Privacy
Last updated: DD Month YYYY
There are two separate things to talk about: the software, which runs on your machine, and this website, which serves you the download. They are treated differently and the distinction matters.
1. The software
We receive nothing
APEX Terminal and Omega Terminal have no account system, no sign-up, no licence check, no analytics and no telemetry. Neither application sends any data to COMPANY NAME or to any third party at any time. There is no mechanism in the software by which it could.
The applications run a local server bound to 127.0.0.1 — the loopback address. That address is not reachable from your local network, let alone from the internet. A request arriving with an origin other than loopback is refused outright.
What the software stores, and where
Everything is written to your own disk, under your own Windows user profile:
- Encrypted credential vault — your broker API keys and tokens, encrypted with AES-256-GCM. The encryption key is stored in a separate file beside the vault, so a copy of the vault alone cannot be read.
- Desk state — watchlists, alerts, risk limits, auto square-off rules, charges configuration, baskets and paper-trading books.
- Window layout and preferences — including your keyboard map, stored in the browser-engine local storage belonging to the application.
- Strategies and journal (APEX only) — strategy definitions, run records and an append-only per-day journal of every entry, exit, target and stop.
These live in %APPDATA%\APEX Terminal and
%APPDATA%\Omega Terminal respectively. To remove everything, delete
those folders.
One-time authentication codes are never stored
A TOTP code you type at connect time is used once and discarded; it is dead within thirty seconds anyway. Only a static TOTP setup key can be saved, only if you choose to save it, and only encrypted. Anything resembling a secret, token, password, PIN or key is masked before it is written to any log.
Your broker does see your traffic
The software connects directly to your broker's REST and WebSocket endpoints using your own API credentials. Your broker therefore sees your orders, your market data subscriptions and your account activity, exactly as they would if you used the broker's own application. Their privacy policy governs that relationship, not ours.
2. This website
No cookies, no tracking
This site sets no cookies, runs no analytics, embeds no third-party scripts and loads no external resources. Fonts are served from this domain rather than from a font CDN, specifically so that visiting this page does not tell anyone else that you did.
Server logs
The site is served from a server we operate, behind Cloudflare's content delivery network. Standard web-server access logging may record the IP address, timestamp, requested path, HTTP status, user agent and referrer of each request. This is used only to understand traffic volume and to diagnose faults. Describe your retention period here, e.g. "Logs are retained for 30 days and then deleted automatically."
Cloudflare, Inc. sits between your browser and our server: it terminates the HTTPS connection, caches static files and filters abusive traffic, and processes connection data on our behalf under its own terms. See the Cloudflare Privacy Policy.
Downloads
Downloading an application requires no email address, no registration and no identifying information of any kind. The download is an ordinary HTTPS file transfer.
3. Your rights
Because we hold no account data, there is generally nothing for us to export, correct or delete on your behalf. If you believe we hold information about you and wish to exercise a right of access, correction or erasure, contact [email protected].
4. Changes
If this policy changes, the "last updated" date above changes with it. Material changes will be noted on the home page.
5. Contact
COMPANY NAME, registered address. Email [email protected].