Privacy Policy
Last updated: October 10, 2026 Controller / operator: Momentum Digital LLC, a Wyoming limited liability company (“PositionAlpha,” “we,” “us,” or “our”) Privacy contact: admin@momentumdigital.online General support: admin@positionalpha.io
This Privacy Policy explains how PositionAlpha handles personal information when you visit https://positionalpha.io, create an account, use AI-assisted strategy or code-generation features, vote on assets, subscribe, or contact us.
1. Who is responsible for your information?
Momentum Digital LLC operates PositionAlpha and is the controller of personal information processed for its own purposes, where “controller” has the meaning given under applicable data-protection law. Contact us at admin@momentumdigital.online for privacy matters and admin@positionalpha.io for product support.
Business address: 30 N Gould St Ste R, Sheridan, WY 82801, USA
If you access PositionAlpha through an organization, that organization may separately determine how it uses your information. Where another party is the controller, its privacy notice may also apply.
2. Information we may collect
The precise information depends on how you use the Service and which features are enabled.
2.1 Account and identity information
We may process information such as your account identifier, email address, authentication-provider identifier, account status, and sign-in/security events. We use Firebase for authentication-related functionality; verify the exact Firebase products and configuration used by the production app.
2.2 Prompts, strategies, code, and other content
When you use AI features, we process the text and other inputs you submit, such as strategy ideas, trading rules, requested instruments, parameters, and relevant context. We also process the resulting AI responses, including generated MQL4/MQL5 code, explanations, and strategy outputs, to deliver the requested functionality and, where enabled, save your work.
Please do not submit passwords, payment-card details, government identifiers, sensitive personal information, confidential information belonging to another person, or information you do not have the right to share.
2.3 Subscription and payment information
If you subscribe, Stripe processes payment information. We may receive transaction identifiers, subscription and plan details, payment status, billing dates, amounts, currency, invoices, and limited payment-method details such as card brand or last four digits. We do not intend to store full payment-card numbers or card security codes on PositionAlpha systems; confirm this against the actual Stripe integration.
2.4 Usage, device, and technical information
We may process information such as IP address, browser and device characteristics, approximate location inferred from IP, logs, timestamps, pages or features used, error reports, performance data, and security events, to the extent collected by our systems and service providers.
2.5 Analytics and cookie-related information
PositionAlpha uses Google Analytics or related analytics functionality where enabled. Analytics may collect page and event information, device/browser details, identifiers, and usage patterns. Analytics configuration should avoid sending strategy prompts, generated code, authentication tokens, or other sensitive content. Cookie and consent behavior depends on the actual configuration and applicable law; do not assume that all analytics is strictly necessary.
2.6 Community votes
The current community feature lets users vote on assets or asset-related items. We may process the vote, the selected asset or item, timestamps, and an account or technical identifier needed to count votes, prevent abuse, and display aggregated results. We do not describe this as a general public-posting, messaging, or direct-message feature.
2.7 Support and correspondence
If you email us, we process your email address, message, attachments, and the information needed to respond and maintain appropriate support records.
3. Why we use information and our legal bases
Where the GDPR or similar laws require a legal basis, we rely on one or more of the following, depending on the context:
- Contract: to create and administer your account, provide requested features, process prompts and return outputs, manage subscriptions, and provide customer support connected with the Service.
- Legitimate interests: to secure the Service, prevent fraud and abuse, debug errors, maintain records, improve reliability, and defend legal claims, where those interests are not overridden by your rights.
- Consent: for non-essential cookies or analytics where consent is legally required, and for any optional processing that we specifically present for consent.
- Legal obligation: to maintain tax, accounting, payment, consumer, security, or other records where required by law.
We will not claim consent as the legal basis for a processing activity unless we actually request and record valid consent for that activity. You may withdraw consent at any time where processing relies on consent; withdrawal does not affect processing that occurred before withdrawal.
4. How AI processing works
PositionAlpha uses Anthropic’s Claude API for AI functionality, according to the information provided for this policy. When you submit an AI request, relevant prompt content and context may be sent to Anthropic for processing, and the response may be returned to PositionAlpha. We may also process the request and response within our own systems to provide the feature, maintain account history where enabled, prevent abuse, and troubleshoot issues.
Anthropic states that, for its commercial API services, inputs and outputs are not used to train its models by default, unless the customer opts in or another applicable exception applies. Anthropic’s retention and handling can depend on the API feature, contractual arrangement, and applicable terms. We do not claim to have a zero-data-retention arrangement unless one has been expressly confirmed for our account and the specific API features used. See Anthropic’s API data-retention documentation and commercial data-use explanation.
Our policy: we do not use your prompts or generated code to train our own AI models unless we separately explain the proposed use and obtain any consent required by law. If we ever propose to use your content for optional training or another materially different purpose, we will provide the required notice and obtain consent where required.
AI requests may contain financial ideas or strategy information. Do not include personal or confidential information unless it is necessary and you are authorized to share it. AI processing is not a guarantee that a generated strategy, directional output, or code is accurate or appropriate.
5. Market data and Twelve Data
PositionAlpha uses Twelve Data for market-data/API functionality, according to the information provided for this policy. Depending on the feature, requests may include a symbol or asset identifier, interval, date range, query parameters, API usage metadata, or other information needed to retrieve market data. Do not assume that prompts or account details are sent to Twelve Data unless the actual integration does so.
Twelve Data and relevant exchanges may impose restrictions on data access, storage, display, and redistribution. Our use of Twelve Data does not mean that all data can be redistributed or displayed to every user or customer. We will use the service only within the rights granted under the applicable subscription and exchange licences. If the product’s actual use requires a licence we do not have, that feature must be restricted until authorization is obtained.
6. How we share information
We may disclose personal information to the following categories of recipients, as necessary for the purposes described above:
- Service providers: Firebase/Google, Stripe, Anthropic, Twelve Data, and other infrastructure, hosting, security, support, or operational providers actually used by the Service.
- Professional advisers: lawyers, accountants, auditors, insurers, and similar advisers subject to appropriate confidentiality obligations.
- Authorities and other parties: where required by law, legal process, or a valid request, or where reasonably necessary to protect rights, safety, users, or the Service.
- Business transfers: a purchaser, investor, successor, or related party in a merger, financing, restructuring, or sale, subject to appropriate safeguards and applicable law.
We do not sell personal information for money. If applicable law defines “sale,” “sharing,” or targeted advertising more broadly, our actual practices and required opt-out controls must be assessed before publication. Do not enable advertising or data-sharing integrations without updating this policy and implementing required controls.
7. Cookies and analytics choices
The website uses browser storage for authentication, security, preferences, and cookie-choice state. The optional cookie notice covers Google Analytics and Google advertising together: those scripts and ad placements are enabled only after the visitor accepts, and are withheld when the visitor declines. This combined control does not establish that consent is the correct legal basis in every location.
You can reopen the cookie notice from the Cookie settings control on this page and change your choice. The choice is stored in browser local storage. Exact Google cookie names, lifetimes, regional requirements, and production property settings still need verification. Blocking optional technologies may affect analytics and advertising; authentication and security storage remain necessary for requested account features.
8. International data transfers
PositionAlpha is operated by a Wyoming, United States LLC and may use service providers that process information in the United States or other countries. If personal information protected by the GDPR is transferred outside the European Economic Area, we will use a valid transfer mechanism where required, such as an adequacy decision or appropriate safeguards, and make information about the applicable safeguards available as required by law.
The existence and adequacy of a particular transfer mechanism must be verified for each relevant provider and contracting entity. We do not claim that every transfer is covered by a specific mechanism until this has been checked.
9. How long we keep information
We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, then delete it or irreversibly anonymise it unless a longer period is required or permitted by law. The retention periods below are the policy PositionAlpha intends to implement. They must be reflected in the production systems, provider settings, and operational procedures; publishing this Policy does not itself configure those systems.
| Data category | Intended retention period |
|---|---|
| Account profile and authentication records | While the account is active, subject to applicable purposes and exceptions. A deletion request is recorded for review; this draft does not promise a processing time or automatic removal. |
| Saved prompts, generated strategies, generated code, and user-created projects | While the account is active or until the user deletes the item. A deletion request is reviewed for applicable scope and exceptions; this draft does not promise a processing time or automatic removal. |
| Backups containing personal information | Backup provider, expiry schedule, restore controls, and reapplication of deletions have not been verified. No backup deletion timeline is promised. |
| Billing, invoices, tax, subscription, refund, and transaction records | For the period required by applicable tax, accounting, payment, and limitation laws. Our default operational target is up to 7 years after the transaction, unless a different period is legally required or a shorter period is lawful. Payment-card details are handled by Stripe and are not intended to be stored by PositionAlpha. |
| Security, authentication, abuse-prevention, and application logs | Normally up to 12 months, unless an incident, investigation, or legal obligation requires longer retention. Logs should avoid prompts, generated code, tokens, and unnecessary personal data. |
| Support correspondence and complaints | Normally 3 years after the issue is closed, or longer where needed for a dispute, legal obligation, or defence of legal claims. |
| Google Analytics data | Configure the analytics property to the shortest practical retention period that meets measurement needs, with a target of 14 months where supported. Aggregated, non-identifying statistics may be retained longer. |
| Community asset votes | While needed to operate voting, detect manipulation, and preserve useful aggregate results. On account deletion, remove the account link where feasible; aggregate results may be retained if they no longer identify a person. |
| Legal claims, fraud, and security investigations | Only for the period reasonably necessary to investigate, resolve, enforce, or defend the relevant matter, subject to applicable law. |
The 24-month inactivity notice, export opportunity, and deletion/anonymisation process are not implemented. No automatic inactivity deletion is currently promised.
These periods are not an assertion that a particular period is mandated by the GDPR. The GDPR requires a purpose-specific assessment and storage limitation; exact periods depend on the data, purpose, applicable law, and actual system design. We will update this Policy if actual retention periods materially change.
Anthropic's retention is separate from PositionAlpha's own retention and is governed by the applicable Anthropic API terms and configuration. Under Anthropic's published standard commercial API policy, API inputs and outputs are generally automatically deleted within 30 days, subject to exceptions and feature-specific terms; Anthropic does not generally support ad hoc deletion of individual inputs and outputs for paid API customers. We do not promise deletion from Anthropic's systems beyond the controls and terms that actually apply. See Anthropic's commercial API retention policy and API deletion explanation.
10. Access, deletion, and account closure
Signed-in users can submit an account-deletion request from Settings → Delete Account. The request is recorded with a status that the user can view; it enters an internal review queue and does not delete data automatically. You may also email admin@momentumdigital.online for access, correction, deletion, or other privacy requests, including if you cannot access your account. We may need to verify your identity and clarify the scope of a request. We will respond within the time required by applicable law and explain any lawful exception or extension.
Submitting a request does not itself complete deletion, suspend the account, or trigger an automated deletion job. We do not currently promise a fixed processing or completion time in this draft. A reviewer must assess identity, scope, linked data, applicable exceptions, and any required manual actions. The request status closed means the review workflow was closed; it does not by itself certify that all PositionAlpha systems, independent providers, or backups have been erased. We may retain limited records where necessary for tax/accounting obligations, security, fraud prevention, legal claims, or another lawful basis.
A request to PositionAlpha does not automatically delete information held independently by Stripe, Anthropic, Google/Firebase, Twelve Data, AWS, or another provider. Their own retention and deletion policies apply. Our provider-side account and object deletion procedures have not been fully verified. In particular, Anthropic's standard paid API policy does not generally provide ad hoc deletion of an individual prompt from its API systems. We will not represent this request queue as provider-side deletion or backup erasure.
11. Your privacy rights
Depending on your location and applicable law, you may have rights to request access, correction, deletion, restriction, portability, objection to certain processing, or withdrawal of consent. You may also have the right to complain to a data-protection supervisory authority. These rights are subject to legal conditions and exceptions.
If the GDPR applies, you can contact us at admin@positionalpha.io to exercise your rights. We may ask for information needed to verify your identity and will respond within the legally required period. We will not discriminate against you for exercising applicable privacy rights.
If you are a resident of a US state with an applicable comprehensive privacy law, you may have additional rights, such as knowing, accessing, correcting, deleting, or opting out of certain forms of processing. The rights available depend on the state law and whether it applies to our business. We will provide any required notice and mechanism when applicable.
12. Security
We use reasonable technical and organizational measures designed to protect information, taking into account the nature of the information and risks associated with the Service. No system or transmission method is completely secure, and we cannot guarantee absolute security.
You are responsible for keeping your credentials confidential and for using the Service from reasonably secure devices and networks. If you believe your account or information has been compromised, contact admin@positionalpha.io promptly.
13. Children
PositionAlpha is intended for adults aged 18 or older and is not designed for children. We do not knowingly seek to collect personal information from children under 18. If you believe a child has provided personal information, contact us so we can review the situation and take appropriate action.
14. Automated processing and profiling
PositionAlpha uses AI to generate responses from user inputs. These outputs may include strategy concepts, entry/exit rules, buy/sell direction, or risk parameters. They are generated to provide the feature requested by the user and may be incorrect or unsuitable.
We do not describe the Service as making legally binding decisions about a person. If we introduce processing that constitutes solely automated decision-making with legal or similarly significant effects under applicable law, we will assess the requirements and provide any required notice, rights, and safeguards before enabling it.
15. Changes to this Privacy Policy
We may update this Policy as the Service, providers, data practices, or legal requirements change. We will update the “Last updated” date and provide notice or obtain consent where required by law. If a material change affects an existing consent, we will obtain renewed consent where legally required.
16. Contact
For privacy questions or requests:
Momentum Digital LLC / PositionAlpha Privacy contact: admin@momentumdigital.online Product support: admin@positionalpha.io Business address: 30 N Gould St Ste R, Sheridan, WY 82801, USA
---