Privacy Policy

Last updated: September 2026

The short version

Quantradin is a free, paper-only backtesting and paper-trading tool. No real money ever moves. We collect the small amount of data we need to run your account and your strategies — and nothing more.

We do not sell your data. We do not run advertising. We keep what we store small on purpose.

What we collect

When you create an account, we collect your email address, a password (which we never store in plain text — it is hashed with bcrypt), and a trader tag (your public handle). You can optionally tell us which kind of trader you are; that is used only to tailor onboarding.

If you sign in with Google, we receive a signed identity token (an id_token) from Google that tells us your email address and that Google verified it. We do not receive your Google password, and we ask Google for nothing beyond your basic profile and email.

As you use the product we store the things you create: your strategies, your backtests and their results, and your paper-desk activity (simulated orders and positions). All of it is scoped to your account.

A few optional things you can add: a passkey (if you choose passkey sign-in, we store the public credential your device creates — never a fingerprint, face, or anything your device keeps private), and a profile picture (either one you pick from our built-in set or one you upload, which is downscaled in your browser before it reaches us).

How we use it

We use your data to run the product: to sign you in, to save and run your strategies, to show your backtest results, and to keep your paper desks up to date. We use your email to send account and security messages (for example, a welcome email or a password-reset link).

The AI helper (DeepSeek)

Some optional features — like drafting a strategy from a description or explaining a verdict — use an AI provider called DeepSeek. When you use one of those features, the text you are working with (your strategy description, spec JSON, and engine-produced numbers) is sent to DeepSeek to generate a reply.

Being plain about this: DeepSeek is hosted in China. Because of that, we deliberately send it as little as possible. We never send it your email, your password, your API keys, your session, or any other personal identifier — keeping personal information out of that request is enforced in our code, not just a promise. The AI only ever explains or drafts; it never sets a verdict or a number. If you do not use the AI features, nothing goes to DeepSeek.

Product analytics, session replay and error monitoring (PostHog)

We use PostHog to understand how the product is used, to watch replays of sessions so we can fix confusing screens, and to catch and diagnose errors. Being plain about what that means: anything you type into a field is masked in a replay before it leaves your browser; your API keys, key ids and secrets are never recorded at all (the screens that show them are excluded from analytics, replay and click maps entirely); we identify you to PostHog by an internal member id, never by your email address; and if your browser sends the Do Not Track signal, we honour it and record nothing. When something breaks, PostHog may record technical details about the error (for example, the page and a stack trace) and a limited amount of context needed to reproduce the problem — never your password, your keys or the contents of a request. We use all of this only to keep the product working and to make it clearer, not to profile you or to advertise.

Cookies

We use a single session cookie to keep you signed in. It is not used for advertising or cross-site tracking. If you sign out or your session expires, the cookie is cleared.

Your browser also keeps your per-desk API keys in its own local storage (not a cookie) so an agent you connect can use them. They stay on your device, are never used for tracking, and are cleared when you sign out.

Who we share with

We do not sell your data, and we do not share it for advertising. The only third parties that touch your data are the service providers we need to run the product — for example, our hosting and database provider, our email sender, the analytics and error monitor above, and (only if you use the AI features) the AI provider above. Each receives only what it needs to do its job.

Deleting your account

You can delete your account yourself at any time. Go to Settings and open the “Delete account” section. You confirm by typing your email and your password. Deleting your account permanently removes your strategies, backtests, desks, keys, and sessions. This cannot be undone.

If you signed up with Google, or you cannot reach Settings, email us at support@quantradin.com and we will delete your account for you.

Contact

Questions about your privacy or your data? Email support@quantradin.com.