Open Backtest Back to home
The controller identity below references the Legal Notice placeholders, which must be completed before the public launch.

Privacy Policy

Last updated: July 30, 2026

1. Scope and controller

This notice explains how Open Backtest processes personal data when you use the website, dashboard, APIs, documentation, support, and organization features.

The data controller is the publisher identified in the Legal Notice. The service is not directed at children under 15, and we do not knowingly collect their data.

2. Data we process

  • account data, including name, email, profile image, language, authentication methods, and security settings;
  • backtesting and journal data, including projects, sessions, simulated and imported trades, executions, account balances, deposits and withdrawals, notes, tags, chart state, screenshots, feedback, and organization membership;
  • portfolio and connection data, including the broker or platform selected, external account identifiers, granted read-only scopes, connection and synchronization status, imported positions and transactions, public wallet addresses, supported blockchain history, and optional wallet-ownership proof;
  • Pine-compatible script data, including folders, source code, saved versions, titles, descriptions, and execution or strategy results;
  • technical data, including IP address, browser, device, logs, API usage, and security events; optional automatic error reports are collected only when you enable diagnostic sharing;
  • billing data handled with our payment provider, such as subscription status and transaction identifiers.

3. Why we use data

We use data to provide and secure the service, authenticate users, restore saved work, run requested simulations, synchronize read-only financial accounts, process subscriptions, enforce limits, communicate service messages, answer support requests, diagnose errors, and improve the beta.

4. Legal bases

  • performance of our agreement for accounts, saved work, requested simulations, imports, synchronization, support, and paid features;
  • our legitimate interests in securing the service, preventing abuse, maintaining audit trails, and improving reliability, balanced against your rights;
  • compliance with legal obligations for billing, accounting, tax, fraud, and valid authority requests; and
  • your consent for optional diagnostic sharing and optional wallet-ownership proof, which you can withdraw without affecting earlier lawful processing.

5. Service providers

We use providers acting as processors or, for some services, independent controllers. They receive only the data needed for the selected feature. Processor contracts and access controls must be in place before production use.

  • hosting, database, and private object storage: [provider legal names and hosting regions — to be completed before public launch];
  • transactional email delivery: Resend;
  • payments and billing: Stripe Managed Payments, for which Stripe acts as merchant of record and Link may present checkout, order management, and transaction support; Stripe and Link process payment, invoicing, tax, fraud, dispute, and buyer-support data under their own notices;
  • optional sign-in providers: Google and Microsoft, only when you choose to authenticate with them.
  • optional financial connections: SnapTrade and the broker or trading platform you select, currently including cTrader, Tradovate, NinjaTrader, MetaTrader, and TradeLocker; Open Backtest imposes read-only access, encrypts the provider secrets or tokens it retains, and does not receive brokerage passwords entered in SnapTrade's hosted portal;
  • optional wallet tools: WalletConnect for a user-requested ownership signature and GoldRush for indexing public wallet balances and transactions; Open Backtest never requests or stores a private key or seed phrase; and
  • market and public-event sources such as Binance, SEC EDGAR, and GDELT receive the technical request, which can include an IP address and the requested symbol, issuer, date range, or search terms. Open Backtest does not send them your broker credentials or private journal notes.

6. International transfers

Some providers may process data outside the European Economic Area, notably in the United States. Before production use, each transfer must be documented and rely on an applicable adequacy decision, certification such as the EU-US Data Privacy Framework, or the European Commission's standard contractual clauses with any required supplementary assessment and measures.

7. Retention and beta resets

Account content, Pine-compatible scripts, portfolio imports, and journal data are kept while your account exists or until you delete the relevant content. Deleted empty backtest sessions remain recoverable for up to 30 days; sessions containing trades are retained until you permanently delete them or delete the account. Closed-beta environments may be reset, so beta content is not guaranteed to be preserved.

Submitting a broker disconnection immediately stops further synchronization by Open Backtest and requests revocation from the provider; provider-side completion may be asynchronous. Where the product offers a retention choice, imported journal data is either kept as a historical record or deleted with the connection. Deleting an Open Backtest account also requests deletion of its pseudonymous SnapTrade user. SnapTrade webhook audit records contain no raw payload and follow a 30-day deletion schedule; expired authorization attempts and other security artifacts are removed according to short operational retention schedules.

Automatic diagnostic reports are retained for no more than 90 days after their latest occurrence and are deleted with the reporting account. Their page route excludes query parameters, fragments, credentials, and opaque identifiers.

Billing, fraud, tax, security, and legal records may be retained longer where law or the establishment, exercise, or defence of legal claims requires it. Production backup lifetimes must be added here once the hosting provider and backup policy are finalized.

8. Cookies and local storage

We use essential cookies and browser storage for sessions, security, language, theme, sidebar preferences, and dismissed notices. Optional analytics or marketing technologies will require an appropriate consent mechanism before public use.

The full inventory, purposes, and lifetimes are described in the Cookie Policy.

Automatic diagnostic sharing is optional, disabled by default, and can be enabled or withdrawn at any time in Account settings.

Pine-compatible source code is stored in the application database and is not currently sent to a generative-AI provider. Any future AI assistant that processes script content will require this notice and the provider inventory to be updated before activation.

9. Security

We apply technical and organizational safeguards including encrypted transport, access controls, encrypted broker credentials and terminal snapshots, private object storage for journal images, and exclusion of authentication secrets from data exports and diagnostics. No system is completely secure, especially during beta testing, so report suspected incidents promptly.

10. Your rights

Depending on your location, you may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent. You may also complain to your data-protection authority.

In France and the EU these rights come from the GDPR, and complaints can be addressed to the CNIL (cnil.fr). Residents of US states with privacy laws, such as California, may exercise the equivalent rights to know, correct, delete, and opt out of the sale or sharing of personal information — we do not sell personal information.

A self-service ZIP export is available from Account settings and includes account, backtest, journal, Pine-compatible script, portfolio, connection, and dashboard/session sharing data, including available shared chart images. It excludes password hashes, bearer-token hashes, encrypted credentials, internal object-storage keys, private security artifacts, and other users' data. You can also request account deletion. Managed organization accounts may require action by the organization controller.

11. Automated decisions

Open Backtest does not make decisions producing legal or similarly significant effects about you. Statistics, strategy results, classifications, and simulations are informational outputs that you choose whether to use.

12. Changes and contact

We will update this notice as the beta, providers, and legal details are finalized. Privacy requests can be submitted through Get Help or the feedback form, or sent to [contact email].