Privacy Policy

Keel collects the minimum needed to provide the Service:

• Bitget API credentials - your API key and secret, used to authenticate requests to Bitget on your behalf. Stored AES-256 encrypted. Never stored in plaintext.
• Trade history - up to 90 days of your Bitget spot and futures fills, fetched on account connect and refreshed in the background.
• Behavioral profile - the bias scores and patterns derived from your trade history. This is computed on our server, not your device.
• Intervention history - records of when Keel flagged a pattern and whether you accepted or overrode the intervention.
• Session token - a short-lived JWT (24-hour expiry) stored in your browser's localStorage. Used to authenticate subsequent requests. Not a cookie.

We do not collect your name, address, government ID, payment information, or any data beyond what is listed above.

Your data is used solely to operate and improve the Service:

• Fetching your trade history from Bitget to build your behavioral profile
• Detecting live trading patterns via WebSocket to fire real-time interventions
• Generating your weekly behavioral report
• Calculating your discipline score from intervention outcomes
• Improving Keel's pattern detection models (on aggregated, anonymized data only)

We do not use your data for advertising, do not build advertising profiles, and do not sell or rent your data to any third party.

Your Bitget API key and secret are encrypted with AES-256 before being written to the database. The encryption key is stored separately from the database and is not accessible to the application at rest - it is only used at query time to decrypt credentials for a specific request.

Credentials are never included in server logs, never returned in API responses after submission, and never transmitted to any party other than Bitget's own API endpoints.

Keel uses a small number of third-party services to operate:

• Supabase (PostgreSQL) - hosts the database that stores your encrypted credentials, trade cache, and behavioral profile. Data is stored in the EU-West (Ireland) region.
• Upstash (Redis) - session caching and rate limiting. Stores short-lived session state, not trade data or credentials.
• OpenRouter (AI inference) - used to route behavioral analysis prompts to the AI model that generates your profile. Trade data sent to OpenRouter is used only for that inference call and is subject to OpenRouter's data handling policy. No persistent storage by OpenRouter.
• Railway (hosting) - the backend API server runs on Railway. Your data transits Railway's infrastructure but is not stored there.
• Vercel (frontend hosting) - the Next.js frontend is served from Vercel's CDN. Vercel receives standard HTTP request metadata (IP, user agent) for each page load; no application data is stored there.

We do not use Google Analytics, Meta Pixel, or any behavioral tracking SDK.

Your data is retained for as long as your account is active. When you delete your account (Settings → Danger Zone), the following are permanently deleted:

• Your encrypted API credentials
• Your trade history cache
• Your behavioral profile and bias scores
• Your intervention history
• Your session token

Deletion is immediate and irreversible. We do not retain backups of user data after account deletion beyond the standard 30-day database backup window, after which the data is overwritten.

Regardless of where you live, you have the right to:

• Access - request a copy of the data Keel holds about you
• Correction - ask us to correct inaccurate data
• Deletion - delete your account and all associated data at any time
• Portability - request an export of your behavioral profile and trade history in JSON format
• Objection - object to specific processing of your data by contacting us

To exercise any of these rights, email privacy@getkeel.xyz. We'll respond within 30 days.

If you are located in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR). The lawful basis for our processing of your data is:

• Contract performance - processing your trade data to provide the behavioral coaching service you signed up for
• Legitimate interests - improving pattern detection accuracy on aggregated, anonymized data

Data may be transferred to and processed in the United States (Railway, OpenRouter infrastructure). We rely on standard contractual clauses for such transfers where applicable.

We take security seriously - it's at the core of the product, not an afterthought:

• API credentials encrypted at rest with AES-256
• All data in transit over TLS 1.2+
• Session tokens expire after 24 hours
• Backend API validates JWT on every authenticated request
• No plaintext credentials in logs or error messages

If you discover a security issue, please disclose it responsibly to security@getkeel.xyz.

Keel is not intended for use by anyone under the age of 18. Crypto trading is generally restricted to adults by law in most jurisdictions. If you believe a minor has created an account, please contact us and we will delete it.

We'll update this policy when things change. Material changes will be highlighted at the top of this page. The "Last updated" date above reflects the current version. Continued use of the Service after changes constitutes acceptance of the updated policy.

Privacy questions go to privacy@getkeel.xyz. General questions go to hello@getkeel.xyz.