Privacy Policy

Effective October 20, 2026. StratPilot is operated by Styles Renner in Texas, USA ("StratPilot", "we", "us").

StratPilot is a futures backtesting service. You use it on this website and from AI assistants such as Claude and ChatGPT through our MCP connector. This policy explains what we collect, why, who processes it, how long we keep it, and what you control. It's written in plain English. If anything is unclear, email support@stratpilot.dev.

What we collect

• Account details: your email address and a password hash. We store your password only as an Argon2id hash. We never store or see the plain password.
• Your strategies and results: the strategy rules you (or your AI assistant) submit, and the backtest output we generate: trades, statistics, charts, equity curves, optimization results and report pages.
• Usage counters: how many backtests and optimizations you ran each day, and running jobs (to enforce quotas). For premium AI features: the number of model calls, tokens and cost.
• Security data: IP address and browser user-agent for sessions, rate limiting and abuse prevention, plus a security log of sign-ins, failed sign-ins, token and app changes.
• Connected apps (OAuth): when you connect Claude, ChatGPT or another MCP client, we store that client's registration info (name, redirect URLs, client ID) and the access/refresh tokens we issue to it. We store tokens only as hashes.
• API tokens you create: only a hash and a short prefix.
• Cookies: a session cookie and a CSRF-protection cookie. Both are strictly necessary and are not used for advertising. The site may use Cloudflare Web Analytics, which is cookieless and collects aggregate page-view data.

We don't collect payment information (billing isn't live), and we don't ask for your brokerage accounts, positions or real trades.

Why we use it

• To run the service: sign you in, run your backtests, show your dashboard and reports, and connect your AI assistant.
• To keep it secure and fair: rate limits, quotas, abuse prevention and debugging.
• To meter premium AI features for cost control and future billing.
• To contact you about your account or important service changes. We don't send marketing email without your consent.

We do not sell or rent your personal data, and we don't use it for advertising. We don't use your strategies to train AI models.

Who processes it (sub-processors)

• Cloudflare, Inc.: DNS, CDN/proxy, TLS and DDoS protection. All traffic to our sites passes through Cloudflare. Cloudflare Web Analytics (if enabled) provides aggregate statistics.
• Hetzner Online GmbH: server hosting in Germany (Nuremberg data center). Your account data and results are stored there.
• OpenRouter, Inc.: used only for premium AI features (plain-English rule parsing, auto-tuning, result explanations) and only when your account has them enabled. For those calls we send the relevant strategy text or result statistics, never your email or password.
• Databento, Inc.: the source of the historical market data we test against. Data flows from Databento to us. We don't send your personal data to Databento.

When you use StratPilot through Claude or ChatGPT, Anthropic's or OpenAI's own privacy policies cover your conversation with that assistant. We receive only the tool calls the assistant makes to our connector.

How long we keep it

• Account data, strategies and results: as long as your account exists. They are deleted when you delete your account.
• Sessions: up to 30 days. OAuth access tokens: about 1 hour. Refresh tokens: up to 60 days, or until revoked or the app is disconnected.
• Security log and rate-limit records: up to 90 days.
• Daily usage counters: deleted with your account.
• Premium AI cost records (internal ID, tool, tokens, cost; no email): up to 24 months, for billing and abuse review.
• Server backups, if any, roll over within 30 days.

Your controls

• Delete your account any time on the Account page. This removes your account, runs, reports, optimizations, API tokens and connected apps immediately.
• Revoke API tokens and disconnect apps (Claude, ChatGPT, etc.) on the Account page. Access stops immediately.
• Change your password on the Account page. This signs out other sessions.
• Access, correction, export: email us and we'll respond within 30 days. Your run reports are also viewable and downloadable (CSV trade lists) from your dashboard.

Depending on where you live (for example the EU/UK under the GDPR, or US states such as California or Texas), you may have additional rights. Email us to exercise them. Our legal bases are performing our contract with you (running the service), legitimate interests (security, abuse prevention) and consent where required.

Security

We use HTTPS everywhere, hashed passwords and tokens, HttpOnly/Secure session cookies, CSRF protection, per-user data isolation, rate limits and a hardened server. No system is perfectly secure. If we learn of a breach affecting your data, we'll notify you as required by law.

Children

StratPilot is not for anyone under 18, and we don't knowingly collect data from children.

Changes

We'll post changes here and update the effective date. If a change is significant, we'll notify account holders by email or on the site before it takes effect.

Contact

StratPilot (Styles Renner), Texas, USA. support@stratpilot.dev