Privacy Policy.

1. Who we are

The platform at tradingwizard.ai is run by @ Odero AB (org. no. 559241-0871), a Swedish company that trades as TradingWizard AI. That company is the data controller: it decides how the data described here is used. You can reach us at hi@tradingwizard.ai, or by post at Anckargripsgatan 3, 211 19 Malmö, Sweden. Our Terms of Service are governed by Swedish law.

2. What we collect

• Your account: email address, and a display name if you give one. If you sign in with Apple, Google or Discord, we receive the email address that provider releases to us and nothing more.
• How you prove it is you: a hashed password, passkey credentials, and two-factor secrets if you turn them on.
• What you build: your bots and their settings, watchlists, alerts, saved chart drawings and workspace layouts.
• What your bots do: every paper trade, every scan a bot ran and the reasoning it recorded.
• What you ask Wiz: your chat messages and the answers, kept so you can come back to a conversation.
• Charts you submit: images you upload for analysis in the terminal, and the analysis written about them.
• Exchange keys, if you connect one: see the section on security below, which says exactly what is encrypted and what is not.
• How you got here and how you use the site: IP address, browser and device, pages visited, features used, and the referral or campaign link that brought you.
• Billing: handled by Stripe on the web and by Apple on iOS. Your card number never reaches our servers.

3. What we do with it

• Run the product: scan the markets you chose, write the analysis, and show you what your bots found.
• Keep your account yours, and keep other people out of it.
• Take payment and manage your subscription.
• Send you the emails an account needs, such as verification, password resets and receipts, and the alerts you switched on.
• Find and fix faults, and measure which parts of the product people actually use.
• Measure our advertising, so we know which campaigns bring people here.

We do not sell, rent or trade your personal data.

4. Who we send it to

These are the companies that handle your data so the product can work. Each one gets only what its job needs.

Several of these are based in the United States, so using the product means your data is processed there as well as in Europe.

5. Wiz inside your own AI (MCP)

You can connect Wiz to an AI client such as Claude or ChatGPT. Anonymous tools work without an account and return only public market information. Anything about your own account needs you to sign in and grant access, and the connected client then receives only the result of a tool you asked for, which depending on the tool can include your plan, your bots, your paper trades, your alerts and your watchlists. Access tokens are never included in tool results. You can disconnect Wiz in the AI client, or revoke it from Settings → Wiz (MCP).

6. Cookies, analytics and advertising

The full list of cookies, what each one is for and how long it lasts is in the Cookie Policy. The part that matters most is which tools wait for your consent and which do not, so it is stated here too.

• Wait for your consent: PostHog analytics, and the Meta Pixel. Neither loads at all until you accept the matching category in the banner.
• Load on every visit: Google Tag Manager, Google Analytics and Google Ads, which start in Google's denied-by-default consent mode and only begin storing and sending identifiers once you accept. Also datafa.st and Vercel traffic counting, the OneSignal notification tool, and Sentry error reporting, which run whatever you choose.
• Always on, because the site needs them: the sign-in session cookies, and a 30-day cookie recording the referral or campaign link that brought you here.

We keep a record of the answer you give the banner: the two choices, when you gave them, and the country your request came from. Signed in, it is stored against your account. Signed out it is anonymous, and it holds no address and nothing that identifies your browser. We keep it so we can show that you were asked, and so we can see how many people say no.

Signed in, you can also switch product analytics off entirely in Settings, under Data and Privacy. That is separate from the cookie banner and it stops PostHog and datafa.st receiving anything about you.

7. Security, and its limits

• Passwords are hashed with bcrypt. We cannot read them.
• Exchange API secrets are encrypted with AES-256-GCM before they are stored. The API key they belong to is stored as you typed it, because it is the public half of the pair. Neither is ever sent back to a browser.
• We ask you for a read-only key when you connect an exchange, and the connect screen says so. We do not check the permissions on the key you paste, so please do not paste one that can withdraw.
• Everything travels over TLS, with HSTS enforced.
• Administrative access is limited to one account.

No system is completely secure, and we cannot promise otherwise.

8. How long we keep it

Billing records are kept by Stripe and by Apple for as long as accounting law requires, which is longer than your account lives.

9. Your rights

You can ask us to:

• Show you what we hold about you.
• Correct anything that is wrong.
• Delete your account and its data.
• Hand it over in a file you can take elsewhere.

Two of these you can do yourself, immediately, in Settings under Data and Privacy. Export downloads a JSON file of your account, and it is capped at your most recent 1,000 trades, 500 chart analyses, 500 notifications and 500 chat sessions, with the caps written into the file so you can see what was left out. Delete account cancels your subscription and then removes your account together with your trades, bots, chart analyses, chats, notifications, watchlists, alerts, journals, research reports, portfolio, referral earnings, email log and usage records.

Deleting your account does not reach everything. Wiz conversation transcripts, saved chart drawings, workspace layouts, trade proposals and setup receipts, per-day account summaries, news digests, bot votes, any cancellation feedback you wrote, marketing send records keyed to your email address, broker order records, and error reports mentioning your account are not removed by that button. Email hi@tradingwizard.ai and we will delete those by hand. We are working on making the button do all of it.

For anything else, email hi@tradingwizard.ai and we will answer within 30 days. If you are in the EU or the UK and you are not satisfied with how we handled it, you can complain to your national data protection authority. In Sweden that is IMY, imy.se.

10. Children

TradingWizard is not for anyone under 18. We do not knowingly collect data from minors, and we delete such an account as soon as we learn of it. If you believe a minor has signed up, write to hi@tradingwizard.ai.

11. Changes

When this policy changes we update the date at the top of this page. If a change materially affects what we do with your data, we will tell you before it takes effect rather than leaving you to notice a date.

12. Contact

hi@tradingwizard.ai