This Privacy Policy describes how Quat ("we," "us," or "our") collects, uses, and protects information when you use our website and trading console at quat.trade(the "Service").
1. Information we collect
Depending on how you use the Service, we may collect:
- Account information: email address, display name, and password (stored in hashed form)
- Alpaca credentials: API keys you provide, or OAuth tokens when you connect via Alpaca OAuth
- Trading and account data: information retrieved from Alpaca on your behalf, such as positions, orders, balances, and account profile data needed to operate the Service
- Usage data: logs related to sign-in, errors, and security (for example IP address, browser type, and timestamps)
- Optional shared content: data you choose to share publicly through verified P&L or similar features
2. How we use information
We use information to:
- Authenticate you and operate the Service
- Display your account, market data, and trading tools
- Execute actions you request, such as placing or closing orders
- Maintain security, prevent abuse, and troubleshoot issues
- Improve reliability and performance of the Service
We do not sell your personal information. We do not use your data for third-party advertising.
3. How we store and protect data
Alpaca API keys and secrets are stored using encrypted storage (for example AWS Secrets Manager in production). Session tokens are stored in secure, HTTP-only cookies. We use industry-standard measures such as HTTPS, access controls, and least-privilege cloud permissions.
No method of transmission or storage is completely secure. You are responsible for keeping your login and Alpaca credentials confidential.
4. Sharing with third parties
We share information only as needed to run the Service:
- Alpaca Markets: to connect your account, retrieve data, and execute trades you authorize
- Infrastructure providers: such as cloud hosting, databases, and secrets management, under contractual safeguards
- Legal requirements: if required by law or to protect rights, safety, and security
Alpaca's use of your information is governed by Alpaca's own privacy policy and terms.
5. Market data
Market data shown in the Service may be sourced using server-side credentials or your own Alpaca data subscription, depending on your account. Market data is subject to Alpaca and exchange terms; you may not redistribute raw market data except as permitted by those terms.
6. Cookies and sessions
We use essential cookies to keep you signed in and to protect OAuth flows. We do not use third-party advertising cookies. You can clear cookies in your browser, but you may need to sign in again.
7. Data retention
We retain account and credential data while your account is active. If you stop using the Service, we may delete or anonymize data after a reasonable period, except where retention is required for security, legal, or backup purposes.
8. Your choices
You may:
- Revoke Quat's access via Alpaca or by removing stored API keys
- Sign out at any time to end your session
- Contact us to request access, correction, or deletion of account data
9. Children
The Service is not intended for anyone under 18. We do not knowingly collect information from children.
10. International users
The Service is operated from the United States. If you access the Service from other regions, you consent to processing and storage in the U.S. and other locations where our providers operate.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the "Last updated" date. Continued use after changes means you accept the updated policy.
12. Contact
Privacy questions or requests: support@quat.trade