Privacy Policy
The short version
- We collect the minimum needed to run your bots: your email, your trade-only API key, your trading records, your sessions and your payment references.
- We never ask for — and never accept — anything that can move your money: no exchange password, no seed phrase, no withdrawal-enabled key.
- We do not sell your data, and we do not use advertising trackers.
- You can export your trade history any time and ask us to delete your account.
- 1. Who we are
- 2. What we collect
- 3. What we never collect
- 4. How we use it
- 5. Legal basis
- 6. How we protect it
- 7. Who we share it with
- 8. International transfers
- 9. How long we keep it
- 10. Your rights
- 11. Cookies
- 12. Children
- 13. Breaches
- 14. Changes and contact
01Who we are
0xSignals ("we", "us") provides trading-automation software that runs on your own Bybit account. We are based in Lagos, Nigeria, and are the data controller for the personal data described here. This policy applies to 0xsignals.com, app.0xsignals.com, our ingest API and our Telegram bots. It should be read with our Terms of Service.
02What we collect
| Data | Why |
|---|---|
| Account details | Your email address, to create your account, sign you in by one-time email link, and contact you about it. Sign-in is passwordless — we do not collect or store passwords. |
| Exchange API key | Your trade-only Bybit API key and secret, so your bots can place and manage orders. Before storage we check the key's permissions; a key with withdrawal or transfer rights is rejected and never stored. |
| Trading data | Your bot configuration, exit ladders, risk settings, signals received, orders, positions, fills, closed trades, refusal logs and per-source records — to run the Service and show you what happened. |
| Account data from Bybit | Balances, positions and order status read through your key, to size orders within your rules and display your account. |
| Sessions and devices | Signed-in sessions with device and browser type, IP address and time, so you can see and end sessions and so we can detect misuse. |
| Payment references | Plan, billing period, and USDT transaction hash and sending address, to confirm payment. No card details are collected or stored. |
| Signal-source data | For a connected Telegram channel: the channel identifier and the posts our bot reads from it. For the ingest API: the provider identity attached to each bearer key. |
| Telegram alerts | Your Telegram user or chat ID, if you switch on alerts. |
| Demo requests | Name, email and/or Telegram username, plan interest, preferred time, time zone, and your message — only to arrange the demo you asked for. |
| Support | Whatever you send us when you contact support. |
| Technical logs | Server and API logs, including IP addresses and request metadata, to keep the Service secure and running. |
03What we never collect
- Passwords — sign-in is by one-time email link
- Your exchange password or your exchange two-factor codes
- Seed phrases, private keys or wallet backups
- API keys with withdrawal or transfer permission — rejected before storage
- Payment card numbers
If anyone claiming to be us asks you for any of these, it is not us. Report it to [email protected].
04How we use your data
- To run the Service: execute your configuration, manage exits, and display positions, history and records.
- To secure the Service: verify key permissions, manage sessions, detect and prevent abuse, and investigate incidents.
- To process payments, referrals and plan changes.
- To communicate with you: service notices, alerts you switched on, support replies, and demo scheduling.
- To keep the software working well: debugging, monitoring and improving reliability. Where we analyse trading data to improve the Service, we use it in aggregate.
- To meet legal obligations.
We do not sell your personal data, rent it, or use it for advertising. We do not make automated decisions about you that have legal or similarly significant effects; the trading the software performs is the execution of rules you configured.
05Legal basis
We process your data under the Nigeria Data Protection Act 2023 and, where it applies to you, the EU and UK General Data Protection Regulation, on these bases:
- Contract — to provide the Service you signed up for.
- Legitimate interests — to secure the Service, prevent fraud and improve reliability, balanced against your rights.
- Consent — for demo requests and optional Telegram alerts. You can withdraw consent at any time.
- Legal obligation — where the law requires us to keep or disclose data.
06How we protect your data
Our security starts from one principle: hold as little power over your account as possible.
- Permission check before storage. Every exchange key is checked against the exchange. Keys with withdrawal or transfer rights are refused and never written to our systems.
- Non-custodial design. We hold no funds and no credentials capable of moving them.
- Encryption at rest. Accepted exchange keys are stored encrypted, never as plain text.
- Passwordless sign-in. You sign in with a one-time link sent to your email. No password exists to be leaked, guessed or reused.
- Session control. You can see every signed-in device and end any session, or all of them.
- Authenticated ingest. Each signal provider uses its own bearer key, and every signal is validated on arrival.
- Restricted access. Access to production systems and data is limited to the people who run the Service.
- Encrypted transport. Traffic between your browser, our servers and the exchange uses TLS.
No system is perfectly secure. You can reduce your own risk by securing the email account you sign in with, never forwarding a sign-in link, enabling two-factor authentication on Bybit, and using a Bybit sub-account for the capital you trade. Revoking your API key on Bybit immediately removes our access to your account.
07Who we share it with
We share data only with the service providers we need to run 0xSignals, and only what each one needs:
- Bybit — API requests made with your key to place and manage your orders.
- Cloud hosting providers — reputable infrastructure providers that host our servers and databases under contractual confidentiality and security obligations.
- Telegram — to read channels you connect, deliver alerts you switch on, and route demo requests to a private internal chat that only our team can see.
- Email — our email provider, to send service messages and support replies.
Third-party signal providers you connect do not receive your personal data from us. We may also disclose data if required by law, to protect our rights or users' safety, or as part of a sale or restructuring of the business, in which case this policy will continue to apply.
08International transfers
Our servers are located outside Nigeria, in other countries. When data moves across borders we rely on the safeguards permitted by the Nigeria Data Protection Act and, where applicable, the GDPR, such as contractual protections with our providers.
09How long we keep it
- Exchange API key — until you remove it or close your account, then deleted.
- Account and trading data — for as long as your account is open, and up to 12 months after closure so disputes and support questions can be resolved, unless you ask us to delete it sooner.
- Payment records — as long as tax and accounting law requires.
- Session and technical logs — up to 90 days, unless needed to investigate an incident.
- Demo requests — up to 12 months if you do not become a subscriber, then deleted.
10Your rights
You can ask us to:
- confirm what data we hold about you and give you a copy;
- correct inaccurate data;
- delete your data or close your account;
- restrict or object to certain processing;
- provide your data in a portable format — trade history can also be exported as CSV from the dashboard at any time; and
- withdraw consent you previously gave.
Email [email protected] from your account email address. We will respond within 30 days. If you are not satisfied, you may complain to the Nigeria Data Protection Commission or the data-protection authority where you live.
11Cookies
The marketing site at 0xsignals.com sets no advertising or tracking cookies. The dashboard uses essential cookies to keep you signed in and protect your session. These are required for the Service to work and are not used for advertising.
12Children
The Service is not for anyone under 18. We do not knowingly collect data from children, and will delete any we discover.
13Security incidents
If a breach affects your personal data in a way that is likely to put you at risk, we will notify you and the relevant authority as required by law, tell you what happened, and tell you what you should do — for example, revoking and replacing your API key.
14Changes and contact
We will post any changes to this policy here and update the effective date. For material changes we will notify you by email or in the dashboard before they take effect.
0xSignals · Lagos, Nigeria · [email protected]