Privacy policy
Last updated: 12 September 2026
This policy explains what personal data DirectTrade handles, why, and what rights you have. It applies to the DirectTrade app for iPhone and Android and to the website at directtrade.app. Your use of the app is governed by our terms of service.
In short: DirectTrade is built to hold as little about you as possible. We store the watchlists, price alerts, chart configurations and drawings you choose to keep in step across devices, and one notification token per device so alerts can reach you. Beyond the messages you choose to send us, we do not store your name, email address, phone number, IP address, device model or location. We do not store your exchange API keys, balances, orders or fills. There are no analytics, no crash reporting, no advertising and no tracking.
1. Who we are
The controller of your personal data is KD Software sp. z o.o., ul. Aleksandra Fredry 2/7, 30-605 Kraków, Poland. Registered in the National Court Register (KRS) under number 0001261286, NIP 6793373732. Contact: support@directtrade.app.
2. What DirectTrade does
DirectTrade is a trading terminal. Prices, candles and order books come to your device straight from each exchange the app supports; the current list is shown in the app. If you connect an exchange account with an API key, requests to see your balances, place or cancel spot orders, and review your orders and fills go from your device to that exchange. None of this passes through us.
3. Data that stays on your device
The following is held only on your device and is never transmitted to DirectTrade:
- the exchange API keys you enter;
- your balances, orders and fills, which the app shows from the exchange and does not store;
- your app settings, such as appearance and app lock;
- the email address and display name your sign-in provider gives the app, which are used on the device only to show who is signed in.
Uninstalling the app removes this data, except that on iPhone a stored API key may be restored if you reinstall the app. Uninstalling does not revoke an API key at the exchange; revoke it there when you no longer need it.
4. Data we store
When you install the app it creates an anonymous guest account with no sign-up. If you choose to sign in with Apple, Google, or an email address and password, your guest account is linked to that sign-in. In both cases, so that your data can be kept in step across your devices, we store the following, keyed by an account identifier:
- Watchlists: the pairs you follow and the names of your lists.
- Price alerts: the instrument, the price level, the direction, and an optional free-text note you type. Please do not put personal information in a note; it is stored as you wrote it and repeated in the notification.
- Chart configurations: their names and settings.
- Chart drawings.
- Notification tokens: one per device, together with the platform (iOS or Android) and the time it was last updated, so that a triggered alert can be delivered to that device.
That is the complete list. Apart from messages you send us, we do not store your email address, name, phone number, IP address, device model or location. The sign-in itself is handled by a provider named in section 7: Apple or Google when you sign in with them, and Google on our behalf when you sign in with an email address and password, which holds that address and password only to authenticate you. We hold only the account identifier that links your data to your sign-in.
Our hosting providers keep operational logs for a short time for security and reliability. At the network level these may include IP addresses. We do not use them to identify or profile you.
The website at directtrade.app sets no cookies and loads nothing from third parties.
5. Why we use your data and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing the app and keeping your data in step across devices | Account identifier, watchlists, alerts, chart configurations, drawings | Performance of a contract (Article 6(1)(b)) |
| Evaluating your price alerts around the clock and delivering notifications | Alerts, notification tokens | Performance of a contract (Article 6(1)(b)). Your operating system separately asks whether the app may show notifications; that permission controls delivery and can be changed in your device settings at any time |
| Security, reliability and abuse prevention | Operational logs | Legitimate interests (Article 6(1)(f)) in keeping the service safe and working |
| Answering your messages | What you send us, including the address you write from | Legitimate interests (Article 6(1)(f)) in running the service and responding to you |
Providing the data in the first two rows is necessary to provide the app: without it, the app cannot keep your data in step across devices or deliver alerts. Everything else is optional.
We do not use your data for advertising, profiling or automated decisions that affect you, and we do not sell it.
6. Notifications
When one of your price alerts triggers, we send a notification to the devices registered on your account. The notification contains the pair, the price, the direction and the note you wrote. Notifications reach your device through Apple's and Google's notification services, which see the content of the notification in order to deliver it. You can turn notifications off in your device settings at any time; alerts will then not be delivered.
7. Who receives your data
- Apple and Google, as sign-in providers (Apple only on iPhone; Google also handles sign-in with an email address and password on our behalf) and as notification providers. When you sign in with Apple or Google, the provider handles the sign-in under its own privacy policy. Where these providers process data outside the European Economic Area, transfers rely on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. A copy of the safeguards is available on request.
- The exchanges you choose to connect. Your device talks to them directly; what they collect and how they use it is governed by their own terms and privacy policies, not by this one.
- Hosting providers in the European Union, which run our systems on our behalf under data processing agreements.
- Authorities, where the law requires us to disclose data.
We do not share your data with anyone else.
8. Where your data is stored
The data described in section 4 is stored in the European Union by our hosting providers. The only transfers outside the EEA are those described in section 7.
9. How long we keep your data
- Account data (watchlists, alerts, chart configurations, drawings) is kept for the life of your account and permanently deleted when you delete the account.
- Notification tokens are deleted when they expire, when you delete the account, or when the device is no longer registered.
- Operational logs are kept briefly by our hosting providers and then removed.
- Support correspondence is kept as long as needed to deal with your request and any follow-up.
You can delete your account in the app under Settings → Account → Delete account, or by emailing support@directtrade.app. Deletion permanently removes the data kept in step across your devices and your notification tokens, and then the sign-in account itself. Deletion by email is completed within 30 days. Device-local data, including settings and, subject to the note in section 3, exchange API keys, is removed by uninstalling the app.
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict how we process it;
- receive the data you gave us in a portable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time where processing is based on consent, without affecting processing that took place before you withdrew it. Notifications are controlled in your device settings.
To exercise a right, write to support@directtrade.app. We may ask you to confirm which account you are writing about. We will respond within one month, or tell you if we need longer. Because we store no name or email address, the only way to tie a request to an account is through the sign-in you use in the app, so please write from the address you sign in with.
You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl). You may also complain to the authority in the country where you live or work.
11. Children
DirectTrade is for people aged 18 and over and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, contact us and we will delete it.
12. Security
We keep the data we hold to a minimum and protect it with measures appropriate to its nature. The most sensitive data, your exchange API keys, never leaves your device. You can help by protecting your device with a passcode, turning on the app lock, and granting API keys no withdrawal permission.
13. Changes to this policy
The current version of this policy is always available at directtrade.app/privacy. If we make a material change, we will announce it in the app before it takes effect.
14. Contact
KD Software sp. z o.o., ul. Aleksandra Fredry 2/7, 30-605 Kraków, Poland. Email: support@directtrade.app. Support: directtrade.app/support.