Privacy Policy

LAST UPDATED: 27 August 2026

This policy explains what QuantX actually collects, who actually receives it, how long we actually keep it, and how to get it deleted. It was rewritten against the source code rather than from a template, so where the answer is unflattering it still says so.

1. What we collect

In short: Your account details, your subscription state, and service logs. Not your trades.

Account data. Email address, username, and a securely hashed password if you set one. We never store your password itself.

Linked accounts, only if you choose to connect them: your Discord user ID and handle; your Google account identifier and the email address Google asserts; your TradingView username if you supply it for indicator access.

Subscription and entitlement data. Your plan tier, subscription and membership status, licence keys, trial state and cancellation events, plus the billing events Whop sends us. We never see or store your card details.

Service and security logs. Sign-in timestamps, last-active timestamps (split between the website and the desktop app), administrative actions taken on your account, email delivery events (delivered, bounced, complained), and the IP address recorded when a password reset is requested. These exist for security and abuse prevention.

Support correspondence. What you send us by email or in Discord.

WHAT WE DO NOT COLLECT

The desktop application keeps your trades, journal entries, backtests and strategy parameters on your own machine. They are not transmitted to QuantX servers. We also run no advertising, analytics or cross-site tracking on this website — see the Storage Disclosure.

2. Why we use it

In short: To run your account, keep your access correct, and keep the systems secure.

to create and operate your account and authenticate you;
to grant, sync and withdraw the access your subscription entitles you to, including Discord roles and TradingView indicator access;
to process subscription events received from Whop;
to send service-critical email — password resets, billing and security notices. These are not marketing;
to detect and prevent abuse, credential sharing and fraud, and to secure the Services;
to provide support when you contact us;
to meet legal, tax and accounting obligations.

We do not sell, rent or trade your personal data, and we do not share it with advertisers.

3. Who receives your data

In short: The full list of companies involved in running QuantX, and what each one gets.

QuantX is built on third-party infrastructure. These are all of them:

Whop — payments, subscriptions and membership. Receives and holds your billing relationship; sends us subscription events. Merchant of record.
Supabase — the database where your account record is stored.
Railway — hosting for the QuantX application server.
Cloudflare — hosting, DNS and network protection for this website and our downloads. Processes request metadata such as your IP address in order to serve and protect the site.
Discord — community, role-based access and alert delivery. Receives your Discord identity and role assignments.
Google — optional sign-in. If you use it, Google confirms your identity to us and we store your Google account identifier and email. Google Fonts also serves the typefaces on this site.
TradingView — indicator delivery via its invite-only system. Receives the TradingView username you give us.
Resend — transactional email delivery. Receives your email address and the message content in order to deliver it, and reports delivery outcomes back to us.
Cboe Global Markets — delayed public options-chain data for market analytics. Receives no user data at all; these are unauthenticated public requests made by our server, not by your browser.

Each of these operates under its own privacy policy. We may also disclose data where we are legally required to, or to establish or defend legal claims.

4. How long we keep it

In short: Account data while your account exists. Event logs on fixed windows. Financial records longer.

Account data is kept for as long as your account exists, and then as described in section 6.

Event and log data is subject to these retention windows:

payment-webhook and subscription-event logs — 90 days;
email delivery events — 90 days;
member activity logs — 90 days;
administrative action logs — 365 days. These record what staff did to an account and exist so that administrative action is accountable.

Financial records — subscription and payment history — are retained for longer, because tax and accounting rules require it and because they are needed to resolve billing disputes. After a deletion these are held in a form that is no longer linked to your identity.

AN HONEST NOTE ON AUTOMATED PRUNING

The automated sweep that enforces the windows above currently runs in report-only mode: it measures what is due for deletion and logs it, but does not yet delete on a schedule. We are stating this rather than implying an automation that is not switched on. It does not affect a deletion request — those are carried out directly, as described below.

5. Your rights

In short: Access, correction, deletion, export, and withdrawing consent. Email us and we will do it.

Access — ask for a copy of the personal data we hold about you.
Correction — ask us to fix anything inaccurate.
Deletion — ask us to delete your account and personal data.
Portability — ask for your data in a machine-readable form.
Objection and withdrawal — withdraw consent or object to processing. Withdrawing consent for data needed to operate your account means we can no longer provide the Services to you.
Complaint — if you are in a jurisdiction with a data-protection authority, you may complain to it. We would rather you told us first.

Email quantxusa@gmail.com from the address on your account. We will verify that the request comes from you before acting — that check protects you, since an unverified deletion request is an attack. We aim to respond within 30 days.

6. What deletion actually does

In short: Your personal data is removed. Anonymous financial and audit records remain.

Deletion is real, and it is specific. When your account is deleted:

your email address, username, password, and any linked Discord, Google and TradingView identifiers are erased;
your sign-in and activity history and your email-delivery trail are erased;
outstanding password-reset links and sign-in sessions are destroyed immediately;
your licence keys are unlinked from you and marked as belonging to a deleted account;
your account record is retained only as an anonymous identifier with every identifying field cleared, so that financial records still balance.

Two categories are deliberately kept, and we would rather say so than let you discover it:

Subscription and payment records, because tax, accounting and chargeback rules require them. They are keyed to the anonymous identifier only.
Administrative action logs, including the record that your account was deleted, by whom and when. This record deliberately does not contain your email address. An action that could erase its own evidence would make staff accountability impossible.

DELETING YOUR ACCOUNT DOES NOT CANCEL YOUR BILLING

QuantX cannot cancel a Whop subscription on your behalf — Whop is the merchant of record and only you can cancel there. Cancel in Whop first, then ask us to delete. If you ask us to delete an account with a live subscription we will tell you rather than proceed, so that you are never left paying for an account that no longer exists.

7. Cookies and browser storage

In short: We set no cookies. Two functional items in local storage, and that is all.

This website sets no cookies and runs no advertising or analytics trackers. It stores two functional items in your browser's local storage: your sign-in token, and your light-or-dark appearance choice. Both stay on your device. The full detail is in the Storage Disclosure.

8. Security

In short: Encryption in transit, hashed passwords, restricted admin access, and honest limits.

Traffic is served over HTTPS. Passwords are stored using a strong one-way hash and are never recoverable. Administrative actions require elevated permission and are logged. Signing out revokes your session token, and an administrator can end all of an account's sessions immediately.

The desktop application keeps your trading data on your own machine, so it is protected by your own device security. Licence keys are bound to a hardware fingerprint to prevent sharing.

No system is perfectly secure, and we will not claim otherwise. Use a unique, strong password and tell us at once if you think your account has been compromised.

9. If there is a data breach

In short: We will tell affected members, and say what we actually know.

If a breach affects your personal data and creates a risk to you, we will notify affected members without undue delay, and any regulator where we are required to. The notice will describe what happened, what data was involved, what we have done and what you should do. We will not delay a notification to make it sound better.

10. Children

In short: QuantX is 18+. We do not knowingly collect data from minors.

The Services are not directed to anyone under 18 and we do not knowingly collect data from children. If you believe a minor has given us personal data, contact quantxusa@gmail.com and we will delete it.

11. International transfers

In short: Our providers are US-based, so your data is processed in the United States.

QuantX operates from the United States and the providers listed in section 3 process data there. If you use the Services from outside the US, you understand that your personal data will be transferred to and processed in the United States, where data-protection law may differ from your own.

12. Changes and contact

In short: The date at the top shows the current version. Ask us anything.

We may update this policy; the Last updated date at the top always reflects the current version, and material changes will be communicated by email or in Discord. Privacy questions and requests: quantxusa@gmail.com.