CalmkeelCalmkeel

Privacy Policy

Last updated: October 23, 2026

1. Introduction

Welcome to Calmkeel ("we," "our," or "Service"). Calmkeel is a non-custodial automated trading tool: it trades in YOUR OWN exchange account using an API key you provide. That makes your exchange credentials the most sensitive thing we handle, so this Privacy Policy states plainly what we hold, what we can read, and what we cannot.

Calmkeel is operated by AshWeb Inc., which is responsible for your personal data in this app. AshWeb Inc. provides the platform (hosting, AI, and payments) and processes data on AshWeb Inc.'s behalf.

2. Information We Collect

2.1 Personal Information

  • Account Information: Email address, username, password (encrypted)
  • Profile Information: Name, country of residence, timezone
  • Billing Information: Processed securely through our payment provider (we do not store card details)

2.2 Exchange Credentials and Trading Data

  • Exchange API key and secret: encrypted IN YOUR BROWSER with the trading bot's public key before they are sent. Our web servers and databases never receive them in readable form, and only the trading bot can decrypt them. We ask for trading permission only — never withdrawal permission — so the bot only places trades and never withdraws. Switch withdrawal off on the key you create, and keep it off
  • Budget you set: the capital limit you allow the bot to use
  • Positions the bot opened and closed: symbol, size, time, and result — the record needed to report performance and to bill per position entered
  • Wallet balances: read from your exchange to check the bot has enough to trade

We do not ask for, and do not store, your exchange account password or your exchange login.

2.3 Technical and Usage Data

  • Service Usage: Features used and frequency of access
  • Technical Data: IP address, browser type, device information
  • App Usage: Which screens you open in the app
  • Email Preferences: Whether you accept non-essential email

3. How We Use Your Information

3.1 Service Provision

  • To create and manage your trading account
  • To run the strategy you started and place the resulting orders in your account
  • To show you the positions the bot opened and closed, and their results
  • To send account and service messages (billing, security, service status)

3.2 Service Improvement

  • To report the performance of the positions the bot opened for you
  • To find and fix faults in how the bot executes; we do not generate recommendations
  • To develop new features and trading tools
  • To enhance user experience and platform functionality

3.3 Trading Analysis (Nothing Is Personalised)

  • Important: We do NOT use your trading data to change what any other user's bot does
  • Your positions are used to report YOUR results; they never change what the bot does for you or anyone else
  • Anonymized, aggregated usage data may inform general service improvements
  • The budget you set limits how much capital the bot may use

3.4 Communication and Support

  • To send account and service messages
  • To respond to support requests and technical issues. When you ask a question on the Support page, or write to the app's support address, we send your message — and, on the Support page, the account details needed to answer it (your plan, renewal date, recent payment results and how much of your usage is left) — to Google (Vertex AI on Google Cloud), so the app can pick the parts of its help pages and of your account record that answer you. Google does not use this content to train or fine-tune its models.
  • To provide account and billing information
  • To notify about service updates and new features (opt-out available)

3.5 Legal and Regulatory Compliance

  • To comply with financial regulations and reporting requirements
  • To detect and prevent fraud, market manipulation, or illegal activities
  • To enforce our Terms of Service and trading policies
  • To protect our rights and the integrity of financial markets

4. Data Sharing and Disclosure

4.1 We DO NOT:

  • Sell your personal information or trading data
  • Share your portfolio information with other users
  • Use your trading data to change what other users' bots do
  • Provide your financial information to third parties for marketing

4.2 We MAY Share Data With:

  • Binance: the exchange the bot trades on. It receives the orders placed with your API key, and its public market data supplies the prices
  • Service Providers: Google Cloud (hosting), Stripe (web payments), Apple and Google (in-app purchases and sign-in), Resend (email). They process data only to provide their service to us
  • Regulatory Authorities: When required by financial regulations or legal process

4.3 Exchange Integration

  • Trading requires an exchange API key with trading permission. Withdrawal permission is never requested and would not be used
  • Your API key is end-to-end encrypted in your browser and is decrypted only inside the trading bot, which holds the private key
  • We do not sell, rent, or share your exchange credentials with anyone, for any purpose

5. Data Security for Financial Information

5.1 Exchange Credential Security

  • Your API key and secret are encrypted in your browser before transmission (RSA-OAEP wrapping an AES-256-GCM key) and can be decrypted only by the trading bot
  • Our application servers and databases hold the encrypted envelope only. A breach of them does not expose readable keys
  • The key is decrypted in memory at the moment an order is placed, and is never written to logs or responses
  • Encrypted transport (TLS) for all connections with your browser and with the exchange

5.2 Trading Data Protection

  • Encrypted storage for portfolio and trading information
  • Segregated data storage with strict access controls
  • Secure transmission of market data and orders
  • Advanced monitoring for unauthorized access attempts

5.3 Regulatory Compliance Security

  • Compliance with financial data protection regulations
  • Incident response procedures for financial data breaches

6. Data Retention for Trading Services

6.1 Active Trading Accounts

  • Personal data retained while account is active
  • Trading history and portfolio data stored for performance analysis
  • Market data and your position history retained for reporting and strategy research
  • Regulatory compliance may require retention of certain trading records

6.2 After Account Deletion

  • When you delete your account, your profile, everything you created in the app and your files are deleted at once
  • Trading data anonymized and may be retained for compliance purposes
  • Some aggregated market analysis data may be retained for service improvement
  • Payment records (amount, date, country and receipt number — not your name or email) are kept for 10 years because tax law requires it; subscription history and usage records are kept for 180 days

6.3 Financial Record Management

  • Market data and anonymised position outcomes stored for strategy research
  • Portfolio performance data retained for user analytics
  • Compliance records maintained according to financial regulations

7. Your Rights and Financial Data Control

7.1 Access and Control

  • View your trading data and position history in the app
  • Access the results of the positions the bot opened and closed for you
  • Update personal information and trading preferences
  • Delete your account in Settings (Danger Zone → Delete Account), even while subscribed. You can also do it without signing in or having the app installed, on the /delete-account page of this app's website: enter your account's email address and open the link we send to it. Deletion is immediate and cannot be undone: a web subscription ends at once, with no refund for the rest of its period, and a subscription bought in the App Store or Google Play must be cancelled there. You can also ask us to delete your account by emailing support@ashweb.io from your account's email address

7.2 Data Portability

  • Request a copy of your personal data and your position history by emailing support@ashweb.io; we reply within 30 days

7.3 Financial Privacy Controls

  • Your results are never shared with other users; there is nothing to opt out of
  • Manage notification preferences for trading alerts
  • Delete your account, which removes your personal data (see 6.2)
  • There are no comparison features to opt out of (see section 14)

7.4 Trading Communication Preferences

  • Choose whether to receive non-essential email
  • Service and security messages are always sent while your account is open
  • Choose which service and account notifications you receive
  • Opt-out of promotional communications while maintaining service alerts

8. Trading-Specific Privacy Considerations

8.1 Strategy Execution and Privacy

  • The strategy is the same for every user; nothing about it is personalised to you
  • The bot sizes positions from the budget you set; we do not profile you to do it
  • Your positions are used to report your own results, not to alter anyone else's bot
  • Execution quality (fills, slippage, errors) is tracked to find faults in the Service

8.2 Market Data and Analysis

  • Your market data usage patterns help optimize platform performance
  • Strategy results are measured using anonymised, aggregated data
  • Market trend analysis uses aggregated, non-personal trading data
  • Algorithm improvements use statistical analysis, not individual trading patterns

8.3 Financial Privacy Protection

  • Trading performance data is encrypted and access-controlled
  • Portfolio information is isolated from general user analytics
  • Financial data is processed separately from marketing and general service data
  • Compliance with financial privacy regulations across all jurisdictions

9. International Data Transfers and Financial Regulations

Your trading data may be processed in countries other than your own to provide global market access and analysis. We ensure appropriate safeguards are in place, including:

  • Compliance with international financial data protection regulations
  • Standard contractual clauses with financial service providers
  • Regular audits for cross-border financial data compliance

10. Regulatory Compliance and Reporting

10.1 Financial Regulatory Requirements

  • Compliance with applicable securities and trading regulations

10.2 Data Sharing for Compliance

  • Required reporting to financial regulatory authorities
  • Cooperation with market surveillance and investigation requests
  • Compliance with tax reporting obligations where applicable
  • Sharing data to prevent fraud and protect market integrity

11. Children's Privacy and Financial Services

Our Service is not intended for users under 18, as trading services require legal capacity to enter financial contracts. We do not knowingly collect data from minors. If we discover underage usage, we will promptly delete associated data and suspend the account.

12. Cookies

We use only the cookies needed to sign you in, keep your session secure, and remember your settings. We do not use advertising or analytics cookies. Sign-up and sign-in are protected by Google reCAPTCHA, which is subject to Google's Privacy Policy and Terms of Service.

13. Third-Party Financial Services

13.1 Cryptocurrency Exchange Integration

  • An API connection with Binance, the only exchange the Service supports today
  • Subject to exchange privacy policies and data handling practices
  • We ensure exchanges meet our security standards for financial data
  • Limited data sharing for order execution and performance reporting only

13.2 Market Data Providers

  • Real-time and historical prices come from Binance's public market data
  • Market data is used to run and research the strategy and to draw your charts; it contains nothing about you

13.3 Financial Infrastructure Services

  • Secure cloud hosting specifically for financial services
  • Payment processing with PCI-DSS compliant providers
  • Backup and disaster recovery with financial data protection standards

14. Community and Sharing Features

14.1 There Are None

  • The Service has no community, social, sharing, comparison, or leaderboard features
  • Your results are visible only to you
  • We do not publish, rank, or compare users
  • If such a feature is ever added, this Policy will be updated before it ships

14.2 Support Communication

  • Support requests you send us are handled privately
  • We do not post your trading data anywhere
  • Nothing you do in the Service is visible to other users
  • Contact details are in section 16

15. Changes to This Policy

We may update this Privacy Policy to reflect changes in financial regulations or our practices. We will notify you of any material changes via:

  • Email notification to your registered trading account
  • Prominent notice in the Service interface and trading dashboard
  • Updated "Last Updated" date on this policy
  • Summary of changes affecting financial data handling or trading privacy

16. Contact Us

For privacy-related questions or concerns:

  • Email: support@ashweb.io
  • Trading Support: Through in-app trading support system
  • Financial Privacy Inquiries: support@ashweb.io

17. Financial Privacy Rights by Jurisdiction

17.1 European Union (GDPR) - Financial Data Rights

  • Right to access all your trading and financial data
  • Right to rectification of inaccurate trading information
  • Right to erasure of personal data (subject to financial record retention requirements)
  • Right to restrict processing of financial data
  • Right to data portability for all trading data
  • Right to object to processing and withdraw consent

17.2 United States - Financial Privacy Rights

  • California Consumer Privacy Act (CCPA) rights for California residents
  • Right to know what financial information is collected and shared
  • Right to opt-out of sale of personal information (we do not sell trading data)
  • Right to non-discrimination for exercising privacy rights

17.3 Other Jurisdictions - Financial Compliance

We comply with applicable financial privacy laws in all jurisdictions where we operate, including:

  • Local financial data protection requirements
  • Securities regulation privacy requirements
  • Cross-border financial data transfer restrictions
  • Regional anti-money laundering (AML) and privacy requirements

Product Emails

From November 9, 2026, we may email you product updates and ideas about Calmkeel, no more than once a week. Until then, we send them only to people who signed up after our sign-up screen told them about these emails and did not say no, or who said yes in the app or turned them on in Settings — and never to people who have told us they live in South Korea. When you sign up you can say no right there by ticking "Don't email me product updates." Every one of these emails has an unsubscribe link, and you can turn them off or back on in Settings → Email preferences. Turning them off does not stop emails about your account, such as sign-in, password and billing emails. If you have told us you live in the EU/EEA, the UK, Canada or South Korea, we send these emails only after you turn them on yourself.

18. Why We Use Your Data

Why we use your data (EU/UK): To provide the service you asked for (contract); to tell you about new features and updates of this service (legitimate interests, from November 9, 2026; see Product Emails) — if you have told us you live where the law requires your consent for this, we send them only after you turn them on, and you can unsubscribe in any email; and to keep the service secure and prevent abuse (legitimate interests). Some processing continues where the law requires us to keep records.

Important: This Privacy Policy works in conjunction with our Terms of Service and Risk Disclosure to govern your use of the Service.