How your data is protected.

We never see your broker password.

Futures accounts connect through Tradovate’s own sign-in page under the NinjaTrader vendor program (OAuth). Stock and options accounts connect through our brokerage-connection provider’s hosted portal. You sign in with them, not with us.

• The access tokens we hold are encrypted at rest (AES-256-GCM)
• Logins and API keys you type into the desktop app are encrypted by Windows or macOS secure storage on your computer
• Orders go out only when you place them, or when you turn on Copy Trader or a bot for that account
• Some brokerages are view-only through our partner; we say so instead of trying to trade
• You can disconnect a broker at any time in Broker Connections

Your own copy of your data.

Your data vault is your journal, written as plain files you own: an Obsidian vault or a private Git repository of yours.

• Every trade can journal itself into your own vault on your own computer
• Notes the desktop backs up to our servers are encrypted at rest
• Export your data vault at any time as an Obsidian-ready folder, or back it up to your own private GitHub repository
• Your GitHub sign-in stays on your computer, encrypted by Windows or macOS

Pooled, anonymised, never sold.

The Lucid Data Pool combines anonymised trade data so features like Data Clocking can show patterns. Here is exactly how it works.

• It takes a fixed list of trade fields, never names, emails, account numbers, notes or screenshots
• Free plans contribute by default; that is part of what keeps Free free. Paid plans can switch it off in Settings → Privacy & Data
• Switching off stops new trades from contributing; trades already pooled stay in the aggregate
• After 90 days the user ID on a pooled trade is replaced with a one-way hash, so it can no longer be linked to you
• Other users only ever see aggregated outputs, never your individual trades
• We do not sell personal information, and pool details are sealed with their own separate key

The Privacy Policy is the binding description of the data pool.

No keys that can withdraw.

When crypto exchange connections open, you link an exchange with your own API key. We check its permissions first.

• A key that can transfer or withdraw funds is refused and never saved; our database will not store one
• There is no transfer, withdraw or deposit function in our exchange code at all
• Saved keys are encrypted at rest and never sent back to any screen; you only see the last few characters
• Wallets are added as read-only addresses

Crypto exchange connections are coming soon.

Stripe handles your card.

You pay on Stripe’s secure checkout. Your card number never reaches our servers.

• We see your Stripe customer ID and whether your plan is active, not your card
• Identity checks for a PIN reset happen on Stripe Identity’s page; we receive only the result, never the images
• Payment webhooks are signature-checked before we act on them

Locks on your account.

The basics, done properly.

• Two-factor authentication in Settings → Account, and an optional App PIN lock
• Passwords hashed with Argon2id; we cannot read your password
• HTTPS everywhere
• Database backups are encrypted to an offline key, so even our own server cannot read them

When something breaks, you see it.

We publish how the service is doing and keep a record of what each order did.

• The status page shows every part of the service, 90 days of uptime and the incident history, and you can get incident emails
• Every order and copied order has a receipt in the app: the times, the prices, the slippage and every check it passed, with a CSV download
• Your own measured order speed is shown as a measurement, and our target as a target

What we can’t promise.

This page explains our practices in plain words. The Privacy Policy and Terms are the binding versions. Privacy Policy · Terms of Service · Report a security issue