Privacy Policy

2. Information We Collect

We collect only the information necessary to provide and improve our services. We adhere to data minimization principles.

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Information from Exchange Connections

When you connect an exchange account via API keys, we collect:

2.4 Information from Zero-Knowledge Proofs

3.1 Core Platform Functionality

• To provide copy trading services: Mirror trades from Traders to Copiers based on subscription relationships.
• To generate verifiable proofs: Create zero-knowledge proofs of trading activity without exposing strategy details.
• To anchor proofs on blockchain: Record proof hashes on public distributed ledgers for tamper-evident verification.

3.2 Platform Improvement

• To analyze usage patterns: Understand how Users interact with features to guide product development.
• To optimize performance: Identify and fix bugs, improve loading times, enhance user experience.
• To train algorithms: Improve trade mirroring execution, risk control recommendations, and trader matching.

3.3 Security and Compliance

• To prevent fraud: Monitor for suspicious activity, unauthorized access attempts, API key misuse.
• To enforce terms: Investigate violations of our Terms of Service.
• To comply with legal obligations: Respond to lawful requests from authorities (see Section 8).

3.4 Communication

• To send service notifications: Subscription confirmations, security alerts, feature updates.
• To provide support: Respond to inquiries, troubleshoot issues.
• To share marketing communications: Only with your explicit consent (opt-in). You may opt out at any time.

4.1 How We Handle API Keys

4.2 Your Responsibilities

• Permission configuration: You are responsible for setting API key permissions to "trading enabled" (if copying) and "withdrawals disabled."
• Key confidentiality: You must not share your API keys outside the Platform.
• Revocation: You may revoke API access at any time through your exchange account or by disconnecting within Obscura.

4.3 Breach Notification

In the event of a security incident involving API keys, we will:

• Notify affected Users within 72 hours of confirmation
• Provide guidance on key rotation and account securing
• Cooperate with relevant authorities and exchanges
• Conduct and publish a post-mortem analysis

5.1 On-Chain Data

Obscura anchors proof hashes to public blockchains (e.g., Ethereum, Polygon, Arbitrum). This data is:

5.2 What Is Revealed On-Chain

• Hash of proof data: A fixed-length string derived from your trading proof
• Timestamp: When the proof was recorded
• Wallet address: The Obscura-controlled address submitting the proof (consistent across Users)

What remains off-chain (private):

• Individual trade details
• Entry and exit prices
• Position sizes
• Exchange used
• Your identity or email

5.3 Your Choices Regarding On-Chain Data

Once data is recorded on a public blockchain, it cannot be erased. By using Obscura's verification features, you acknowledge and accept the permanent, public nature of blockchain records.

If you wish to minimize on-chain exposure, you may:

• Choose not to use verification features
• Use privacy-focused blockchains with enhanced pseudonymity
• Generate proofs less frequently

6.1 We Do Not Sell Your Personal Data

Obscura does not and will not sell your personal information to third parties for marketing or advertising purposes.

6.2 Categories of Third Parties With Whom We Share Data

6.3 Legal Compliance

We may disclose your information if required by:

• Valid legal process (court order, subpoena, warrant)
• Applicable law or regulation
• Government or regulatory authority request

Where permitted, we will attempt to notify you of such requests unless prohibited by law.

6.4 Business Transfers

In the event of a merger, acquisition, financing, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any such change of control.

7.1 Opt-Out and Deletion Process

To opt out and request account deletion:

• Submit request via email to: compliance@obscura.finance
• Verification: We may request additional information to verify your identity
• Processing timeline: We will cease all data processing and delete your account within 1 month of verified request
• Complete data deletion: All personally identifiable information will be deleted within 1 year of the deletion request, subject to:
  • Legal obligations requiring longer retention
  • Anonymized data retained for analytics
  • On-chain proof hashes (cannot be deleted)

7.2 What "Deletion" Means

• Account inaccessible: You will no longer be able to log in or access Platform features
• Personal data removed: Email, name, and direct identifiers purged from active databases
• Backup purging: Data will be removed from backups within the 1-year window

Exceptions:

• Anonymized aggregate statistics may be retained
• Blockchain records remain immutable
• Legal holds override deletion requests

9.1 Access and Portability

You may request:

• Confirmation of whether we process your personal data
• A copy of your personal data in structured, machine-readable format
• Information about how your data is processed

9.2 Correction and Deletion

You may:

• Update account information through Platform settings
• Request correction of inaccurate data
• Request deletion of your personal data as described in Section 7.1

9.3 Objection and Restriction

You may:

• Object to processing based on legitimate interests
• Request restriction of processing in certain circumstances
• Withdraw consent at any time (where processing is based on consent)

9.4 Exercising Your Rights

To exercise any rights:

• Submit request via: compliance@obscura.finance
• Provide sufficient information to verify identity
• Specify the right(s) you wish to exercise

We will respond within 30 days (extended by up to 60 days for complex requests).

9.5 California Privacy Rights (CCPA)

California residents have additional rights:

• Right to know categories and specific pieces of personal information collected
• Right to deletion
• Right to opt-out of sales (we do not sell)
• Right to non-discrimination for exercising rights

To exercise California rights, contact compliance@obscura.finance with "CCPA Request" in subject line.

9.6 EU/UK Privacy Rights (GDPR)

EU/UK residents have rights under the General Data Protection Regulation, including:

• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to lodge a complaint with a supervisory authority

Our lawful bases for processing include:

• Contract performance: Providing requested services
• Legitimate interests: Platform security, improvement, fraud prevention
• Legal obligation: Compliance with applicable laws
• Consent: Marketing communications

10.1 What We Use

10.2 Your Choices

• Browser settings: Most browsers allow cookie control
• Opt-out links: [Insert opt-out mechanism for analytics]
• Do Not Track: Our systems currently do not respond to DNT signals

11.1 Technical Safeguards

11.2 Organizational Safeguards

• Employee training: Annual privacy and security training
• Confidentiality agreements: All employees sign confidentiality agreements
• Access logging: All internal access to user data is logged and audited
• Vendor review: Third-party processors are vetted for security compliance

11.3 No Absolute Security

While we implement industry-standard safeguards, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but will promptly notify you of any known breach affecting your data.

16.1 United States

This section applies to residents of the United States. We comply with applicable federal and state privacy laws. California residents should refer to Section 9.5.

16.2 European Union / United Kingdom

This section applies to residents of the EU/UK. We process personal data in accordance with the General Data Protection Regulation (GDPR) and UK GDPR.

16.3 Other Jurisdictions

If you are accessing Obscura from outside the United States, please note that your data may be transferred to, stored, and processed in the United States or other jurisdictions where our servers operate.