Data Privacy

• Your email address. Used to identify your account and to sign you in. Nothing else.
• A hash of your password. Hashed with argon2. We never store, log or have access to the password itself.
• Session records. A row holding a session identifier, when it was created and when it expires. The cookie in your browser holds that identifier and nothing more.
• Your activity on the exchange. Orders, fills, positions and ledger entries. This is the product working, and it is kept for as long as the account exists.
• Server logs. Standard web request logs including IP address, user agent, path and timestamp, kept on a rolling basis for operations and abuse handling.

• Payment details of any kind. There is no payment processor in the service, so there is nothing to collect.
• Government identification, date of birth, address or phone number.
• Anything from behind an authentication wall on another platform. We do not ask for, and cannot access, your social accounts.
• Analytics, advertising or behavioural tracking. The site loads no third-party scripts and no analytics package.

Two cookies, both strictly necessary, neither used for tracking:

• A session cookie, set when you sign in, holding only a session identifier. It is httpOnly, Secure and SameSite=Lax.
• A preview access cookie, set while Trendex is in private preview, recording that you entered the shared access password. It holds a signed token, not the password.

Trendex ingests public metrics about the public figures, creators and memes it lists. That data comes from the YouTube Data API, Google Trends and Wikimedia pageviews, and it is public information about public figures. It is entirely separate from user accounts and is never joined to them.

We use these providers to run the service, and no others:

• Vercel, which hosts and serves the web frontend.
• Hetzner, which hosts the application server in Ashburn, Virginia, and the encrypted backup storage in Helsinki, Finland.
• Cloudflare, which provides DNS and sits in front of the API as a proxy and firewall.

We do not sell personal data, share it with advertisers, or disclose it to anyone else except where required by law.

Account and trading data live in a database on the Ashburn server. Backups are taken daily, retained for 14 days on that server and 90 days on separate storage in Finland. Your data therefore crosses between the United States and the European Union as part of normal backup operation.

You can ask us to show you the data we hold about you, correct it, export it, or close your account. Write to privacy@trendex.trade.

The limit worth stating plainly: we cannot always delete trading records outright. Every transaction on Trendex is a double-entry ledger journal, and each journal must sum to zero. Erasing one side of a completed trade would leave the other side unbalanced and would corrupt the records of the account on the other end, which is not yours to erase.

So when you ask us to close your account we anonymise it: your email address and password hash are removed, every session is destroyed, and you can no longer sign in. The ledger entries remain, attached to an account that no longer identifies anyone. If that is not acceptable to you, do not create an account.

Passwords are hashed with argon2. Sessions are server-side and can be revoked. The database is not reachable from the public internet. Traffic is encrypted in transit, and the API sits behind a proxy with firewall rules and rate limiting. None of that is a guarantee, and no service can offer one.

To report a vulnerability, write to security@trendex.trade. See the System Policies page for what we ask of security researchers.

Trendex is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, write to privacy@trendex.trade and we will remove it.

If this policy changes, the date at the top of the page changes with it. Material changes will be announced in the product.