Quawd Privacy Policy

Version: 0.3 Last updated: 2026-05-08

---

This Privacy Policy describes how Quawd, Inc. ("Quawd", "we", "us") collects, uses, shares, and protects information about you in connection with the Quawd Platform (the "Service"). It applies to information collected through the Service, our website at quawd.bot, and any related applications. By using the Service you acknowledge that you have read this Policy.

1. Information We Collect

1.1 Information you provide directly

• Account information. Email address, password (stored hashed), display name, and any other profile information you submit.
• Authentication tokens. When you sign in with a third-party identity provider (for example, Google), we receive the basic profile information that provider returns to us, but not your password.
• Brokerage credentials. If you connect a brokerage account, you submit API credentials. These credentials are stored encrypted in Google Cloud Secret Manager and are never logged or displayed in plaintext after submission.
• Strategies and User Content. Any Strategies, configuration data, notes, prompts to Quawd Bot, and similar content you submit to the Service.
• Payment information. If you subscribe to a paid plan, our payment processor (Stripe, Inc.) collects payment-card information directly. Quawd receives a token and limited metadata (last four digits, card brand, expiration); we do not store full card numbers.
• Support communications. Information you provide when you contact us for support.

1.2 Information collected automatically

• Usage data. Pages and features you access, actions you take, request timestamps, and similar telemetry.
• Device and connection information. IP address, browser type and version, operating system, device identifiers, and referring pages.
• Cookies and similar technologies. We use cookies for authentication, session management, preferences, and analytics. You can control cookies through your browser settings; disabling them may impair functionality of the Service.

1.3 Information from third parties

• Brokerage activity. When you connect a brokerage, we receive account information and order/position data from that brokerage's API to the extent of the permissions you grant.
• Market data. We receive market data from third-party providers to support backtesting, paper-trading, and live execution.
• Identity verification. If we are required to verify your identity (for compliance or fraud prevention), we may receive verification information from third-party providers.

2. How We Use Information

We use the information we collect to:

• provide, operate, and maintain the Service, including running the Strategies you build;
• authenticate you and secure your Account;
• process transactions and bill subscriptions;
• communicate with you about the Service, including sending transactional notices, updates, and support responses;
• comply with legal obligations, respond to lawful requests, and enforce our Terms;
• detect, investigate, and prevent fraud, abuse, or violations of our Terms;
• improve the reliability, security, usability, and system performance of the Service through aggregated and de-identified analytics;
• record and retain consent and audit information as described in our Terms; and
• with your consent where required, send marketing communications. You may opt out of marketing communications at any time using the "unsubscribe" link in any marketing email.

We do not sell your personal information. Quawd does not use brokerage activity, Strategies, or trading history for targeted advertising.

2.1 AI inference and model training

Inputs you submit to Quawd Bot (including prompts, Strategies, and configuration data) may be processed by third-party AI providers (see Section 3.1) for inference purposes — that is, to generate responses back to you within the Service.

Quawd does not use your Strategies, prompts, or other User Content to train generalized AI models. Inputs sent to third-party AI providers are governed by those providers' API terms; under Anthropic's API terms, customer inputs and outputs are not used to train Anthropic's generally available models. We do not separately train any Quawd model on your User Content.

3. How We Share Information

We share information only as described below.

3.1 Service providers

We share information with third-party service providers that operate the Service on our behalf, under contractual obligations to use the information only for the purposes we direct. Current providers include:

• Google Cloud Platform — hosting, storage (Firestore), and authentication (Firebase).
• Stripe, Inc. — payment processing.
• Anthropic, PBC — language-model inference for Quawd Bot.
• Sentry / equivalent — error reporting and observability.
• Brokerages and exchanges — for users who connect a brokerage, Quawd transmits orders and reads account state via the brokerage's API.

3.2 Business transfers

If Quawd is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction.

3.3 Legal and safety

We may disclose information when we believe in good faith that disclosure is required by law or legal process, or is necessary to protect the rights, property, or safety of Quawd, our users, or the public.

3.4 With your consent

We may share information for any other purpose disclosed to you with your consent.

4. Data Retention

We retain personal information for as long as your Account is active and as needed to provide the Service. After Account deletion, we retain certain information as required for legal, regulatory, accounting, or audit purposes, including:

• Consent records (acknowledgments of disclaimers): retained as immutable audit records. Identifiers may be hashed (irreversibly) after Account deletion to reduce identifiability while preserving evidentiary value.
• Transaction and billing records: as required by tax and financial regulations.
• Logs: typically up to 18 months, then deleted or aggregated.
• Support requests: messages submitted through the contact form on /support are retained for 24 months to support follow-up on long-lived issues, then deleted.

When information is no longer needed for any of these purposes it is deleted or de-identified.

5. Security

Quawd implements technical and organizational measures designed to protect personal information from unauthorized access, alteration, disclosure, or destruction. These include encryption in transit (TLS), encryption at rest, hardened access controls, secret management for sensitive credentials (Google Cloud Secret Manager), audit logging, and regular review of our security posture. No system is perfectly secure. You are responsible for maintaining the confidentiality of your Account credentials.

Quawd will provide notice of material security incidents affecting your personal information as required by applicable law, using the contact information associated with your Account.

6. Your Rights and Choices

Depending on your jurisdiction, you may have rights to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete information, subject to the retention exceptions in Section 4.
• Port your information to another service in a structured, machine-readable format.
• Restrict or object to certain processing.
• Withdraw consent to processing that relies on your consent.

To exercise these rights, email us at david@quawd.bot. We will respond within the timeframes required by applicable law. We may need to verify your identity before fulfilling certain requests.

6.1 California residents (CCPA/CPRA)

California residents have additional rights, including the right to know what categories of personal information we have collected, the right to non-discrimination for exercising privacy rights, and the right to opt out of any "sale" or "sharing" of personal information as those terms are defined under California law. We do not sell or share personal information as those terms are used in the CCPA/CPRA.

6.2 European Economic Area, United Kingdom, and Switzerland

Where the GDPR or UK GDPR applies, our legal bases for processing are: performance of a contract (providing the Service), legal obligation (retaining records), our legitimate interests (security, fraud prevention, product improvement), and your consent (for marketing or other optional uses). You have the right to lodge a complaint with your local supervisory authority.

7. International Data Transfers

Quawd is based in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. Where required, we use appropriate safeguards (such as standard contractual clauses) for international transfers.

8. Children

The Service is not directed to children under thirteen (13), and we do not knowingly collect personal information from children under thirteen. If you believe we have collected information from a child under thirteen, please contact us and we will delete it.

9. Cookies and Tracking

We use first-party and third-party cookies for the purposes described in Section 1.2. We do not currently use cookies for cross-site behavioral advertising. We honor "Do Not Track" signals where required by applicable law; otherwise, our cookie behavior is controlled through your browser.

10. Third-Party Sites

The Service may contain links to third-party sites (including your brokerage). This Policy does not apply to those sites. We encourage you to review their privacy policies before providing them information.

11. Changes to This Policy

We may update this Policy from time to time. The "Last updated" date above will reflect the most recent revision. For material changes, we will provide reasonable notice (for example, by in-product banner or email).

12. Contact

Privacy questions or requests: Email: david@quawd.bot

---

End of Privacy Policy.