Privacy Policy

The controller of your personal data is Simon Bartos (business ID 3658308-4). Privacy questions and requests can be sent to support@quantwright.com.

Beta applications — when you apply for the private beta: your email address, your name if you give it, and your answers (what you tell us about yourself, the country you will use QuantWright from, the markets you trade, how you build strategies, whether you are in a prop-firm evaluation, a strategy you would test first, and how you heard about us).

Account information — your email address and basic profile details, recorded by our identity provider when you create an account, and the version and time of the Terms you accepted.

Subscription information — your Stripe customer id, subscription status and renewal date, and invoices. Stripe handles your card details; we never see or store them.

Content you create — strategies, generated code, backtests, chat messages and files you upload, and the assistant’s web searches for you: its queries, the pages it found or opened and short quotes from them, kept with the chat.

Bug reports — if you send one from the app: your description, the technical details the form shows you before you send it (page, browser, window size, theme and time) and, only if you tick the box, access to that chat so we can investigate; we keep a report until the issue is resolved and then for at most 12 months.

Free setup tests — when you use the “Test my setup free” form: your email address, the trading setup you describe, the market, symbol and timeframe you choose, and, if you give them, how you heard about us and a creator’s code. We use them only to run that one test, email you the result and send one follow-up about it; we do not add you to any mailing list. The legal basis is taking steps at your request (Art. 6(1)(b) GDPR). We do not store your IP address with the request; to prevent abuse we keep short-lived counters keyed to one-way hashes of your IP address and email address, deleted within a day.

Attempt reviews — if you email us a trading statement for a free review of one prop-firm challenge attempt: your email address and name, the file you send (its trades: dates, instruments, sides, sizes, prices and results, and anything else it shows, such as an account number, if you leave it in), the firm’s name and the limits and rules you tell us, and our review. We use them only to make that one review, send it to you and answer your questions about it: never to build or test our software, never for anything else, and we never publish or quote them. We remove your name, account number and other identifying details from the file before we read the trades. The legal basis is taking steps at your request (Art. 6(1)(b) GDPR). Please do not send passwords, or a file showing your address or bank details.

Visits to our public pages — when you open a page of our website that is readable without an account, the page tells our server which page it was (its path, without the rest of the address), the link tag it was opened with, if any (for example ?ref=x), and the name of the website you came from, if your browser gives it (for example reddit.com, never that page’s address). Our server uses your IP address and your browser’s user-agent string only in that moment, to make a code that changes every day (a one-way hash with a secret key), so we can count each visitor once a day; it never stores the IP address or the user agent. The daily code is kept with the page and link tag it was seen with for at most two days and then deleted; the daily totals (views per page, link tag and website) contain nothing about you and are kept. This uses no cookies and nothing stored in your browser. We use it only to count visits by source, on the basis of our legitimate interest in knowing which channels bring visitors (Art. 6(1)(f) GDPR).

People we write about — if our public research (for example our strategy studies or the Codeability Index) names you or a trading method you publish: the name you publish under, the public material we quote or describe, with its address and the date we read it, our saved copy of it, and our notes and scores on it. We take this from public sources: what you have published, and what others have published about your method (for example an article that restates your rules), each named and linked where we use it. We use it to publish research about trading methods offered to the public and to keep it accurate, on the basis of our legitimate interest in doing so (Art. 6(1)(f) GDPR). Before or soon after we publish, we may write to you at an address you publish for business to ask for your comments; that note contains no offer, and we keep it and your reply with the research. Anyone can read what we publish, on our website and on the platforms where we post it, and our AI provider, Anthropic, reads the material and our notes while we prepare it. You can object at any time, or ask us to correct or delete what we hold about you, through the contact address in the first section. A correction we make to published research is dated on our corrections page.

Creators we contact — if we consider inviting you to our creator programme: the name and handle you publish under, what your public profiles show (platform, audience size, what you post and sell), our notes on whether the programme suits you, the contact route you publish for business or collaborations, and our messages with you. We take this from your public profiles. We use it to decide whom to invite and to write to you about it, on the basis of our legitimate interest in finding creators to work with (Art. 6(1)(f) GDPR). We write only through a route you publish for business or collaborations, and one “no” is enough: we stop and do not write again. This is separate from our research: whether you take part never changes what our research says about you.

Usage and technical data — server logs, request identifiers, IP address, browser and device details, error reports, and how much AI work your account has used (for the fair-use limits).

To consider your application and contact you about the beta, and, if you told us you trade a prop-firm evaluation, to offer you a free attempt review once (you can say no at any time) — steps you ask us to take before a contract (GDPR Art. 6(1)(b)).

To provide the Service you subscribe to — running your backtests and analyses, storing your content, taking payment, support: performance of our contract with you (Art. 6(1)(b)).

To keep the Service secure and working — logs, abuse prevention, fair-use limits, debugging: our legitimate interest in a secure, reliable service (Art. 6(1)(f)).

To keep accounting records — invoices and payment records: our legal obligation under accounting law (Art. 6(1)(c)).

We do not sell your personal data, do not use it for advertising, do not use your content to train AI models, and make no automated decisions about you that have legal or similarly significant effects.

These providers process personal data on our behalf, only to provide their service to us:

• Clerk — sign-in and account management (your email address and login details)
• Supabase — our database, hosted in the United States (your account’s content, applications, subscription status)
• Vercel — hosting of the website and application (request logs, IP address)
• Fly.io — the servers that run backtests (strategy code, parameters and market data)
• Anthropic — the AI assistant for most messages, with its web search and the pages it opens, and the check on its replies before they are sent (your messages, strategy code, backtest results and what is read from files you upload; the search queries the assistant writes from them; and the addresses of the pages it opens)
• OpenAI — the check that generated code follows the rules you stated; and the AI assistant, with its web search, in Exact mode and when you paste a Pine script, attach a file or use some commands (the same kinds of data)
• Stripe — payments (your payment details, handled by Stripe; we receive a customer id, the subscription status and invoices)
• Resend — sending email (your email address and the message)
• Zoho Mail — our email, hosted in the EU (your email address, what you write to us and files you send us, such as a statement for an attempt review)
• Cloudflare — Turnstile, a bot check on the sign-up and sign-in forms run by Clerk (your IP address and signals from your browser, used only to tell people from bots)

What you write in the chat, your strategy code and your backtest results are sent to our AI providers, Anthropic and OpenAI, to write replies and code and to check them; the list above says which does what. When the assistant uses the web (beta), the search queries it writes from your messages, and the address of any page it opens, including a link you send, go to the provider running it, which fetches the page; the site that publishes the page receives that provider’s request, not yours. The pages found are listed under the reply. Neither provider may train its models on what we send. Each deletes it within 30 days, unless the law requires it to keep it longer or it keeps it longer to deal with misuse (Anthropic keeps a request its automated safety systems flag for up to 2 years). Anthropic runs its models for us in the United States; this does not extend to its web search or to the pages it opens. Do not paste secrets, private links or sensitive personal data into the chat.

If you connect your own AI assistant to your account through the Agent API, the results the Service returns go to that assistant and to its provider. You choose the assistant and the provider, and your use of them is under your own agreement with that provider: we do not choose or control them, and they do not process personal data for us. The Terms ask you to use the assistant with training turned off, or under zero data retention, with a provider hosted in the United States or the European Union.

Stripe also processes payment data as an independent controller for its own legal obligations (for example fraud prevention and financial regulation), under its own privacy policy.

Our market-data providers (named on the Legal & Disclaimers page) receive only what a data request needs — a symbol, a timeframe, a date range — and no personal data about you.

Our database and several of these providers are in the United States or process data there. Where they do, the transfer relies on the EU–US Data Privacy Framework for providers certified under it, and otherwise on the European Commission’s Standard Contractual Clauses in the provider’s data processing agreement.

Applications — while we consider them and for up to 12 months after we decide, then deleted. An approved application is kept while the account it led to exists, because it is what lets that account subscribe.

Account and content — while your account exists. When you ask us to delete your account, we delete it and its content within 30 days.

Payment and invoice records — for as long as accounting law requires (in Finland, up to 10 years), even after your account is deleted.

Free setup tests — until we have sent you the result, then for at most 12 months after we mark the request done. You can ask us to delete it sooner.

People we write about — what we publish stays up, with the quotes and links it rests on, unless we take it down (for example after an objection we accept). Our saved copies and notes, and any note we sent you about it, with your reply: at most while the research stays up, then deleted within 12 months after it comes down.

Creators we contact — our notes and messages: at most 12 months after the last message between us or, if we never write to you, after we note you; longer only while you take part in the programme. If you ask us not to contact you again, we keep your name and contact route on a do-not-contact list, and nothing else from our notes, so we can respect that.

Visit codes — at most two days. The daily visit totals contain nothing about you.

Attempt reviews — the file you send and the email it came in: deleted within 14 days after we send your review; our email provider then clears deleted mail from its servers within 30 days. Our review and your messages about it: at most 12 months after we send it. We keep a count of reviews with the date and the firm’s name, which contains nothing about you.

Logs and error reports — for a limited period needed for security and debugging, normally no longer than 90 days.

We carry out these deletions ourselves; they are not all automated yet, which is why the periods above are maximums rather than exact dates.

You can ask us for access to your personal data, and to correct it, delete it, restrict or object to its processing, or receive it in a portable form. You can export your strategies and backtests, and request deletion of your account and its content, through the contact address in the first section. We answer within one month.

You can also complain to a data protection authority — in Finland, the Office of the Data Protection Ombudsman (tietosuojavaltuutetun toimisto), or the authority where you live or work.

We use only the cookies needed to sign you in and keep your session. We count visits to our public pages without cookies (see “What we collect”) and run no advertising trackers or third-party analytics.

We use encrypted transport, per-user data scoping, and encryption at rest for stored credentials. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from children.

We may update this policy. Material changes are announced in the product and reflected by an updated “Last updated” date.