Privacy Policy

Last updated: June 2026

What vwaply stores and why:

• Account: your email and a salted password hash (argon2id). We never store plain-text passwords.
• Broker credentials: API keys/tokens you connect are encrypted at rest (AES-256-GCM) and are never displayed back in full or shared with third parties.
• AI credentials: provider API keys you save in Settings are encrypted at rest (AES-256-GCM) and used only to call the provider you selected.
• Trading data: equity snapshots and journal entries (computed from your broker's paper-trading fills) are stored to power your dashboard and journal.
• AI processing: Copilot messages and the market/account data needed to answer them are processed by the AI provider configured for your account or deployment. They are not used to train models.
• No selling of data, no ads, no tracking cookies. A session cookie keeps you signed in - that's it.

Disconnecting a broker deletes its stored credentials. Deleting your account deletes your data. Questions: support@vwaply.com.