Privacy Policy
The short version
I keep as little as I can: your email for the list and your account, your purchase, the TradingView username you send me to grant script access, your Telegram account to let you into the group, and, if you use the connector, your exchange API keys and the log of what it did with them. No ad trackers, no selling data.
1. Who's responsible
The data controller is Sergey Fedorov, an individual, 2 rue des Fleurs, L-3468 Dudelange, Luxembourg. Email: [email protected].
2. What I collect and why
| Data | Where it comes from | Why | Legal basis |
|---|---|---|---|
| Email address and, if you came through a tagged link, the source tag (utm parameters) | The waitlist form on this site | To send you the letters you asked for and to know which channel brought you | Consent; you can withdraw it with the unsubscribe link in any letter |
| Name, email, country, purchase and subscription status, invoices | Whop, when you buy | To deliver what you bought, handle renewals and refunds, and keep accounting records | Contract; legal obligation for accounting records |
| TradingView username | You, when you ask for access | To grant and remove script access on TradingView | Contract |
| Email, one-time sign-in codes (stored hashed) and sign-in sessions with IP address and browser (user agent) | You, when you sign in to your account at app.meanward.com | To sign you in without a password and to keep the account secure | Contract; legitimate interest for security |
| Telegram username and user id | You, when you join the Club or write to support | To let members in, keep others out and answer questions | Contract; legitimate interest for support |
| Exchange API key and secret, exchange name, the alerts your strategy sends, the orders placed, positions and realised results, timestamps and the IP the alert came from | You and your TradingView alerts, if you use the connector | To execute your alerts, report trades to you, and investigate what happened when something goes wrong | Contract |
| Server logs: IP address, user agent, pages requested, time | Cloudflare, which hosts this site, and the connector's hosting | Security, abuse prevention, keeping the service running | Legitimate interest |
| Support emails and chat messages | You | To answer and to improve the guides | Legitimate interest |
I don't collect card numbers (Whop and its payment providers do), and I don't run advertising trackers or analytics cookies on this site.
3. API keys, specifically
- Keys are stored encrypted at rest and never written to logs. Logs mask keys, secrets and signed exchange headers.
- They're used only to place and manage the orders your alerts ask for and to read your positions and balances for that purpose.
- They're deleted when your connector plan ends or when you ask, whichever comes first. Revoking the key on the exchange works immediately and doesn't need me.
4. Who processes data for me
| Processor | What for | Where |
|---|---|---|
| Resend | Email list, letters and sign-in codes | USA |
| Whop | Checkout, subscriptions, invoices, refunds, member list | USA |
| Cloudflare | Hosting this site and the waitlist form; storing encrypted backups of the connector's database | Global network, EU and USA; backups in the EU |
| Telegram | The channel, the chat and the Club | Outside the EU |
| Fly.io | Hosting the connector and its database | Singapore region |
| Your exchange (Binance, Bybit, Hyperliquid or another one you choose) | Receives the orders from your keys | Per the exchange |
| TradingView | Delivers the scripts and sends the alerts | USA |
Transfers outside the EU rely on the processors' standard contractual clauses or an adequacy decision. I don't sell data and don't share it with anyone else, except when the law requires it.
5. How long I keep it
- Email list: until you unsubscribe or I close the list.
- Purchase records and invoices: 10 years, as Luxembourg accounting law requires.
- TradingView and Telegram usernames: while you have access, then 12 months in case of a dispute.
- API keys: until your plan ends or you ask.
- Sign-in codes: 24 hours. Sign-in sessions: 30 days.
- Connector logs, alerts and order records: 12 months after your plan ends.
- Site server logs: as Cloudflare keeps them, typically days.
- Encrypted database backups: 35 days, then deleted automatically. Data you ask me to delete is gone from them within that time.
6. Your rights
You can ask me what I hold about you, get a copy, have it corrected or deleted, object to processing based on legitimate interest, and withdraw consent. Email [email protected]; I answer within a month. Deleting purchase records before the accounting retention period isn't possible, but I'll restrict them. If you think I got something wrong, you can complain to the Luxembourg data protection authority (CNPD, cnpd.lu) or the authority in your own country.
7. Security
Access to the systems above is limited to me, and secrets are kept out of code. No system is perfectly secure; if I learn of a breach that affects you, I'll tell you without undue delay.
8. Cookies
This site sets no cookies of its own. Cloudflare may set a security cookie to tell browsers from bots; it stores no personal data. The waitlist form sends your email and the source tag to my server and nowhere else.
9. Children
The products are for adults. I don't knowingly collect data from anyone under 18; if I learn I have, I delete it.
10. Changes
I'll post changes here with a new effective date and email you about changes that matter.