# Privacy policy > What Tactfolio collects, why, who it shares it with, how long it keeps it, and how to see, export or delete your data. No ads and no tracking cookies. Written by [Tactfolio research team](https://tactfolio.com/about/editorial-policy.md), published 2026-10-16, updated 2026-10-16. Last updated October 16, 2026. > **In short:** we collect what Tactfolio needs to run your account, your strategies and your trading. We do not sell your data, show ads or use tracking cookies. You can ask us to delete your account and everything in it at any time. This policy covers tactfolio.com, the Tactfolio app, our emails and the Tactfolio MCP server that AI assistants such as Claude and ChatGPT connect to. "We" means the Tactfolio team. ## What we collect **Your account.** Your email address and a password, which we store only as a salted hash. We also store the public handle you choose, such as the one in your strategy links. **What you build.** Your strategies, every saved revision, backtest settings, and anything you import from Composer, QuantMage or a JSON file. Strategies stay private until you publish them. **Trading connections.** If you connect Alpaca, we store your Alpaca account id and API keys. If you connect Hyperliquid, we store your wallet address and the agent key you create for Tactfolio. Secret keys are encrypted with AES-256-GCM before they are stored. We also store your strategy's orders, positions, balances and daily results, so Trade can show them and email you a summary. **AI assistants.** When you connect an assistant, we store the assistant's name and web address as it registered them, the access you approved, and short-lived access tokens. While the assistant works, we keep its working drafts for up to 7 days. If the assistant sends us a problem report with the `send_feedback` tool, we store what it wrote, the tool involved, and the assistant's name, model and version. We do not receive or store your conversations with your assistant. We only see the requests it sends to Tactfolio's tools, such as "backtest this strategy". **Support.** The messages you send us from the Support page and the email address we reply to. **Technical data.** When you sign in, we store your IP address and browser type with your session, so you can see and end your sessions and we can spot abuse. Support requests store the IP address they came from, to limit spam. Our servers keep request logs, which include IP addresses, for a short time to find and fix problems. ## Cookies We use one kind of cookie: the sign-in cookie that keeps you signed in. We do not use advertising or analytics cookies, and we do not track you across other sites. The app saves a few settings, such as panel sizes and where to return after you sign in, in your browser's local storage. They never leave your device. ## How we use your data - To run Tactfolio: save your strategies, run backtests and run the strategies you choose to trade. - To send emails you need: sign-up and password links, trading summaries, problems with your strategies, and replies to your support requests. - To keep Tactfolio safe: stop abuse, protect accounts and find bugs. - To improve Tactfolio: fix what assistants and members report. We do not sell your data. We do not use it for advertising. We do not use your private strategies to train AI models. ## Who we share it with We share data only with the services that run Tactfolio, and only what each one needs: - **Railway** hosts our servers and database, in the Netherlands. - **Cloudflare** carries traffic to tactfolio.com and sends our emails. - **Alpaca**, if you connect it. Your strategy sends orders and reads your account with your own keys. - **Hyperliquid**, if you connect it. Your strategy signs orders with the agent key you created. When you publish a strategy, its rules, backtest and your public handle become visible to everyone. Anyone can view and copy a published version. We may share data if the law requires it, or to protect our members or Tactfolio from fraud or harm. ## How long we keep it - Your account, strategies and trading history: until you delete them or ask us to delete your account. - Assistant drafts: deleted after 7 days without use. - Assistant access: an access token lasts one hour. A refresh token lasts 30 days, and you can revoke an assistant at any time on the [MCP page](https://tactfolio.com/connect). - Sign-in sessions: until you sign out or they expire. - Server request logs: a short time, usually a few weeks. When we delete your account, we delete your strategies, trading connections, keys, drafts and sessions. A strategy version you published may stay in other members' copies, because they copied the rules, not your account. ## Your choices and rights - **See and change your data.** Your strategies are in your workspace, and your email and password are in Settings. - **Remove an assistant.** Revoke it on the [MCP page](https://tactfolio.com/connect). - **Disconnect a broker.** Disconnect it in Trade. This deletes its stored secret key. - **Delete your account.** Ask us from the [Support page](https://tactfolio.com/support). We confirm by email and delete it within 30 days. - **Get a copy.** Ask us for a copy of your data. You can also export any strategy as a JSON file from the builder. Depending on where you live, laws such as the GDPR give you more rights, such as objecting to how we use your data or complaining to a data protection authority. Write to us and we will help. ## Security Passwords are hashed. Broker and wallet keys are encrypted. All traffic uses HTTPS. Assistants get tokens that work only for Tactfolio's MCP server and only for the access you approved. No system is perfectly safe, so tell us at once if you think your account was misused. ## Children Tactfolio is not for children. You must be 18 or older to create an account. ## Changes to this policy When we change this policy, we update the date at the top. If a change matters for how we use your data, we will tell members by email before it takes effect. ## Contact Write to us from the [Support page](https://tactfolio.com/support). You do not need an account, and we reply by email.