Privacy Policy

Who operates FlowSig

FlowSig is operated by FlowSig OÜ, a company registered in Estonia, which acts as the data controller for the information described below. Contact: [email protected] or contact support on Telegram.

1. Information we collect

• Account data: email address and a hashed (not plaintext) password.
• Telegram session: encrypted at rest; used only to read the channels/groups you add.
• Exchange API key & secret: encrypted at rest; trading-only keys without withdrawal permission are enforced.
• Trading data: the signals received, orders placed, and results, so we can show your dashboard and history.
• X source data: selected public account IDs, handles, and delivered public posts. Post content is redacted after the configured retention period.
• IP address & device info: logged on registration and key security events, used to prevent trial abuse and fraud.
• Cookies: a session cookie, a CSRF-protection cookie, and a language preference — no third-party advertising cookies.

2. How we use it

• To operate the service — read your channels, apply your settings, place and track orders.
• To prevent abuse of the free trial (duplicate accounts via IP, phone, or exchange key) and other fraud.
• To send essential account emails (password reset, email confirmation, subscription expiry reminders).
• To diagnose bugs and keep the service reliable.

3. Security

Passwords are hashed with Argon2 and never stored in plaintext. Telegram sessions and exchange API credentials are encrypted at rest with a symmetric key kept outside the codebase. Security-relevant actions (logins, key changes, live-mode toggles) are written to an audit log.

4. Sharing

We do not sell your data. It's shared only with: our crypto payment processor (to process a payment you initiate), Binance, Bybit, or OKX, Telegram, and X (as required to operate the service you connected them to), our configured AI provider (to analyze signal text), Brevo (to deliver essential account emails), and law enforcement if we're legally compelled.

5. Retention & deletion

We keep your data while your account is active. You can permanently delete your account and all associated data at any time from the Security page — this removes your source subscriptions, settings, exchange keys, and Telegram session immediately. X post text and raw payloads are also automatically redacted after 90 days by default.

6. Your rights

Depending on your location, you may have rights to access, correct, or export your data. Most of this is already available directly in your dashboard; for anything else, contact [email protected] or contact support on Telegram.

7. Children

FlowSig is not directed at anyone under 18 and we don't knowingly collect data from minors.

8. Changes

We may update this policy as the product changes. Material changes will be reflected by updating the date at the top of this page.