This policy explains what information SecBot ("we", "us") collects when you use secbot.trade, the SecBot dashboard, our alerting features, and the SecBot MCP server, and what we do with it. The short version: we collect the minimum needed to run the service, we never sell your data, and we never hold your funds or your card details.
Information we collect
Account data
When you create an account we collect your email address and a password. Passwords are stored only as salted cryptographic hashes — we cannot read them. Your email is used to sign you in, to secure your account (for example, password resets), and for essential service messages. We do not use it for third-party marketing.
As you use the product we also store the settings you create — watchlists, alert preferences, and similar configuration — so the service works the way you set it up.
MCP server and OAuth
The SecBot MCP server lets AI assistants (such as Claude) access SecBot data on your behalf. Access is authorized through OAuth 2.0. When you connect a client we store the authorization grants and access tokens needed to keep that connection working, an identifier for the connecting client, and logs of the tool calls made with your credentials (which tool, when, and usage counts for quota enforcement). You can revoke a connected client at any time from your account, which invalidates its tokens.
Payments
Subscriptions are paid in USDC (a digital dollar token) directly from your own crypto wallet using the x402 payment protocol. Because of this design:
- We never see or store card numbers, bank details, or any traditional payment credentials.
- We record the wallet address you pay from and the on-chain transaction details of your payment, and associate them with your account to activate and track your subscription.
- Payments are settled through a third-party payment facilitator and recorded on public blockchains. Blockchain transactions are public and permanent by design; we cannot edit or delete them.
- We are non-custodial: we never hold, control, or transmit your funds.
Affiliate program
If you join the affiliate program, you create a separate affiliate account with an email address and password, and you provide a payout wallet address where your revenue share is sent. We track which subscriptions were referred through your link, accrued and paid commissions, and the on-chain transactions of payouts. To prevent abuse, referral-link visits are rate-limited by IP address; those IPs are used only for rate-limiting and fraud prevention.
Service logs and analytics
Like nearly every website, our servers log technical data about requests: IP address, browser user-agent, pages and API endpoints requested, timestamps, and error details. We use these logs to keep the service secure (rate-limiting, abuse and fraud detection), to debug problems, and to understand aggregate usage of features. We do not use third-party advertising trackers.
Cookies
We use cookies for one purpose: keeping you signed in (session authentication). We do not use advertising or cross-site tracking cookies.
How we use your information
- To provide, secure, and operate the service, including sign-in and alert delivery.
- To activate subscriptions and attribute affiliate commissions.
- To enforce usage quotas and prevent fraud and abuse.
- To debug problems and improve features based on aggregate usage.
- To comply with legal obligations.
What we never do
- We never sell or rent your personal information.
- We never store card or bank details.
- We never take custody of your funds.
- We never share your data with advertisers.
Sharing
We share data only with the infrastructure and service providers needed to run SecBot (hosting, payment facilitation, messaging delivery), each limited to what their function requires; when required by law or valid legal process; or to protect the rights, safety, and security of SecBot and its users. Subscription payments are, by the nature of public blockchains, visible on-chain.
Data retention
We keep account data for as long as your account exists. Server logs are retained for a limited operational window and then deleted or aggregated. Records of on-chain payments are retained as long as needed for accounting and legal purposes; the underlying blockchain records are permanent and outside our control.
Security
All traffic is encrypted in transit (HTTPS). Passwords are hashed, OAuth tokens are scoped and revocable, and access to production systems is restricted. No system is perfectly secure, but we design so that a breach exposes as little as possible — we hold no payment credentials to steal.
Your rights
You can access and update your account information from your account settings. You can disconnect OAuth clients at any time. To request a copy of your data or deletion of your account, email [email protected] from your account email address. We will honor deletion requests except where we are legally required to retain records (for example, payment accounting) — and we cannot erase public blockchain transactions.
Children
SecBot is a financial-information service and is not directed at anyone under 18. We do not knowingly collect data from minors.
Changes to this policy
If we make material changes, we will update this page and the "last updated" date above. Continued use of the service after a change means you accept the updated policy.
Contact
Questions about privacy: [email protected].