Privacy
Version 0.1 of Nov 2, 2026. Written in plain language by the operator; a lawyer-reviewed version will replace this one before the public beta. If anything here contradicts applicable law, the law prevails.
Today the site stores one thing about people: what you leave on the waiting list. We do not sell data, there is no advertising and audience measurement is not active yet. When the beta exists, we will store your account, your strategies and your paper trades. You can ask us to delete your data by writing to [email protected].
1. Who is responsible
Tulkas LLC (Delaware, USA), operator of StrategyCheck. Contact for everything on this page: [email protected].
2. What we store, why and for how long
| Data | Why | For how long |
|---|---|---|
Waiting list (today): email, chosen case (optional), language, section of the site you signed up from, date, and an irreversible digest of your IP (ip_hash: SHA-256 of the IP, the day and a salt, truncated) |
A single notice when the beta opens. The IP digest is to limit abuse of the form; it cannot be used to recover the IP. | Up to 12 months after the beta launch (planned for February 28, 2027), or until you ask to delete it, whichever comes first. |
| Account (beta; does not exist yet): email and sign-in data | So you can sign in and each customer sees only their own data. | While the account exists. Deleted on request. |
| Strategies and code (beta): your rule or script, its versions and parameters | To run them in paper and show you the results. | While the account exists. Deleted on request. |
| Trades and decision log (beta): orders, fills and why each decision was made, in paper | To compute metrics and be able to replay every decision. It is an audit trail. | While the account exists. By design this log cannot be edited or deleted row by row; if you close the account, we delete your email and profile and the log is left without those identifying data. How this applies to each case will be refined in the lawyer-reviewed version. |
| Public engine status (today) | The Status page shows aggregate facts about the product's own test account, not about people. | It contains no personal data. |
We do not store your broker password. With Alpaca, the authorization token is stored encrypted and can be revoked from Alpaca (see Security). We do not use your data for advertising, we do not sell it and we do not hand it to third parties except the processors in section 3 or under a legal obligation.
3. Which third parties we work with
| Third party | Why | Status |
|---|---|---|
| Supabase | Database, authentication and secrets vault. | In use |
| Cloudflare | Delivery of the site, DNS and the function that receives the form. It sees the IP address of visitors, like any network provider. | In use |
| Hetzner | Server where the execution engine runs. | In use |
| Alpaca | Market data and, if you connect your account, the broker. When you authorize, Alpaca also applies its own privacy policy. | Market data in use; account connection under construction |
| Typography (Google Fonts), which sends your IP to Google when the page opens; and Google Analytics 4 when it is switched on. | Fonts in use; Analytics not active | |
| Paddle | Subscription billing, when it exists. Card data is handled by Paddle, not by us. | Future; nothing is charged today |
Some of these providers are in the United States or process data outside your country. The product's database is in the European Union. If the law of your country requires an additional safeguard for those transfers, we will provide it in the lawyer-reviewed version.
4. Cookies
Today the site uses no advertising or tracking cookies, and stores nothing in your browser beyond what is strictly necessary for it to work. Beta accounts will use what is needed to keep your session open.
Audience measurement with Google Analytics 4 is not active yet. When it is switched on it will be without advertising cookies or remarketing, with the IP anonymized, and where the law requires it we will ask for your consent first. We will update this page before switching it on.
5. Your rights
You can ask us by email, from the address you signed up or registered with: to see what data of yours we have, to correct it, to delete it or to stop receiving notices. We aim to reply in under 30 days. To delete your email from the waiting list, an email asking for it is enough. If you think we handled your data badly, write to us first; you can also go to the data protection authority of your country.
6. Security
What we do to protect data, and what we do not have yet, is in Security.
7. Minors
The service is not aimed at people under 18 and we do not knowingly collect data from minors.
8. Changes
This is version 0.1. A lawyer-reviewed version will replace it before the public beta. If it changes in a material way, we email people on the list or with an account and update the date above.