Privacy policy

When you use the bot (@joinTGsignals_bot):

• Your Telegram user ID (numeric), username, first name, language code. Stored so the bot can DM you and so we can match a subscription to a Telegram account.
• The asset you joined the waitlist for (if applicable).
• The history of drip-campaign messages we've sent you (one row per message-type sent, for idempotency, no message bodies stored).

When you subscribe via Stripe:

• Your Stripe customer ID and subscription ID (so we can verify your license is still active and stop trades when you cancel).
• Your subscription tier and the asset keys it covers.
• Your current_period_end date (so the bot knows when your access expires).
• We never see your card number, CVV, or billing address. Stripe handles those; we only get a customer-ID reference.

When you connect your cTrader account:

• Your cTrader account number (the public-facing trading account ID) and broker name, returned to us by cTrader after you authorize.
• You never share your cTrader password with us. You connect via cTrader's secure OAuth flow (cTrader Open API): one click, you log in on cTrader's own page, and you authorize tgsignals. We only receive an access token, never your credentials.
• The OAuth access/refresh token scoped to your cTrader account (so we can route trades to the right account). Money never leaves your broker.

• Your broker password or trading credentials. cTrader's secure OAuth (cTrader Open API) never reveals your password to us, you log in directly on cTrader and only an access token is returned.
• Your bank or credit-card details (Stripe handles those).
• Your real name unless you sign up for Stripe with it (and even then we don't store the name, only the Stripe customer-ID reference).
• Your trading positions, account balance, or P&L on your own account. The algorithm sends signals, it doesn't query your account state.
• Your IP address beyond standard webhook delivery logs (rotated by systemd-journald every 30 days).

The site uses Google Analytics 4 (page-view counting). No advertising cookies, no remarketing, no cross-site tracking pixels. You can disable GA4 by enabling Do Not Track in your browser or using an ad-blocker, the site works fine without it.

If you're in the EU (or any jurisdiction with similar laws), you have the right to:

• Access what data we hold on you. Reply to your bot DM thread with "/data" or message @webmasteraccount and we'll dump every row tagged with your Telegram ID in plain JSON.
• Delete your data. Same channel, say "/delete me" or DM us. Within 14 days every row tied to your Telegram ID is purged (Stripe customer history retained per Stripe's own policy, which we cannot override).
• Port your data to another service. Same dump as Access, in machine-readable JSON.
• Object to any specific processing, DM us with the objection, we'll respond within 7 days.

Waitlist + bot user records are kept indefinitely so we can resume delivery of signals if you re-subscribe after cancelling. If you ask for deletion (above), records are purged within 14 days.

Stripe records retention is governed by Stripe and applicable financial regulations (typically 7 years for transaction history). We cannot delete those records, only Stripe can.