Privacy Policy

Last updated: 18 October 2026.

CryptoPro is operated by VibeSoft Studio, KVK 42136303 (info@vibesoftstudio.com) - see the Terms of Service for who operates this service. This policy covers CryptoPro Suite, Charts, Trader and Training, which share one account and one database. It explains what we store, why, and what you can do about it.

What we store

Your account: username, a hashed password (never the password itself), and - only if you switch it on - a two-factor secret. You may add a notification email; it is stored but nothing sends email yet. What you create: watchlists, chart layouts and drawings, settings, your chosen theme and language, course progress and quiz results, and Trader's trading journal and paper-trading state. Broker keys: if you connect Alpaca, your API credentials are encrypted before they are stored. Trader places paper orders only. Patreon, if you link it: your Patreon member ID, your plan, whether your pledge is active, and the date of your next charge, so the suite knows whether you are on Pro. Payments go through Patreon: we do not collect payment card details, and we do not ask for special-category data. Google, if you sign in or connect with it: Google's identifier for your account and the email address Google gives us, so that the next sign-in finds your account. We do not store your name or picture in our own tables, and an account created this way gets a neutral username. Signing in with Google gives us no password, so such an account has none.

Why, and on what legal basis

To provide the account and the features you asked for (performance of a contract), and to keep the account secure - sessions, optional two-factor, and write limits on credential changes (legitimate interest). Google Analytics on cryptoprosuite.com runs only with your consent (see below). We do not profile you, we do not make automated decisions about you, and we do not use your data to train anything.

Cookies and local storage

Three cookies. cpc_session is set only when you sign in. It is HttpOnly, SameSite=Lax, Secure in production, and valid for 30 days or until you sign out. It identifies your session and nothing else - and the same cookie is shared across every CryptoPro Suite app (Charts, Trader, Training), so signing in once signs you in everywhere. cp_patreon_state is set only while you link a Patreon membership on cryptoprosuite.com. It holds a random value that protects that step, has the same flags, and is deleted as soon as linking finishes, or after 10 minutes at the latest. cp_google_flow is set only while you sign in with or connect Google. It holds a random value that ties that step to your browser, has the same flags, and is deleted as soon as the step finishes, or after 10 minutes at the latest. Local storage keeps your own preferences on your device - theme, language, last open tab, watchlists, and in Trader the API keys you entered. No advertising, no tracking pixels and no social media embeds. Charts, Trader and Training use no analytics at all. Fonts and chart libraries are served from our own servers, so opening a page does not tell anyone else that you were here, unless you allow analytics on cryptoprosuite.com.

Analytics on cryptoprosuite.com

This landing site (cryptoprosuite.com, not Charts, Trader or Training) asks before it uses Google Analytics. Only if you click "Allow analytics" does it load Google Analytics 4 from Google. Google then sets the cookies _ga and _ga_NMV97G2X57 on cryptoprosuite.com for up to 13 months and receives the pages you view, your browser and device type, and an approximate location derived from your IP address. We use this only to count visits and see which pages are read. Google's advertising features, ad personalisation and Google signals are switched off. If you click "Reject analytics", or make no choice, Google Analytics is not loaded and nothing is sent to Google. Your choice is kept in your browser's local storage (cp_analytics_consent). You can change it at any time with Cookie settings in the footer; withdrawing deletes the analytics cookies.

Who else processes it

Hosting: Vercel. Database: Supabase. Both process data on our instructions only. If you connect Alpaca, requests go to Alpaca using your own keys. Patreon: if you link your membership, Patreon sends us the membership details listed above; your pledge and payment are handled by Patreon under its own privacy policy. Google sign-in: if you use it, your browser goes to Google, under Google's own privacy policy, through our sign-in provider Supabase. Supabase's sign-in system briefly holds a record for that Google account, with the email address, name and picture Google provides; we delete it as soon as the sign-in finishes, and a daily job removes any that a sign-in left behind. Analytics: Google Ireland Limited, only if you allow it on cryptoprosuite.com; Google may process this data in the United States, under the EU-US Data Privacy Framework. Nothing is sold, rented, or shared for advertising.

How long we keep it

For as long as your account exists. Deleting your account (Account → Danger zone) ends every session immediately and blocks sign-in across the whole suite; the data is then permanently erased after 30 days, including the link to your Google account. Sign-in sessions expire after 30 days on their own. To slow down password guessing, every sign-in, registration and password check is recorded with the IP address it came from (or your username, when you are already signed in) and deleted after one hour.

Your rights

You can ask for access, correction, erasure, restriction, objection, or a portable copy of your data - and you can delete your account yourself at any time, without asking us. Write to info@vibesoftstudio.com for anything else. You also have the right to complain to your national data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens).

Changes

If this policy changes, the date above changes with it. Material changes will be announced in the app.