Privacy Policy
What Parabolt LLC collects when you use Parabolt, why, who processes it, how long we keep it, and your choices.
PDF version
OpenDownload
Text version
1. What we collect
| Kind | What it includes | Where it comes from |
|---|---|---|
| Identity | Name or username, email, avatar, Whop and Discord account ids, membership status and access level | Whop and Discord when you sign in |
| Profile | Country of residence (as you state it), language, time zone, display preferences | You |
| Broker connections | Which broker, account ids, the API keys, tokens or wallet address you provide, account balances, positions, orders and fills. Where a broker has no other way in (Robinhood), your username and password are used once to sign in and are not stored; only the broker's tokens are kept | You and your broker |
| Agent and extension | If you run our agent or browser extension, its status reports, its log and the broker confirmations it passes on, shown only to you | Your own computer or browser |
| Plans and activity | The alerters you follow, your rules, approvals you give or decline, the orders the Service sends and their results, the go-live acknowledgements you confirm (with time and IP address) | Your use of the Service |
| Alerts | Messages posted in the community channels the Service reads, and the trades parsed from them | Discord communities where our bot is installed |
| Technical | IP address, browser and device type, pages requested, error logs, a session cookie | Your browser |
| Advertising (visitors, with consent) | Pages viewed on our public pages and sign-up events, through the Whop pixel. A sign-up event carries your email address, name and account id | Your browser, only after you click Accept |
We do not ask for, and you should not send us, your broker password where the broker offers another way to connect. We do not collect payment card details; Whop processes payments.
2. Why we use it
- To provide the Service you signed up for: sign-in, tracking, plans, approvals, orders, notifications and support.
- To keep it safe: detect abuse, enforce access levels and country restrictions, investigate incidents, and keep records of what was approved and sent.
- To comply with law, including sanctions screening and responding to lawful requests. As part of that screening we look up the country of the IP address each request comes from, and refuse requests from sanctioned countries; the address is kept only in the log line of a refused request. IP Geolocation by DB-IP.
- To improve the Service, using usage measurements and error logs.
- To measure our advertising, only for visitors who accepted the pixel.
For people in the EU and UK, our legal bases are: performing our contract with you; our legitimate interests in security, record-keeping and improving the Service; legal obligations; and your consent for the advertising pixel, which you can withdraw at any time.
3. Who processes it
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and storage | United States |
| Render | Application hosting | United States |
| Whop | Sign-in, memberships, payments, the advertising pixel | United States |
| Discord | Sign-in, reading community alerts, notifications | United States |
| Apple, Google and Mozilla push services | Delivering notifications to a phone or browser you turned Push on in (the device's push address is stored on our server) | United States |
| SnapTrade | Connecting brokers that have no direct link: holds the brokerage sign-in you give it and relays balances, positions and orders | Canada and United States |
| Resend | Sending email notifications to your address | United States |
| Sentry | Error reports from the Service, with your account id and the error's own text (email addresses are cut to their domain), so we can fix what broke | United States |
| AI model providers (Anthropic, OpenAI, Google or another we configure) | Reading the text and images of captured alerts when the AI parser is on. Community messages only, never your account or broker data | United States |
| jsDelivr | Serving the charts library and a font to your browser (sees your IP address like any web server) | Worldwide |
| Your broker | Carrying out and reporting your orders | Where your broker operates |
Operational log lines (what the Service did, with the account involved, named by its Whop or Discord handle) are also delivered to private Discord channels that only the people who run the Service can read. Email addresses in these lines are cut to their domain and IP addresses to their network (the last part removed).
We share personal information only with these providers, with your broker as needed to carry out what you set up, with professional advisers under confidentiality, with a buyer of the business, or where the law requires it. We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising except through the pixel on our public pages after you accept it.
4. Security
Broker credentials are encrypted at rest with a key kept outside the database. Connections use HTTPS. Access to production data is limited to the people who run the Service. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
5. How long we keep it
- Account, plans and trading records: while your account exists. When you delete your account they are deleted, except a separate copy of the records of real-money orders (with the positions and approvals they belong to) and of your go-live acknowledgements, which we keep for disputes, tax and legal obligations for up to 6 years and then delete.
- Broker credentials: until you disconnect the account or delete your account. If your membership ends, we stop reading your broker accounts once the account has not been used for 30 days with nothing open at a broker, and delete the stored broker logins and keys after 90 days; we email you at each step. A live account you connect before your country allows live trading is stored the same way, even though no real-money order can go out from it.
- Captured alerts: for as long as the community they came from is tracked, because alerter statistics are calculated from them.
- Technical logs and error reports: generally up to 90 days at our hosting and error-reporting providers. Log lines in our private Discord channels are deleted after 90 days. Daily usage counts per account are kept 120 days. The record of admin actions is kept; when an account is deleted, its email address is removed from it.
- Backups: our database provider keeps backup copies, so deleted information can remain in them for up to 30 days until they are replaced.
5a. Sharing your trading record, if you choose to
Nothing about your accounts is visible to anyone else unless you turn a sharing feature on. Each one is off by default and can be turned off again at any time:
- Public portfolio page. A page anyone can open, without signing in, showing an account's closed trades, open positions and results, in money or in percent as you choose.
- Copy portfolio. Other members may follow an account you share: each of your fills is shown to them as a signal and may be copied into their accounts, and your results are shown as statistics the same way an alerter's are.
- Execution feed and stream feed. Your positions and results posted into a Discord channel you name, or read by a streaming overlay at a secret address you control. Posts already made stay in that channel until you delete them there.
Communities may also post recaps of their alerters' alerts to their own Discord channels; those show the alerts, not any member's account.
6. Cookies and the advertising pixel
The Service uses a session cookie to keep you signed in and stores a few preferences (language, theme, layout) in your browser. These are needed for the Service to work.
Our public pages (the home page, brokers page, onboarding questions, sign-in and membership pages) can load the Whop pixel, which tells Whop which pages a visitor viewed and whether they signed up (a sign-up is sent with the email address and name on the account), so we can measure our advertising. It loads only after you click Accept on the banner. You can change your choice at any time with the Cookie settings link at the bottom of those pages. Declining changes nothing else about the Service.
Do Not Track. Browsers' Do Not Track signals are not a consistent standard, so the Service does not respond to them. The pixel never loads without your Accept.
7. Your choices and rights
Wherever you live, you can get a copy of your personal information, ask us to correct it, or delete your account and the information tied to it (except the records described in section 5). In Settings, under Account, Download my data gives you a copy as one file and Delete account deletes the account. You can also email legal@parabolt.org from the address on your account, for example if you can no longer sign in; we will answer within 30 days.
Deleting your account does not cancel your Whop membership (cancel it on Whop), and does not revoke the keys or app access you gave your broker (revoke them at your broker). If you ran our agent or browser extension, uninstall it and delete its folder.
California residents have the rights above under California law, including to know what we collect and to delete it, and the right not to be discriminated against for using them. We do not sell personal information or share it for cross-context behavioural advertising without consent.
EU and UK residents also have the rights to restrict or object to processing, to data portability, to withdraw consent at any time, and to complain to their data protection authority. Your information is processed in the United States; where the law requires, transfers rely on our providers' standard contractual clauses.
8. Children
The Service is not for anyone under 18. We do not knowingly collect information from children; if we learn we have, we delete it.
9. Changes
We will post any change here with a new effective date, and tell signed-in members about a material change before it takes effect.