Privacy Policy

StratWhiz (stratwhiz.com) is operated by HL Tech LLC, 14665 NE 34th St, Bellevue, WA 98007 ("StratWhiz", "we", "us"). We are responsible for the personal information described in this policy. You can reach us at info@stratwhiz.com.

Account information you give us.

• Your name, email address and password. We store the password only as a one-way bcrypt hash; we cannot read it.
• If you sign in with Google or Apple, the name and email address that provider shares with us and the account identifier it issues. We never receive your Google or Apple password. Apple may give us a private relay address instead of your real one.
• Your public username, which you can choose in Settings. Until you do, we show a default built from your initials and a few characters of your account id.
• A mobile number, if you add one. It is optional at sign-up and becomes required only when you link a brokerage, so we can text you a security code first.
• The invite code you signed up with, if sign-up was invite-only, and which member invited you.
• When you agreed to the Terms of Use and this Privacy Policy, and which version you agreed to.

What you create in StratWhiz.

• Strategies (the full logic of every node, variables and settings), their version history, folders, and the strategies you star or share.
• Strategy Lab experiments, their settings and profiles, and their results (trades, equity curves and metrics).
• Dream World and Real World deployments: their settings and safeguards, and the positions, orders and trades they produce.
• Your dashboard layout, whether you have completed the product tour, and the in-app alerts we show you (for example, a deployment that stopped or a brokerage link about to expire).

Prompt and voice modes. When you describe a strategy in the Builder, the text you type is sent to an AI model to turn it into a strategy. When you use voice, the recording is sent to a speech-to-text service, and the transcript is then handled like typed text. We do not save your recordings or the conversation on our servers: the conversation lives in your browser tab and is lost when you close it. Our logs record which model answered, how long it took and whether it succeeded, not what you said. Under Microsoft's terms for these Azure services, your prompts and recordings are not used to train the AI models.

Security codes. When we email or text you a 6-digit code (to verify your email, reset your password, or confirm your phone), we store only a keyed hash of the code, and it expires after 10 minutes.

Technical information. Like any website, our servers receive your IP address, browser type and the pages you request. We use the IP address to rate-limit sign-in, password-reset and verification attempts and to protect the service; those counters last only for their window of a few minutes. For troubleshooting, our servers send diagnostics (which pages and services were called and how long they took, errors, and the logs of background jobs such as backtests and deployment ticks) to Azure Application Insights. These records can carry your account's internal id, the ids of your strategies, experiments and deployments, and the figures a deployment tick works with, but not your email address, name or phone number, and they age out on Azure's retention schedule.

What we do not collect. We never see or store your brokerage username or password. We do not collect payment card details, your precise location, contacts, photos or government ID numbers, and we do not buy data about you from data brokers. We do not use analytics, advertising or social-media tracking tools.

Real World trading works by linking a brokerage account. Today that is Charles Schwab; we are adding other brokerages (such as Interactive Brokers, E*TRADE, Webull, TradeStation and tastytrade), and the same rules apply to each.

• You sign in on the brokerage's own website and approve access there. The brokerage then gives us access tokens; we never receive your brokerage password.
• We store those tokens encrypted (AES-256-GCM) and use them only to do what you set up: read quotes, your account balances and positions, and place and track the orders your Real World deployments generate.
• We keep a copy of your account balance, the positions and orders tied to your deployments, and the trades they close, so the dashboard and deployment pages can show them.
• Unlinking removes the connection and its tokens from StratWhiz. Your approval may remain listed at the brokerage until it expires or you revoke it there. Anything held at the brokerage (positions, orders, statements) stays there and is covered by the brokerage's own privacy policy.

Dream World uses no brokerage and no real money. Its balances, positions and trades exist only in StratWhiz.

We use your information to:

• create and secure your account, including email verification, password resets and SMS codes before a brokerage link;
• run the features you use: save and version strategies, run backtests, run Dream World and Real World deployments, and place orders with your brokerage when your strategies call for them;
• show your own data back to you on the dashboard and in each feature;
• send the service emails and texts the product needs: codes, account notices and, unless you turn them off in Settings, emails about alerts that stopped something. We do not send marketing messages;
• keep the service reliable and safe: diagnose errors, prevent abuse, and enforce our Terms of Use;
• meet legal obligations.

Where the law requires a legal basis (for example, in the EU or UK), we rely on performing our contract with you for the above, on our legitimate interest in keeping the service secure and working, and on your consent where we ask for it.

We do not sell or rent your personal information, and we do not share it for cross-context behavioural advertising. We have not done either in the past 12 months.

Your account is private by default. Other users can see only:

• Strategies you choose to share to the Community: the strategy's name, description, complete logic and current version, how often it has been copied and starred, and your public username. You confirm each share first, and you can unshare at any time. Copies other users saved while it was shared stay with them.
• Your public username, wherever you appear as an author, including on experiments other users run on a strategy you shared.

Other users never see your name, email, phone number, folders, experiments, results, version history, deployments, balances or profit and loss.

We use a small number of providers who process data on our behalf, under contracts that limit their use of it:

• Microsoft Azure hosts the app and its database, runs background jobs (backtests and deployment ticks), and delivers real-time updates. Azure Communication Services sends our emails and text messages. Azure AI Foundry runs the AI models behind prompt mode (the models may be built by different vendors, but they run in our Azure environment), and Azure AI Speech transcribes voice input.
• Your brokerage (Charles Schwab today, others as they are added) receives the orders your Real World deployments place and returns your account data, as described above.
• Market data: we fetch prices and quotes through a market-data service. These requests carry ticker symbols and dates, not your personal information.
• Google and Apple, if you choose to sign in with them, confirm who you are and share your name and email address with us under their own privacy policies.
• Google Fonts: your browser downloads the site's fonts from Google, which receives your IP address and browser details when it does.

We may also disclose information when the law requires it, to protect the rights or safety of our users or others, or as part of a merger or sale of the business, in which case this policy continues to apply.

We use only cookies and browser storage that the product needs or that remember your own display choices. There are no advertising or analytics cookies, so there is nothing to opt out of.

Blocking essential cookies will stop sign-in from working. Clearing local storage only resets your display preferences.

• Account data, strategies, experiments and deployments are kept for as long as you have an account.
• Email and SMS codes stop working after 10 minutes. Their hashes are deleted when you request a new code, and expired ones are cleaned out routinely.
• Market quotes are shared reference data and contain nothing about you.
• When your account is deleted, we delete your account and everything linked to it (strategies, versions, folders, experiments and results, deployments, positions, orders, trades, brokerage links, alerts and preferences). Experiments other users ran on a strategy you shared are deleted with it. Server logs and backups age out on our hosting provider's normal schedule.
• We may keep limited records longer where the law requires it or to resolve a dispute.

You can, at any time:

• see and change your name, username and phone number in Settings;
• unshare a strategy, unstar it, or delete it;
• stop or delete a deployment, and unlink a brokerage in Settings;
• turn on privacy mode, which hides your identity and Real World figures on screen when you present or stream;
• delete your account yourself from Settings, after confirming your email address and password (or an emailed code);
• turn alert emails on or off in Settings;
• ask us for a copy of your data, to correct it, or to delete your account for you, by writing to info@stratwhiz.com. We will confirm the request comes from you before acting on it.

Depending on where you live (for example, the EU, the UK or California), you may have further rights, such as to object to or restrict processing, to data portability, and to complain to your local data protection authority. We will not treat you differently for exercising any of them.

We answer requests within 30 days (45 days where California law allows), and we verify them against the email address on your account. If we decline a request, you may appeal by replying to our answer, and we will tell you the outcome of the appeal and how to contact your state attorney general if you disagree. Because we do no cross-site tracking or advertising, there is nothing for a browser's Do Not Track or Global Privacy Control signal to switch off.

Before you ask us to delete your account, close any Real World positions and cancel working orders at your brokerage. Deleting your StratWhiz account does not touch your brokerage account.

We protect your data with encryption in transit (HTTPS), encrypted brokerage tokens, hashed passwords and security codes, SMS confirmation before any brokerage link, rate limits on sign-in and verification, and managed identities instead of stored keys for our cloud services. No system is perfectly secure; if a breach affects your personal information, we will tell you and the authorities as the law requires.

Our servers and database are located in the United States (Microsoft Azure, West US 3). If you use StratWhiz from elsewhere, your information is transferred there. Where the law requires it, we rely on appropriate safeguards for those transfers, such as the European Commission's standard contractual clauses.

StratWhiz is for adults. You must be at least 18 to create an account, and we do not knowingly collect information from anyone younger. If you believe a minor has an account, contact us and we will delete it.

We will update this policy when the product or the law changes. The effective date at the top shows the current version. If a change materially affects how we use your information, we will tell you by email or in the app at least 14 days before it takes effect.

Questions or requests about your privacy: info@stratwhiz.com, or by post to HL Tech LLC, 14665 NE 34th St, Bellevue, WA 98007.