Legal

Privacy Policy

Effective date: 2026-07-29
Data controller: NAEEM INC, 12397 South Orange Blossom Trail #134, Orlando, Florida 32837, USA
Privacy contact: naeem@fade.market

1. Who this covers

This policy covers fade.market and the Fademarket app, including the public board, the practice trading account, Coach, the course and the member area. The board can be read without an account. Everything else needs one.

2. Exactly what is collected

The list below is enumerated from the product's own database tables. It is not a catch-all: if something is not in this list, it is not stored.

Your account

Your trading and learning

• Your practice wallet. One record per account holding your practice cash balance and the full list of practice positions: instrument, side, quantity, entry price, the grade at entry, target, stop, open and close timestamps, and profit or loss in practice dollars. This is the record the leaderboard and Coach read.
• Your trade notes. The free-text "why I took this trade" notes you write, with the position they belong to, the instrument, the side, your quick-tags and when you wrote them.
• Course progress. Which lessons you have completed, and your streak.
• Grade challenges. If you dispute a coaching rule that scored you: the rule, the instrument, the points involved, the grading version in force, and the reason you typed. Kept as a permanent record used to refine the rules.
• Your board sensitivity setting, if you changed it from the default.
• Referrals. Your own referral code, and, if you were referred, which code and which account referred you.

Coach

• Conversations. Chat title and the full message history of each conversation, yours and Coach's replies both.
• Files you attach. File name, declared type, size and the extracted plain text. Text only: binary files are rejected, so no images, PDFs or documents are stored as such.
• Projects. Project names and the list of files, chats and inline notes you grouped into them.
• Briefings. Any scheduled briefing you set up: its title, its configuration, and the last generated output, cached.
• Usage counters. A per-day count of your messages and tokens, used to enforce the daily allowance.

Live trading, only if you connect it

• Your main wallet address, which is public information on a public blockchain.
• Your agent wallet private key, encrypted at rest. See section 7.
• Which network the link was validated on, and when.
• An idempotency record of orders placed, so a retried request cannot double-place.
• Whether you have live mode switched on.

Billing, only if you subscribe

• Your Stripe customer id, your subscription id, the subscription status, the plan tier, and the end of the current paid period.
• No card data. Card numbers are entered on Stripe's own hosted page and never reach Fademarket's servers.

Activity and technical data

• An activity log of what your account did: a timestamp, your account id, your username, an action name such as a checkout start, a billing-portal open, a promotional-code redemption or a live-trading denial, and a short detail string. Where a live-trading request is refused on location, only the two-letter country code is recorded, never your network address.
• Push notification tokens, if you use the native app shell and enable notifications: the device token, the platform, and when it was last seen.
• Rate-limiting counters, held in server memory only, keyed by account or network address, and never written to the database.
• One-time verification codes, stored as a keyed hash with a short expiry and an attempt cap. The code itself is never stored in readable form.
• Screen pairing codes, if you pair a TV or big screen, for ten minutes only.

What is not collected

• No card numbers, no bank details.
• No government identity documents, no proof of address, no selfies.
• No advertising identifiers, no third-party advertising or analytics trackers, and no cross-site tracking cookies. The board and these pages make no requests to any host other than the product's own interface.
• No contact lists, no photo library, no microphone, no precise device location. The only location signal is a country derived from your network address, as described in section 8.
• No brokerage statements and no connection to a bank account.

3. Why each thing is collected

• Username, password hash, email or phone: to create your account, sign you in, and let you recover access. One of email or phone is required so an account has a recoverable identity, and so the same person cannot silently hold two accounts.
• Practice wallet, trade notes, course progress: to run the features themselves, sync them between your devices, and rank qualifying accounts on the leaderboard.
• Coach conversations, files and projects: to keep your history, and to give Coach the context it needs to answer.
• Country, attestation and network address at attestation: to enforce the geographic restriction on live trading, which is a compliance control, not a marketing signal.
• Billing identifiers: to know whether your membership is active, and to open the billing portal so you can manage or cancel it.
• Activity log and rate limiting: to keep the service up, to investigate abuse and payment fraud, and to support you when something goes wrong.
• Verification codes: to prove you control the email or phone you gave.

The legal bases the operator relies on are Contract, for account and billing data. Legitimate interests, for security and abuse prevention. Consent, for marketing messages. Legal obligation, for tax and accounting records.

Your data is not sold, and it is not rented, traded or shared with data brokers.

4. Your trade record feeds Coach

This is worth stating plainly, because it is the point of the product.

When you talk to Coach, the server first builds a short profile from your own practice record and attaches it to Coach's instructions. That profile is computed on the server, from your synced practice wallet, and can include:

• how many practice trades you have closed, your practice win rate, and your total practice profit or loss;
• your win rate broken down by long versus short;
• your win rate on high-graded entries versus low-graded entries;
• your average winning trade against your average losing trade;
• how long you hold winners against how long you hold losers;
• your currently open practice positions, marked against the live board;
• your own written notes on why you took a trade.

That is what makes Coach able to say something about your trading rather than trading in general. It is computed per request and is never mixed with another user's record. Other users cannot see it.

5. What goes to the AI provider

What is sent, per message:

• the messages in that conversation, including everything you typed;
• Coach's standing instructions and teaching examples;
• the current state of the market and the live graded board;
• the profile computed from your practice record described in section 4;
• the text of any files or projects you attached to that conversation.

What is not sent: your password or its hash, your email address, your phone number, your payment identifiers, your wallet address, and your live-trading key. Your username is not sent as an identifier either. The provider receives the content and the profile, not your account record.

The provider processes that text to generate the reply and returns it. The operator does not control the provider's own retention or logging, which is governed by the provider's terms. The current provider is Anthropic (Claude), confirmed as the live provider by the service health endpoint

Practical advice: do not paste anything into Coach that you would not want a third-party AI service to process. It is a trading coach, not a vault.

6. Payments

Payments run through Stripe. When you start a checkout you are sent to Stripe's own hosted page, and your card details are given to Stripe, not to Fademarket. Fademarket receives back only a customer id, a subscription id, the subscription's status and the end of the current paid period, and stores those to decide whether your membership is active.

To manage or cancel, the app opens Stripe's own billing portal. Stripe processes that data as its own controller under its own privacy terms. Billing records are kept for tax and accounting purposes even after an account is deleted, for as long as the law requires.

7. Live-trading credentials

Live trading is off by default and gated. If you do connect it:

• The agent wallet private key you paste is encrypted before it is stored, and the database never sees it in plain form. It is decrypted in memory only at the moment an order is signed.
• It is write-only after submission: no interface returns it, and it is deliberately excluded from every log, error message and activity record.
• An agent wallet can place and cancel orders. It cannot withdraw or transfer funds. You can revoke it at the venue at any time, independently of Fademarket.
• Unlinking deletes the stored key.
• Your main wallet address is public blockchain information, and is stored as given.

8. Location

The only location data used is a two-letter country code, resolved from your network address by a keyless third-party lookup service. It is cached for twenty-four hours in server memory, keyed by network address, and it is not written to the database as a browsing history.

It is used for one purpose: deciding whether live trading is permitted. The check is default-deny, so a failure resolves to restricted. Paper trading is never gated on location. Your network address is stored in one place only: alongside a residency attestation, if you made one, as evidence of when and from where it was given.

9. Email, SMS and notifications

• Verification codes are sent to the email or phone you gave, through an email delivery provider or an SMS provider.
• Service and onboarding messages may be sent to the email or phone you gave. You can opt out of marketing messages at any time; you cannot opt out of essential account and billing notices while you hold an account.
• Push notifications are sent only if you enable them in the native app shell, and stop when you disable them or remove the app.
• A signup notice goes to the operator when you create an account. The version sent to the operator's own inbox contains your username, email and phone. A second, separate notice posted to the team's internal chat channel deliberately contains only your username and a running count, with no email or phone, because that channel has other readers.

10. Third parties that receive data

• The AI provider, as described in section 5.
• Stripe, for payments and subscription management.
• A geolocation lookup service, which receives a network address in order to return a country code.
• An email delivery provider and an SMS provider, which receive the address or number a message is going to, and the message.
• Hyperliquid, the trading venue, if and only if you connect live trading. Orders you place go to the venue as orders.
• The customer relationship system. The code can push a signup's username, email address and phone number to GoHighLevel, a marketing and CRM platform. This path is gated off unless the operator has switched it on and supplied a key; when it is off, the signup is recorded locally and the sync is logged as gated. CRM sync is currently ON in production, so account and contact details are also held in our customer relationship system.
• Hosting and infrastructure providers that run the servers, the database and the static site. Render (application hosting and PostgreSQL database), United States

11. Local storage on your device

These pages and the board use your browser's local storage for two things only: your light or dark theme choice, and, in the app, your session token and a local copy of your practice wallet so it works offline and survives a refresh. There are no advertising cookies and no third-party trackers. Clearing your browser storage signs you out and removes the local copy, but not the server copy.

12. How long things are kept

• Your account record and practice wallet: kept while your account exists.
• Coach conversations: kept while your account exists, with the oldest automatically pruned once you pass a fixed cap of stored conversations, currently fifty. Uploaded text files are also capped, currently twenty files and two megabytes per account, with a maximum of two hundred kilobytes each.
• Daily usage counters: one row per day, kept while your account exists, removed on deletion.
• Activity log: kept for operational and abuse-investigation purposes. Rows for a deleted account are deleted, and any that remain keyed to the internal id have their detail field scrubbed.
• Push tokens: at most ten per account, oldest evicted; a token unseen for roughly six months is treated as dead.
• Verification codes: minutes, with an attempt cap.
• Location cache: twenty-four hours, in server memory only.
• Screen pairing codes: ten minutes, single use.
• Grade challenges and published Fades: the record is deliberately permanent. Published Fades resolve on a public record and stay up. Challenge rows are append-only and are kept as a dataset for refining the rules; they are keyed to an internal id, not to your name in public.
• Billing records: kept by Stripe and by the operator for as long as tax and accounting law requires, which can outlast your account.

A general retention period for everything not listed above: We keep your data while your account is open. If you delete your account we remove it immediately, apart from records we must keep for tax and accounting. We do not currently purge inactive accounts automatically, so an unused account keeps its data until you delete it.

13. Access, correction and deletion

You can see and change your own email, phone and password from the app at any time, and you can delete individual Coach conversations, files, projects and briefings yourself.

Full account deletion is done by the operator on request. There is no self-service delete-my-account button in the product today. Email naeem@fade.market from the address on the account, or with enough detail to prove you own it, and ask for deletion.

When a full deletion runs it is irreversible and removes:

• your account record;
• your practice wallet and its entire trade history;
• your course progress;
• your Coach conversations, files, projects and briefings;
• your trade notes;
• your daily usage counters;
• your stored live-trading credentials, and your live-trading permission;
• your referral code and your referral links;
• your rows in the activity log, with any remaining detail scrubbed.

What survives a deletion, honestly stated: billing records held by Stripe and kept for tax purposes; published Fades on the public record, which are the platform's own output and not personal to you; and Deletion removes your account row, your practice wallet and trade history, your Coach chats, files and projects, your course progress, your coaching ledger, your notification tokens, your membership record, any exchange credentials, and your referral records.

Depending on where you live you may also have the right to a copy of your data, to correct it, to object to certain processing, to restrict processing, or to complain to a regulator. To exercise any of those, use the same contact address. The operator will respond within 30 days.

14. Security

Passwords are stored as bcrypt hashes. Sessions are signed tokens, and changing your password invalidates every older session. Live-trading keys are encrypted at rest and excluded from all logs. Requests are rate limited, and administrative interfaces are separately authenticated. Traffic is served over HTTPS.

No system is perfectly secure. If you believe your account has been accessed by someone else, change your password immediately, which will sign the other device out, and contact the operator.

15. Children

Fademarket is not for children. Accounts require you to be at least 18 years old. The operator does not knowingly collect data from anyone below that age, and will delete such an account on becoming aware of it.

16. Changes

This policy will change as the product changes. Material changes will be posted here with a new effective date. Because the schedule of what is collected in section 2 is written from the actual database schema, it must be revisited whenever a new store is added.

17. Contact

Privacy questions and deletion requests: naeem@fade.market, NAEEM INC, 12397 South Orange Blossom Trail #134, Orlando, Florida 32837, USA.

NAEEM INC is the data controller and can be reached at naeem@fade.market for any data request, including from the United Kingdom and the European Union.