Privacy Policy

Effective October 20, 2026. StratPilot is operated by Styles Renner in Texas, USA ("StratPilot", "we", "us").

StratPilot is a futures backtesting service. You use it on this website and from AI assistants such as Claude and ChatGPT through our MCP connector. This policy explains what we collect, why, who processes it, how long we keep it, and what you control. It's written in plain English. If anything is unclear, email support@stratpilot.dev.

What we collect

• Account details: your email address and a password hash. We store your password only as an Argon2id hash. We never store or see the plain password. If you use "Continue with Google", we receive your email address, whether Google has verified it, and your Google account ID (to recognise you next time); we don't get your Google password or access to anything else in your Google account.
• Public profile: your handle (your handle.corka.ai subdomain), and the display name and bio you choose, are public. Your email is never shown. Your runs stay private unless you share or publish them.
• Your strategies and results: the strategy rules you (or your AI assistant) submit, and the backtest output we generate: trades, statistics, charts, equity curves, optimization results and report pages.
• Usage counters: how many backtests and optimizations you ran each day, and running jobs (to enforce quotas). For AI features: the number of model calls, tokens and cost.
• Security data: IP address and browser user-agent for sessions, rate limiting and abuse prevention, plus a security log of sign-ins, failed sign-ins, token and app changes.
• Connected apps (OAuth): when you connect Claude, ChatGPT or another MCP client, we store that client's registration info (name, redirect URLs, client ID) and the access/refresh tokens we issue to it. We store tokens only as hashes.
• Video links ("strategy from video"): the public video link you submit (YouTube, TikTok, Instagram or another supported video site), the video's public title, description and transcript (or a transcript we make from its audio), and the strategy we extract from it. These are saved with the resulting run so the report can show its source.
• API tokens you create: only a hash and a short prefix.
• Cookies: a session cookie and a CSRF-protection cookie. Both are strictly necessary and are not used for advertising. The site may use Cloudflare Web Analytics, which is cookieless and collects aggregate page-view data.

We don't collect payment information (billing isn't live), and we don't ask for your brokerage accounts, positions or real trades.

Why we use it

• To run the service: sign you in, run your backtests, show your dashboard and reports, and connect your AI assistant.
• To keep it secure and fair: rate limits, quotas, abuse prevention and debugging.
• To meter AI calls for daily usage caps, cost control and abuse prevention.
• To contact you about your account or important service changes. We don't send marketing email without your consent.

We do not sell or rent your personal data, and we don't use it for advertising. We don't use your strategies to train AI models.

Who processes it (sub-processors)

• Cloudflare, Inc.: DNS, CDN/proxy, TLS and DDoS protection. All traffic to our sites passes through Cloudflare. Cloudflare Web Analytics (if enabled) provides aggregate statistics.
• Hetzner Online GmbH: server hosting in Germany (Nuremberg data center). Your account data and results are stored there.
• OpenRouter, Inc.: used for included AI features (plain-English rule parsing, auto-tuning, result explanations and automatic run titles) for signed-in accounts. For those calls we send the relevant strategy text or result statistics, never your email or password. For "strategy from video" we send the video's title, description and transcript, and a strategy summary is used to generate a short run title.
• YouTube (Google LLC), TikTok, Instagram (Meta Platforms, Inc.) and other video sites you link to: when you submit a video link, our server fetches that public video's page, captions or audio from the platform. YouTube requests are routed through Cloudflare's WARP network. Downloaded audio is transcribed on our own server and deleted immediately afterwards; we don't keep video or audio files.
• Databento, Inc.: the source of the historical market data we test against. Data flows from Databento to us. We don't send your personal data to Databento.

When you use StratPilot through Claude or ChatGPT, Anthropic's or OpenAI's own privacy policies cover your conversation with that assistant. We receive only the tool calls the assistant makes to our connector.

How long we keep it

• Account data, strategies and results: as long as your account exists. They are deleted when you delete your account.
• Sessions: up to 30 days. OAuth access tokens: about 1 hour. Refresh tokens: up to 60 days, or until revoked or the app is disconnected.
• Security log and rate-limit records: up to 90 days.
• Daily usage counters: deleted with your account.
• Video audio: deleted right after transcription (seconds to minutes). Transcript excerpts and extracted rules: kept with the run until you delete it or your account.
• AI cost records (internal ID, tool, tokens, cost; no email): up to 24 months, for billing and abuse review.
• Server backups, if any, roll over within 30 days.

Your controls

• Delete your account any time on the Account page. This removes your account, runs, reports, optimizations, API tokens and connected apps immediately.
• Revoke API tokens and disconnect apps (Claude, ChatGPT, etc.) on the Account page. Access stops immediately.
• Change your password on the Account page. This signs out other sessions.
• Access, correction, export: email us and we'll respond within 30 days. Your run reports are also viewable and downloadable (CSV trade lists) from your dashboard.

Depending on where you live (for example the EU/UK under the GDPR, or US states such as California or Texas), you may have additional rights. Email us to exercise them. Our legal bases are performing our contract with you (running the service), legitimate interests (security, abuse prevention) and consent where required.

Security

We use HTTPS everywhere, hashed passwords and tokens, HttpOnly/Secure session cookies, CSRF protection, per-user data isolation, rate limits and a hardened server. No system is perfectly secure. If we learn of a breach affecting your data, we'll notify you as required by law.

Children

StratPilot is not for anyone under 18, and we don't knowingly collect data from children.

Changes

We'll post changes here and update the effective date. If a change is significant, we'll notify account holders by email or on the site before it takes effect.

Contact

StratPilot (Styles Renner), Texas, USA. support@stratpilot.dev