QWQ ("Company," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, and what choices you have. It applies to all users of qwqco.com and our related services (the "Service").

By using the Service, you consent to the data practices described in this policy. If you do not agree, please do not use the Service.

Information We Collect

We collect the minimum information necessary to provide and improve the Service. The categories of data we collect include:

Information you provide directly:

• Account information — your email address, display name, and password (stored as a salted hash, never in plain text).
• Trading preferences — your selected watchlist tickers, risk tolerance settings, preferred strategy configurations, and notification preferences.
• Communications — messages you send to our support team, feedback, and survey responses.
• Referral information — if you participate in our referral program, we record referral codes and associated email addresses.

Information collected automatically:

• Hashed IP address — we hash your IP address upon collection. We do not store raw, identifiable IP addresses. The hash is used solely for security purposes (fraud detection, rate limiting).
• Browser and device information — browser type, operating system, device type, screen resolution, and language preference.
• Usage data — pages visited, features used, time spent on pages, click patterns, and referral URLs.
• Cookies and similar technologies — see Section 6 below.

Information We Do NOT Collect

We believe in data minimization. The following sensitive information is never collected, stored, or processed by QWQ:

• Raw IP addresses — all IP addresses are hashed immediately upon receipt.
• Credit card numbers or payment details — all payment processing is handled exclusively by Stripe. Your full card number, CVV, and billing address are transmitted directly to Stripe and never pass through or are stored on QWQ servers.
• Social Security Numbers (SSN) or government-issued identification numbers.
• Brokerage account passwords or credentials — if you connect an Interactive Brokers account, authentication is handled through IBKR's official OAuth flow. We receive only an authorized access token, never your username or password.
• Bank account numbers or routing numbers.
• Biometric data — fingerprints, facial recognition data, or voice prints.

How We Use Your Information

We use the information we collect for the following purposes:

We do not sell your personal information to third parties. We do not use your data for purposes unrelated to the Service without your explicit consent.

Third-Party Service Providers

We share limited information with trusted third-party providers who help us operate the Service. Each provider receives only the minimum data necessary to perform their function:

• Stripe (stripe.com) — Payment processing. Receives your email and payment information directly. Stripe is PCI DSS Level 1 certified. See Stripe's Privacy Policy.
• SendGrid (sendgrid.com) — Email delivery for transactional and marketing emails. Receives your email address. See Twilio/SendGrid Privacy Policy.
• Cloudflare (cloudflare.com) — CDN, DDoS protection, and DNS services. May process IP addresses and request metadata in transit. See Cloudflare's Privacy Policy.
• Interactive Brokers (interactivebrokers.com) — Brokerage connectivity for automated trading features. If you choose to connect your account, IBKR receives authentication tokens. QWQ may receive read-only portfolio data (positions, balances) as authorized by you. See IBKR's Privacy Policy.

We require all third-party providers to maintain appropriate security measures and to use your data only for the purposes for which it was shared.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account data — retained for the duration of your account plus 30 days after deletion request to allow for account recovery.
• Trading preferences and journal entries — retained for the duration of your account. Deleted upon account deletion.
• Usage and analytics data — retained in anonymized/aggregated form for up to 24 months for service improvement.
• Payment records — retained for 7 years as required by tax and financial regulations.
• Support communications — retained for 2 years after the last interaction.
• Security logs (hashed IPs) — retained for 90 days, then automatically purged.

When data is no longer needed, it is securely deleted or irreversibly anonymized.

Cookies and Tracking Technologies

We use a minimal set of cookies to operate the Service:

• Essential cookies — required for authentication, session management, and security. These cannot be disabled without breaking core functionality.
• Preference cookies — remember your settings (e.g., dark mode, dashboard layout). These are optional.
• Analytics cookies — help us understand how users interact with the Service so we can improve it. These are optional and can be declined via our cookie banner.

We do not use advertising cookies or tracking pixels from ad networks. We do not participate in cross-site tracking or retargeting programs.

You can manage cookie preferences through your browser settings or through the cookie consent banner displayed on your first visit. Disabling essential cookies may impair the functionality of the Service.

Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right to access — you may request a copy of the personal data we hold about you. We will provide this in a commonly used, machine-readable format within 30 days.
• Right to deletion — you may request that we delete your personal data. Upon receiving a verified request, we will delete your data within 30 days, except where retention is required by law.
• Right to data portability (export) — you may request an export of your data (trading journal, preferences, account info) in JSON or CSV format.
• Right to correction — you may request correction of inaccurate personal data.
• Right to opt out of marketing — you may unsubscribe from marketing emails at any time by clicking the "unsubscribe" link in any email or by updating your notification settings. Transactional emails (receipts, security alerts) cannot be opted out of while your account is active.
• Right to restrict processing — in certain circumstances, you may request that we limit how we use your data.
• Right to object — you may object to our processing of your data for certain purposes.

To exercise any of these rights, contact us at privacy@qwqco.com. We will respond within 30 days. We may need to verify your identity before processing certain requests.

California residents (CCPA): You have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information. To submit a request, email privacy@qwqco.com.

EU/EEA residents (GDPR): The legal bases for our processing of your personal data are: (a) your consent, (b) performance of a contract (providing the Service), and (c) our legitimate interests (security, service improvement). You may withdraw consent at any time. You have the right to lodge a complaint with your local data protection authority.

Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age. Options trading requires legal adult status, and by using the Service you represent that you are at least 18 years old.

If we become aware that we have inadvertently collected personal data from a person under 18, we will take immediate steps to delete that information. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@qwqco.com.

Security Measures

We implement industry-standard security measures to protect your personal data, including:

• Encryption in transit — all data transmitted between your browser and our servers is encrypted using TLS 1.3.
• Encryption at rest — sensitive data stored in our databases is encrypted using AES-256.
• Password hashing — passwords are hashed using bcrypt with unique salts. We never store passwords in plain text.
• Access controls — access to user data is restricted to authorized personnel on a need-to-know basis.
• Infrastructure security — our servers are protected by firewalls, intrusion detection systems, and DDoS mitigation (Cloudflare).
• Regular security audits — we conduct periodic security reviews and vulnerability assessments.
• IP hashing — IP addresses are hashed immediately upon receipt and never stored in raw form.

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but will notify affected users promptly in the event of a data breach, as required by applicable law.

International Data Transfers

QWQ primarily processes data in the United States. If you access the Service from outside the United States, your data may be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

By using the Service, you consent to the transfer of your data to the United States. Where required by law (e.g., GDPR), we ensure appropriate safeguards are in place for international data transfers.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify you via email or through a prominent notice within the Service.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

Questions About This Policy

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Privacy inquiries: privacy@qwqco.com
General support: support@qwqco.com
Website: qwqco.com