we do changes. The version marker at the top of the page tells you which text you are reading; material changes are notified with the Terms of Service.