Privacy Policy

Epic Apex Trader

Last updated: 2026-07-24

---

1. Overview

This Privacy Policy describes how an Epic Apex Trader deployment (“Apex”, “we”) may collect, use, and store information when you use the desk and APIs.

Because Apex can be self-hosted, the deploying operator is the data controller for that instance.

2. Information we collect

Account data

• Email address, display name, password hash (not plaintext password)
• Authentication tokens (JWT) issued to your browser or client

Trading configuration (BYOK)

• Encrypted venue credentials you choose to store (stocks API, crypto exchange keys, optional DEX material)
• Autopilot preferences, risk settings, and audit events related to key changes

Trading and wallet activity

• Portfolio positions, fills, journal entries, wallet ledger events
• Optional payment references (session ids, amounts) when card funding is enabled

Technical data

• Server logs (errors, health checks, request metadata)
• Cache of public market data used for charts and signals

We do not intentionally collect government ID, biometric data, or full payment card numbers inside Apex. Card payments, if any, are processed by the operator’s payment processor under that processor’s privacy policy.

3. How we use information

• Authenticate you and isolate your tenant data
• Execute or prepare trades using your keys on your venues
• Provide charts, signals, risk, and wallet features
• Secure the service, debug faults, and prevent abuse
• Comply with law when required

4. Multi-tenant isolation

Signed-in users’ portfolio, wallet, journal, and credentials are stored separately. Operators must not use user keys except to operate the service for that user.

5. Sharing

We do not sell personal data. Data may be shared with:

• You (via the desk and APIs)
• Venues you connect (orders and balance requests using your keys)
• Payment processors when you fund the wallet
• Infrastructure providers used by the operator
• Authorities when legally required

6. Retention

Account and trading records are retained while your account is active and as needed for security and audit. Logs are rotated according to operator policy. You may request deletion of account data from the operator; some records may be retained where required by law or fraud prevention.

7. Security

• Passwords hashed (PBKDF2)
• Venue secrets encrypted at rest
• HTTPS recommended and required for public deployments
• No security measure is perfect; report issues privately when possible

8. Local storage

The desk may store a JWT access token in browser local storage for session continuity. Clear it via Sign out.

9. Children

Epic Apex Trader is not directed to children under 18 (or the age of majority in your jurisdiction).

10. International users

Data may be processed where the operator hosts infrastructure. You are responsible for ensuring use is lawful where you live.

11. Your choices

• Do not store API keys if you prefer operator-only configuration
• Delete keys in My Keys
• Sign out to clear local tokens
• Contact the operator for access or deletion requests

12. Changes

Updates will be posted to this document and/or the repository. Continued use constitutes acceptance.

13. Contact

Contact the instance operator or open a private security report via the project’s private repository.