Your privacy.

The short version

The rest of this page is the longer version of that paragraph, broken into the categories your data privacy laws expect to see.

Categories of data and where they come from

From Whop, when you purchase a subscription

• The email address you used to register on Whop.
• The Whop membership ID and product tier (Basic or Pro).
• The subscription status, billing period end date, and cancellation / refund status as Whop reports them to our cloud API via Whop’s membership webhooks.

We do not receive your payment instrument from Whop. Whop holds and processes payment information directly; its handling of that information is governed by Whop’s privacy policy.

From the WS Terminal application, automatically

• License-validation requests. The application periodically checks in with our cloud API to confirm your license is still active. Each request includes the license key, the request timestamp, the originating IP address, and the application user-agent string.
• Live-trading acknowledgment records. When you accept the in-application live-trading acknowledgment modal (or the auto-start variant), we record: a SHA-256 hash of the exact text you accepted, a list of the individual clauses you checked, the application version, the IBKR port the application was configured to use at the moment of consent, the timestamp, your IP address, and your user-agent string. This record exists so that, if a dispute about consent ever arises, we can prove what you accepted, when, and from where.
• Trade postings. When live trading is enabled, the application sends individual trade records (instrument, side, quantity, fill price, timestamp, the cumulative P&L attribution for that trade, the preset/config identifier under which the trade occurred) to the cloud API for inclusion in the aggregated track-record curve. Trade postings are signed with an HMAC key derived from your license key, which is how the cloud API authenticates that the post came from your installation.
• Active-config snapshots. When the application starts a new trading session, it posts a snapshot of the configuration in effect (which preset is loaded, which parameters have been edited) so that the cloud API can tag the resulting trade-stream with the configuration that produced it. The snapshot does not include credentials, broker account identifiers, or any data that identifies your broker account.

From you, when you contact us

• Email content, attachments, and the email address you write from when you contact [email protected].
• Refund-request metadata (Whop order number, account context) when you submit a refund request under the Refund Policy.

From Discord, if you are a Pro-tier licensee who joins

• Your Discord user ID and the role assignment Whop applies on your behalf. Your messages, voice activity, and other Discord content are governed by Discord’s own privacy policy; W.S. Trading Co. has no special access to them beyond what any server administrator on Discord has.

From your browser, when you visit our website

• Standard server log information (IP address, user agent, request path, response status, referring URL, timestamp). These logs are operated by our hosting provider (Cloudflare Pages for the marketing site and documentation site; Railway for the cloud API) for operational and security purposes, retained on the provider’s standard schedule.
• The marketing site does not use Google Analytics, Facebook Pixel, or any equivalent third-party tracker as of the date above. Web fonts are loaded from Google’s public CDN; that may result in a request to Google’s servers when you load the page, subject to Google’s policies.

The data that stays on your machine

A short list because it matters more than the long list above:

• Brokerage credentials. WS Terminal connects to Interactive Brokers via your local IB Gateway or Trader Workstation. Your IBKR username and password are entered into IBKR’s software, not ours. We do not see them, store them, transmit them, or have any technical means to recover them.
• Your brokerage account number or balance. We do not request these from IBKR. The trade postings described in § 02 above identify your installation by license, not by broker account.
• Raw market data. The market-data subscription you obtain from IBKR delivers ticks to your local installation for the application’s use. We do not relay, store, or otherwise see that data — under our agreement with Interactive Brokers and the exchange agreements that govern your subscription, we are not permitted to.
• Files on your local computer. The application reads and writes files under %APPDATA%\WSTerminal\ (license token, acknowledgment cache, trade log, custom presets, configuration). None of those files are transmitted to us except where § 02 above explicitly says so. We do not traverse the rest of your filesystem and we do not have remote-access mechanisms into your computer.
• Your trade history outside what you opt to sync. The local trade_log.json is the application’s own running log; the subset POSTed to the cloud API (per § 02) is what we see. If you run the application in paper mode, no trade postings are sent.

Each category of data, used for one or two specific purposes

• License + Whop data → validate that your subscription is active, route the right tier capabilities to your installation, communicate billing-status events to you in the application, and handle refund and chargeback flows under the Refund Policy.
• Acknowledgment audit log → prove, if a dispute arises, that you accepted the live-trading acknowledgment text in effect at the time you enabled live trading. This is a regulatory-defense record under 17 C.F.R. § 4.41 / NFA Compliance Rule 2-29 patterns described in the Disclaimer.
• Trade postings → compute the aggregated track-record curve that is displayed on api.ws-trading.co/track-record, on the marketing site, and inside the application. The curve is per-preset, not per-buyer, and individual postings are not displayed in a way that identifies the buyer who submitted them.
• Active-config snapshots → tag trade postings with the configuration that produced them so we can verify the aggregated curve corresponds to the published preset rather than a custom variant.
• Email and refund metadata → respond to the message you sent, process the refund or support request described, and keep a record sufficient to demonstrate the request was handled.
• Server logs from the website and cloud API → operate the services, investigate and mitigate abuse, and comply with applicable legal process.

We do not sell your personal information, rent it to third parties, share it with data brokers, use it for cross-context behavioral advertising, or process it for automated decision-making that has a legal or similarly significant effect on you.

Who else sees what

We operate the Services with a small set of third-party providers, each of which receives only the data needed to do its job:

• Whop — payment processing, license provisioning, Discord role assignment, refund execution. Whop receives your name, email, payment instrument, and any other data you provide during Whop checkout. Whop’s privacy policy applies.
• Railway — hosting for the cloud API at api.ws-trading.co and its Postgres database. Railway receives all data described in § 02 above as a function of hosting that infrastructure. Railway’s privacy policy applies.
• Cloudflare — CDN, hosting for the marketing site and the documentation site at docs.ws-trading.co, and email routing from [email protected] to the operator’s personal inbox. Cloudflare receives standard server-log information described in § 02 above. Cloudflare’s privacy policy applies.
• Discord — runs the Pro-tier community. Discord receives the data you provide it directly when you join the server and post in it. Discord’s privacy policy applies.
• Databento and other market-data providers — we license historical futures data from third parties for the aggregated track-record backfill described on /how-it-works.html. Those providers do not receive data about you; we are the customer of theirs.
• Google Fonts — the marketing site uses Google’s public CDN to load web fonts. Loading the page may result in a request to Google’s servers; the font requests do not include personalized data, but the request itself is subject to Google’s policies.

We may also disclose data to: (a) a successor entity in connection with a merger, acquisition, or sale of substantially all of W.S. Trading Co.’s assets, subject to the successor honoring the commitments in this Privacy Policy; (b) law enforcement, courts, or regulators when required by valid legal process, with notice to you where permitted by law; and (c) our professional advisors (legal, accounting, insurance) on a need-to-know basis under their own confidentiality obligations.

Retention schedule

• Live-trading acknowledgment audit logs: retained for at least seven (7) years following the expiration or termination of the corresponding license. This window is the prudent retention period given the statute of limitations under the Commodity Exchange Act private right of action (5 years absolute), state contract claims (typically 4–6 years), and state consumer- protection claims (typically 3–6 years), all of which could plausibly reach back into a buyer’s acknowledgment record.
• License records, Whop webhook events, and trade postings: retained while the license is active and for a further period after termination sufficient to comply with tax, accounting, and dispute-defense obligations (target: three (3) years after termination, longer if a dispute, chargeback, or investigation is pending).
• Email correspondence: retained while the related matter is open and for a reasonable archive period after resolution.
• Server logs: retained on each hosting provider’s standard schedule, typically days to a few weeks.
• Anonymized or aggregated data (the aggregated track-record curve, performance summaries for operational analysis): retained indefinitely. Aggregated data is not associated with an identifiable buyer once aggregated.

What sets cookies on this site

The marketing site at ws-trading.co does not set first-party tracking cookies and does not use analytics or advertising cookies as of the date above. The site does load web fonts from Google’s public CDN; that request happens from your browser to Google directly and is subject to Google’s cookie policy.

The cloud API at api.ws-trading.co issues authentication tokens to maintain dashboard sessions when you sign in. Those tokens are functional, not tracking.

The Discord and documentation properties operate on their own cookie policies (Discord’s for the Discord server, Cloudflare Pages’ for the docs site).

Access, correction, deletion, and similar requests

Subject to applicable law and the retention obligations described in § 06, you may:

• Request a copy of the personal information we hold about you (license record, acknowledgment records, trade postings attributable to your license, email correspondence).
• Request correction of inaccurate personal information (most commonly: updating an email address that has changed).
• Request deletion of personal information we hold about you. We will delete what we can, but we may retain (a) the acknowledgment audit log for the seven-year window described in § 06, (b) records necessary to comply with tax, accounting, anti-fraud, and legal obligations, and (c) records associated with an open dispute, investigation, or refund request.
• Opt out of any future marketing email we send you. We currently do not send marketing email, but if we begin to, the opt-out will be available at the bottom of the email and on request.

Submit a request by email to [email protected] with the subject line Privacy Request and a brief description of the request. We verify your identity by requiring the request to come from the email address on the corresponding license, or by a comparable verification path we agree on with you. We respond within 30 days for most requests; complex requests may take longer, in which case we will tell you so.

Residents of certain U.S. states (including, for example, California under the California Consumer Privacy Act and California Privacy Rights Act, and other state-law equivalents) may have additional or different rights with respect to their personal information. We honor state-law rights as required by the applicable statute, regardless of whether we are within the threshold that triggers that statute’s formal applicability to us.

We do not knowingly process personal information of children under the age of 18. WS Terminal is sold to adults who are legally capable of opening a futures brokerage account; the product is not directed to minors.

Where the data lives, where the operator lives

W.S. Trading Co. is based in the United States. Our hosting providers (Whop, Railway, Cloudflare, Discord) host the Services from infrastructure they operate, primarily in the United States. If you access the Services from outside the United States, you understand that your information will be transferred to, processed in, and stored in the United States.

We do not currently market the product to residents of the European Economic Area, the United Kingdom, or other jurisdictions whose data-protection laws impose additional transfer-mechanism obligations on the operator. If you reside in such a jurisdiction and you choose to purchase a subscription, you do so on the understanding that the Services are operated from the United States and you accept the consequences of the cross-border transfer.

What we do to protect what we hold

We use reasonable administrative, technical, and physical safeguards to protect the information described in § 02 above: encrypted transport (TLS) for all API and website traffic; authenticated and signed messages between the application and the cloud API (HMAC signing of trade postings, acknowledgment-record postings, and other write paths; verified Standard-Webhooks signatures on Whop webhook ingestion); restricted administrative access; secure handling of secrets and credentials in the cloud-hosting environment.

No system is perfectly secure. We do not warrant that our Services will be free from unauthorized access. If we become aware of a breach affecting your personal information, we will notify you and any applicable regulator as required by law, and we will work to mitigate the impact.

How updates are surfaced

We may revise this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision. Material revisions (changes that materially expand the categories of data we collect, the purposes we use it for, or the third parties we share it with) will be surfaced via in-application banner, dashboard prompt, or email to the address on the license. Non-material revisions take effect on posting.

How to reach us about your data

For privacy-related requests — access, correction, deletion, opt-out, questions about how we handle a particular kind of data, breach reports — email [email protected] with the subject line Privacy Request. We respond within 24–48 hours on weekdays for initial acknowledgment; substantive resolution is within 30 days for most requests, with notice to you if more time is required.

W.S. Trading Co. is the controller of the personal information described in this Privacy Policy. As of the “Last updated” date above, W.S. Trading Co. does not meet the thresholds that would require publication of a physical mailing address under the California Consumer Privacy Act or comparable state privacy laws (no sale of personal information; under the consumer-count and revenue thresholds). If your inquiry would require a physical mailing address to resolve, email the address above and we will provide one on request.