Privacy Policy

Last updated: September 28, 2026

1. Who We Are & What This Covers

This Privacy Policy describes how AutoApe LLC ("AutoApe", "we", "us") collects, uses, stores, and shares information when you use the AutoApe website (autoape.io), the AutoApe desktop application, and related services (the "Service"). It is incorporated into our Terms of Service.

2. Information We Collect

Account information. Email address, display name, and a hashed password when you register with email; or your basic profile (name, email, avatar) from Google or GitHub when you sign in with a social provider. We never see your social-login password. We also record which version of the Terms of Service you accepted when you created your account and each time you accept an updated version, and when.

Billing information. Payments are processed by Stripe. We receive your subscription plan, billing status, and the last four digits / brand of your card for support purposes — we do not receive or store full card numbers.

Service usage. Subscription verification events from the desktop app (login, license checks), API request metadata for our data services (endpoints called, request counts, rate limiting), device/browser information, IP address, and diagnostic logs. Referral-program activity if you participate.

AI assistant. On plans that include the managed AI assistant, the messages you send the assistant and the results of the tools it reads to answer you — which can include your open positions, balances, orders, bot and strategy settings, and paper or live trade history — are sent from the desktop application through autoape.io to Anthropic, which generates the reply. We store only the usage of each call (the model, token counts and cost), never the message content. If you use your own API key or a local model instead, your conversations go directly from your device to the provider you chose and do not pass through our servers.

Games and leaderboards. If you submit a score to the Banana Bonanza game, the player name you enter (and, if you give one, a shortened form of your Solana address) is shown publicly on the game leaderboard. The trading leaderboard is offline; entries submitted to it earlier are no longer shown publicly.

Support communications. Anything you send us by email.

3. What Stays on Your Device (We Never Receive It)

The desktop application stores the following only on your device, encrypted in a local vault (Argon2id key derivation + AES-256-GCM) protected by a master password that only you know:

  • brokerage and exchange API keys and OAuth tokens (Schwab, Alpaca, OANDA, CEX keys);
  • blockchain wallet private keys and seed phrases;
  • your local trading configuration and strategy settings.

Your keys, OAuth tokens, private keys and seed phrases are never transmitted to AutoApe servers — not even by the AI assistant. Trading operations execute directly from your device to your brokerage, exchange, or the blockchain. We cannot see, recover, or reset your master password, your keys, or your wallets. Your individual trade history and trading configuration live on your device and we do not collect them, except the content of AI assistant conversations you start on a managed-AI plan, which passes through our servers to Anthropic as described in Section 2.

4. How We Use Information

  • Provide, maintain, secure, and improve the Service
  • Verify subscriptions and license entitlements for the desktop app
  • Process payments, manage subscriptions, and apply referral credits
  • Send transactional emails (account, billing, security notices)
  • Provide customer support
  • Monitor aggregate usage, performance, and abuse (rate limiting, fraud detection)
  • Comply with legal obligations

We do not use your information for third-party advertising, and we do not sell or rent personal information to anyone.

5. Sharing

We share information only with:

  • Service providers acting on our behalf, bound to use it only to provide their service to us: Stripe (payments), Anthropic (AI assistant processing on managed-AI plans, see Section 2), Vercel (website hosting and Vercel Analytics), Neon (database hosting), Resend (email delivery), Google Analytics (only if you accept analytics cookies), and Google or GitHub when you choose to sign in with them;
  • Authorities when required by law, subpoena, or to protect the rights, safety, or property of AutoApe, our users, or the public; and
  • A successor entity in connection with a merger, acquisition, or sale of assets (your data remains subject to this policy or one at least as protective).

6. Security

We use TLS for all data in transit, encryption at rest for sensitive server-side data, hashed passwords, and access controls on internal systems. The most sensitive data in the AutoApe ecosystem — your keys — never reaches us at all (see Section 3). No method of transmission or storage is 100% secure, and we cannot guarantee absolute security; if we learn of a breach affecting your personal data we will notify you as required by law.

7. Retention

We retain account data for as long as your account is active or as needed to provide the Service. After account deletion we remove or de-identify personal data within 90 days, except where retention is required for legal, tax, billing-dispute, or fraud-prevention purposes. Aggregated, de-identified usage statistics may be retained indefinitely.

Two exceptions apply today. First, when an administrator deletes an account, we keep that account's email address, and our internal audit log keeps its entries about administrative actions on the account (including the deletion). We keep these records to prevent abuse and to resolve disputes, and we currently retain them indefinitely; you can ask us about them at the address in Section 12.

Second, we keep the records of your Terms of Service acceptances (your account ID, email address, the version you accepted, and when) after your account is deleted, whether you or an administrator deletes it, for legal purposes.

8. Cookies

The website uses essential cookies for authentication and session management. To understand aggregate site usage it uses Google Analytics, which is loaded only after you consent to analytics cookies, and cookieless Vercel Analytics. We do not use third-party advertising cookies. You can also control cookies through your browser settings; blocking essential cookies will break sign-in.

You can change or withdraw your analytics consent at any time: (also in the site footer).

9. Your Rights

Depending on your jurisdiction (including under GDPR and CCPA/CPRA), you may have the right to access, correct, delete, or export your personal data; to restrict or object to certain processing; to opt out of non-essential communications; and to not be discriminated against for exercising these rights. We honor these requests for all users regardless of location. To exercise any of them, email info@autoape.io — we will respond within 30 days. EU/UK users may also lodge a complaint with their supervisory authority.

10. International Transfers

We are based in the United States and process data there. If you use the Service from outside the U.S., you understand your information will be transferred to and processed in the U.S., which may have different data-protection laws than your jurisdiction.

11. Children

The Service is not intended for anyone under 18. We do not knowingly collect personal information from children; if we learn that we have, we will delete it promptly.

12. Changes & Contact

We may update this policy from time to time; material changes will be notified via email or through the Service, and the date above will change. Privacy inquiries: info@autoape.io.