Privacy Policy

1.The short version

• We collect what is needed to run your account and the platform: your email, username, password (stored only as a one-way hash), and what you do inside the product.
• We do not sell your personal data. We do not show advertising and we do not run advertising or analytics trackers on this site.
• Hybrid Forex is a paper-trading and research platform. We never hold your money and never see your bank or card number; card payments are handled by Stripe.
• Some features send text to AI providers to generate answers. We never send your password, payment details or broker keys to them.
• You can ask us to give you a copy of your data, correct it, or delete your account at any time. See section 11.

2.Who we are

This policy explains how Hybrid Forex (“Hybrid Forex”, “we”, “us”) handles personal information when you visit hybridforex.com or use the platform, including the Trade Desk, SimDesk paper trading, Round Table, Pit Boss, Auto-Trade, Strategy Lab, the journal and the daily Morning Call. We decide why and how your information is used, which makes us the controller of it.

Contact for anything in this policy: [email protected].

3.Information we collect

You give us:

• Account details: email address, username, display name and password. The password is stored as a salted one-way hash; we cannot read it.
• Optional profile details: for example country, trading experience, risk profile, goals, preferred markets and account-size range. These help tailor onboarding and the compliance notices shown for your country.
• Trading activity inside the platform: paper orders and positions, watchlists, alerts, strategy and auto-trade rules, journal entries and notes, and the questions you put to Pit Boss or the Round Table.
• Broker connections you choose to add: API keys or tokens for a broker. They are encrypted with AES-256-GCM before storage and used only to talk to that broker on your behalf.
• Community content: messages you post in Trading Floors.
• Support messages: anything you email to us.
• Newsletter sign-ups: the email address you enter on our site to receive the daily brief.

We collect automatically:

• Security and device data: IP address, browser and device type, session and trusted-device identifiers, sign-in history, and audit records of sensitive actions such as sign-ins, password resets and two-factor changes.
• Service usage: which features you use and how often, including AI usage counts, so we can apply plan allowances and keep the service reliable.
• Email delivery records: recipient, subject line and delivery status of the emails we send you.

From payment processing: when you buy a paid plan, Stripe collects your card details directly. We receive only a Stripe customer identifier, your plan and subscription status.

We do not knowingly collect government identity numbers, bank account numbers or card numbers, and we ask you not to put them in notes, chat or journal entries.

4.Cookies and local storage

We use only what the site needs to work and to keep your account safe:

• Session cookie (hforex_session): keeps you signed in. It is HttpOnly, Secure and SameSite, and lasts up to 30 days.
• Trusted-device cookie: remembers a device you have marked as trusted so we can skip extra sign-in checks there. It lasts up to a year.
• Browser storage (hf-theme): remembers your light or dark theme.
• Security cookies from Cloudflare: our network provider may set technical cookies that protect the site from abuse.

We do not use advertising cookies, cross-site tracking or third-party analytics. Because these cookies are strictly necessary, the site does not show a cookie consent banner. If that ever changes we will update this page and ask first.

5.How we use your information

• Provide the service: create and secure your account, run paper trading and strategies, keep your journal, and deliver alerts.
• Generate AI output: answer your questions and produce research, summaries and setups (see section 5).
• Take payment and manage your plan through Stripe.
• Keep the platform safe: detect fraud, abuse and unauthorised access; enforce our Terms; investigate incidents.
• Communicate with you: account and security emails, billing notices, support replies, and the daily brief if you subscribed. You can unsubscribe from the brief at any time.
• Improve and maintain the platform: fix bugs, monitor performance and reliability, and understand which features are used.
• Meet legal obligations and protect our rights.

Legal bases (EEA and UK visitors): we rely on performance of our contract with you to provide the service; our legitimate interests in security, fraud prevention and improving the product; your consent for marketing emails, which you can withdraw at any time; and legal obligation where the law requires us to keep or disclose information.

6.AI features and your data

Several features are powered by third-party AI models: the Round Table and Macro Round Table, Pit Boss, trade setup and price level generation, the strategy assistant, news summaries, the Morning Call and community message tagging. We currently use Anthropic and OpenAI, and may add or change providers.

• Depending on the feature, the text sent can include your question, the symbols involved, and trading context such as positions, watchlists or journal notes that the feature needs to answer you.
• We never send your password, payment details or broker keys to an AI provider.
• Pit Boss keeps short memories of your conversations so it can be more useful next time. Ask us if you want them deleted.
• AI output is generated automatically and can be wrong. It is educational and is not personalised investment advice. See the Risk Disclosure.

7.Who we share information with

We do not sell your personal information and we do not share it for cross-context advertising. We share it only with providers that help us run the service, under their own terms:

• Hosting and network: our server provider and Cloudflare, which deliver and protect the site.
• Payments: Stripe.
• Email delivery: our email sending provider, which receives the recipient address and message content.
• AI providers: Anthropic and OpenAI, as described in section 5.
• Market data providers: services such as Twelve Data, EODHD and Yahoo Finance receive ticker symbols to return prices. They do not receive personal information.
• Brokers you connect: when you add a broker, we exchange data with it on your instruction.
• Google Drive: encrypted backups of our systems are stored there (section 7).
• Advisers and authorities: professional advisers, and courts or regulators when the law requires us to disclose information or to protect rights, safety and security.
• A future owner: if Hybrid Forex is merged, acquired or sold, information may transfer to the new owner, who must honour this policy.

Trading Floors posts and your chosen display name are visible to other members.

8.Google services and encrypted backups

Hybrid Forex does not offer “Sign in with Google” and does not read members’ personal Google data. We use Google Drive in one way only: our operator account stores nightly backups of our own database and configuration.

• Every backup is encrypted on our server before it is uploaded, so Google cannot read its contents.
• The connection is limited to files our backup job itself creates; it cannot browse other files in the account.
• Backups are kept on a rolling schedule of 7 daily, 4 weekly and 6 monthly copies, then permanently deleted.

Hybrid Forex’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

9.Where your data is processed

Our servers and most of our providers are in the United States. If you use Hybrid Forex from the EEA, the UK, India or elsewhere, your information will be transferred to and processed in the United States and other countries whose data protection laws may differ from yours. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses with our providers.

10.How long we keep it

• Account, trading and journal data: while your account is open. After you ask us to delete the account we remove it from live systems within 30 days.
• Backups: deleted information can remain in encrypted backups until those copies expire, which is at most about six months.
• Security and audit records: kept as long as needed for security, fraud prevention and legal compliance.
• Newsletter addresses: until you unsubscribe or ask us to delete them.
• Billing records: kept as long as tax and accounting rules require.

11.How we protect it

• All traffic uses HTTPS. Passwords are stored only as salted hashes, and broker credentials are encrypted at rest.
• Optional two-factor authentication protects sign-in, and we email you when a new device signs in.
• Access to production systems is restricted, and sensitive actions are recorded in audit logs.
• Backups are encrypted and restore-tested.

No system is perfectly secure. Please use a strong, unique password and turn on two-factor authentication. If a breach affects your information we will notify you and the relevant authorities as the law requires.

12.Your rights and choices

Depending on where you live, you have the right to:

• access the personal information we hold about you and receive a portable copy;
• correct information that is wrong or incomplete;
• delete your information and close your account;
• object to or restrict certain uses, and withdraw consent you gave earlier;
• opt out of marketing email at any time, using the unsubscribe instruction in the message or by writing to us.

How to use them: email [email protected] from the address on your account. We may ask you to confirm your identity, and we will respond within 30 days. We will not treat you differently for exercising a right.

EEA and UK: you can also complain to your local data protection authority. California: we do not sell or share personal information as those terms are defined in the CCPA/CPRA. India: you have the rights to access, correction, erasure and grievance redress under the Digital Personal Data Protection Act, 2023, and you can use the contact above as our grievance channel.

13.Children

Hybrid Forex is for adults only. You must be at least 18 to create an account. We do not knowingly collect information from anyone younger; if you believe a child has given us information, write to us and we will delete it.

14.Changes to this policy

We may update this policy as the product or the law changes. The date at the top shows the latest version. If a change is material we will notify you by email or inside the platform before it takes effect.