Privacy Policy

Last updated: October 2026

This Privacy Policy explains what ThetaFlow ("we", "us") collects, why, and how we handle it. By using ThetaFlow you agree to this policy.

1. Information we collect

  • Account identity — your name and email address, your brokerage login or account ID, and the numbers of the brokerage accounts your strategies trade.
  • Brokerage authorization — for Tastytrade, the client ID and secret of the Tastytrade app you register, and an OAuth access/refresh token; for Alpaca, the API key ID and secret you create in Alpaca; for Webull, the App Key and App Secret you create in Webull. All are stored encrypted at rest and never written to our logs. We never receive or store your brokerage password.
  • Your configuration — the strategies and parameters you create.
  • Trading data — orders, fills, positions, and the profit-and-loss we sync from your brokerage account to run and report on your strategies.
  • Operational data — basic logs and session information needed to run the service securely.

2. How we use it

We use your information to operate the service: to authenticate you, execute and track the strategies you configure, show your P&L, provide support, and bill your subscription. We do not use your trading data to make recommendations, and we do not sell your personal information.

3. How we share it

  • Your brokerage (Tastytrade, Alpaca or Webull) — to act on the accounts you connected, as you have configured.
  • Payment processor — to bill your subscription. Your card details are handled by the processor, not stored by us.
  • Infrastructure providers — hosting and database providers that run the service on our behalf.
  • Legal — when required by law or to protect rights and safety.

4. Security

We connect to your brokerage through OAuth (no stored passwords) and encrypt your brokerage tokens at rest. No system is perfectly secure, but we take reasonable measures to protect your data.

5. Data retention and your choices

We keep your information for as long as your account is active or as needed to provide the service and meet legal obligations. You can disconnect your brokerage, disable, or delete your account at any time; on deletion we remove your stored brokerage token and personal account data, subject to records we must retain by law. To request access to or deletion of your data, contact us.

6. Cookies

We use a single session cookie to keep you signed in. We do not use third-party advertising cookies.

7. Children

ThetaFlow is not intended for anyone under 18, and we do not knowingly collect data from children.

8. Changes to this policy

We may update this policy; material changes will be reflected by the "last updated" date above.

9. Contact

Privacy questions or requests? Email hello@thetaflow.app.