Privacy Policy

1. Who we are

ThisTimeIsDifferent is a subscription SaaS for cryptocurrency trading automation: paper trading, backtesting, and live bots that you operate from our cloud dashboard. We are not a broker, exchange, custodian, bank, or investment adviser.

Contact: hello@thistimeisdifferent.app · Support: support@thistimeisdifferent.app · Billing: billing@thistimeisdifferent.app

2. What we collect

• Account data: email, name (if provided), password hash, tenant/workspace membership, plan and feature entitlements, onboarding acknowledgements (including Terms acceptance).
• Billing data: subscription status, plan, add-ons, invoices, and Stripe customer / subscription identifiers. Card numbers are processed by Stripe — we do not store full card PANs on our servers.
• Exchange credentials: API keys and related secrets that you choose to connect, stored encrypted in our database for the purpose of running your bots. You must use trade/read permissions only — never withdrawal-capable keys.
• Trading operations data: strategy configs, signals, orders/fills metadata, positions, paper balances, backtest jobs, risk settings, and related logs needed to operate and debug the Service.
• Product telemetry: login sessions, security events (including 2FA), approximate IP / user-agent for abuse prevention, and optional product analytics such as hashed page-view signals where enabled.
• Support communications: messages you send to our contact or support addresses, and in-product notifications.
• AI features (optional): if you enable Sentiment+ or similar features, prompts/context derived from market and strategy data may be sent to third-party AI providers under their terms, solely to generate informational outputs.

3. What we do not collect or hold

• We do not custody your crypto or fiat.
• We do not receive your exchange login password (only API credentials you paste).
• We do not sell your personal data to data brokers or advertisers.

4. Why we process data (purposes)

• Provide, secure, and improve the Service (bots, dashboard, paper, backtest).
• Authenticate users, enforce plan limits, and prevent abuse/fraud.
• Bill subscriptions and add-ons via Stripe; send billing-related notices.
• Provide support and operational incident response.
• Comply with law and enforce our Terms of Service.

Legal bases (where applicable, e.g. GDPR/LGPD-style regimes): contract performance (running your account), legitimate interests (security, product integrity), consent where required (e.g. certain cookies/marketing), and legal obligation when we must retain records.

5. Processors and sharing

We share data only as needed to run the Service:

• Stripe — payments and customer portal.
• Hosting / infrastructure — cloud VMs, database, and logs under our control or our hosting providers.
• Email / messaging — transactional mail (e.g. Migadu) and optional Telegram bots if you enable them.
• Exchanges — your bots call exchange APIs using your credentials; exchange privacy practices are theirs, not ours.
• AI providers — only when you use AI-powered features that require an external model call.
• Authorities — if legally required, or to protect rights, safety, and the integrity of the Service.

We do not sell personal information.

6. Cookies and sessions

We use essential cookies/local storage for login sessions, security (e.g. 2FA / trusted device), and CSRF-style protections. These are required for the Service to function. Optional analytics cookies, if introduced, will be disclosed and controlled where required by law.

7. Retention

We retain account, billing, and operations data for as long as your account is active and for a reasonable period afterward for security, dispute resolution, backups, and legal compliance. You may request deletion of account data subject to Section 8; some billing and security logs may be retained where we have a legitimate need or legal duty.

8. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, restrict, or delete personal data, and to object to certain processing. To exercise these rights, email support@thistimeisdifferent.app from your registered address. We may verify identity before acting.

You can update many profile and exchange settings directly in the dashboard. Closing your account does not unwind trades already executed on your exchange.

9. Security

We use encryption in transit (HTTPS), encrypted storage for exchange secrets, access controls, and operational monitoring. No method of transmission or storage is 100% secure. You remain responsible for password strength, 2FA, and the scope of API keys you upload.

10. International transfers

The Service is operated from infrastructure that may be located outside your country (including cloud regions we choose for production). By using the Service you acknowledge that your data may be processed in those locations with appropriate safeguards where required.

11. Children

The Service is for adults who can form a binding contract and legally trade digital assets where they live. We do not knowingly collect data from children under 18 (or the higher age of digital consent in your region).

12. Changes

We may update this Privacy Policy. Material changes will be reflected by updating the effective date on this page and, when appropriate, by notice in the product or by email. Continued use after the effective date constitutes acceptance of the revised policy.

13. Contact

Privacy questions: support@thistimeisdifferent.app · Billing: billing@thistimeisdifferent.app