Privacy

Last updated 19 October 2026

This policy covers the TradeSurge website, the TradeSurge app and Surge Copilot. “TradeSurge”, “we” and “us” mean the team that operates them. Questions go to [email protected].

What we collect

• Account details: your email address, your name, and a hash of your password (never the password itself).
• Google sign-in: if you sign in with Google, we receive your Google account id, email address and name, and use them only to sign you in. We ask for nothing else from your Google account and never share it.
• Trading profile: the answers you give during onboarding, such as your experience, the firms you trade with, your usual risk per trade and your time zone.
• Exchange connections: the venue, the environment (Demo or Production), a label you choose, and the API key and secret, which are encrypted and never shown back to you or to our staff.
• Trading data from your exchange: balances, positions, orders and fills that we read with your key, plus the accounts, rules and copy settings you set up in the app.
• Security and usage records: sign-ins, devices, IP addresses and the actions recorded in your security log, and product events that tell us which features are used.
• Copilot conversations: the messages you send Surge Copilot and its replies, kept as your chat history.
• Billing: your plan, its status and the Stripe customer and subscription ids. Card details are entered on Stripe's pages and never reach us.
• Website chat: if you leave your name and email in the chat on our website, we keep them with the conversation so we can reply.

Why we use it

• To run the service you signed up for: show your accounts, check trades against rules, run Breach Guard, copy trades and answer Copilot questions.
• To keep accounts secure: verify sign-ins, detect abuse and keep an audit trail of sensitive changes.
• To bill you and to send the emails the service needs, such as sign-in codes and account notices.
• To understand which features work and to fix what doesn't.

We don't sell your data, and we don't share it with advertisers. The website has no advertising trackers. It uses Google Analytics only if you allow it in the cookie banner.

Who processes it for us

We use a small number of providers, each only for what it does for us:

• Tencent Cloud (Singapore) hosts the app, its databases and backups.
• Cloudflare sits in front of our sites for DNS, TLS and protection against attacks.
• Stripe takes payments and manages subscriptions.
• Resend delivers our emails, such as sign-in codes.
• Google (Tag Manager and Analytics) counts visits and pages on the website, only when you allow analytics cookies.
• Anthropic provides Claude, which answers the Copilot questions our own skills can't. For those, we send the conversation, your first name, the page you're on and the account figures the answer needs. Keys and secrets are never sent. Details are on the security page.
• Your exchange (today, Bybit) receives the requests we make with your key, such as reading balances or placing the orders you confirm.

Some of these providers process data outside the country you live in. We choose providers that protect it under contract.

Cookies

We use cookies that are needed for the service to work: your sign-in session, a “trusted device” cookie if you choose it, your display preferences such as the theme, and the choice you make in the cookie banner. With your permission, the website also sets Google Analytics cookies to count visits and pages. They stay off until you allow them, and you can change your choice any time from “Cookie settings” at the bottom of every page. We don't use advertising cookies.

How long we keep it

We keep your data while your account is open. Revoking an exchange key erases its encrypted secret at once. When you ask us to delete your account, we delete or anonymise your data, except what we have to keep for billing and legal records, and security log entries we keep to investigate abuse.

Your choices

• Revoke any exchange key in the app at any time, or delete it at your exchange.
• Ask for a copy of your data, a correction, or deletion of your account by emailing [email protected] from the address on your account.
• Opt out of non-essential emails from the link in any of them.

Depending on where you live, you may have further rights under local law, and we'll honour them.

Security

How we protect your data and keys is described on the security page.

Changes

If we change this policy in a way that matters, we'll update the date above and tell signed-up users by email before the change takes effect.