Privacy policy, last updated 12 November 2026
1. The short version
Nydex is run by Thomas Kramer, one person, and he is the one responsible for the data described here. Nydex holds your email address, the settings and trade log you create in the app, and your Alpaca credential (an API key pair or an access token) in encrypted form. It sells nothing, shows no advertising, and runs no analytics or tracking scripts of any kind. You can download everything it holds, and you can delete the account and its contents from Settings at any time.
2. What is stored, and where
Your email address. Sign-in is passwordless: a magic link, or Google. There is no password to store. Google sign-in returns your email address and an account identifier; Nydex asks for nothing else and receives nothing else.
Your settings. Watchlists, saved configurations, strategy thresholds, layout preferences and your trade log are kept as a single record against your account. The trade log holds tickers, share counts, prices, timestamps and profit or loss.
Your tax inputs. The state, filing status and other-income figure you type into the Tax tab are part of that same settings record. They are used only to compute the estimate shown on your screen. They are never sent to a tax authority, a preparer, or anyone else.
Market fact sheets. Shared market fact sheets (prices and filing figures, not tied to you) are stored separately and are not part of your account.
Your Alpaca credential. Either an API key pair you pasted, or, if you connected your account through Alpaca, the access token that connection produced. Both are stored encrypted in the database with a key Nydex does not keep alongside the data, and readable only by your own account. While you are signed in the credential is held in memory for the session and is never written to your browser's storage. If you use Nydex without an account, it stays in your browser and goes nowhere else. Connecting through Alpaca sends nothing to Nydex except the token: your broker password is typed on Alpaca's site and never passes through here.
Billing identifiers. If you subscribe, Nydex stores the Stripe customer and subscription identifiers for your account. Card numbers never reach Nydex. Stripe collects and holds them.
Rate-limit counters. To stop abuse of the backend, Nydex counts requests against a truncated one-way hash of your IP address. The address itself is never stored.
Calendar feed link. If you create a calendar feed (Pro), Nydex stores a one-way hash of its token, not the link itself. The feed lists the tickers on your watchlists, so anyone you give the link to, and the calendar service you add it to, can read those tickers. To build it, Nydex sends each ticker, and nothing about you, to Financial Modeling Prep. The full feed URL, token included, is a web address like any other, so Cloudflare's request logs record it each time your calendar fetches it, and keep it for Cloudflare's log retention period. Regenerating or stopping the link (Settings → Account) ends the old one at once, and deleting your account deletes the hash.
3. Who else sees it
Five companies process data on Nydex's behalf, each for one job, and two more only when they are switched on:
Supabase: the database and the sign-in system, hosted in the United States. Cloudflare: hosting; it answers each request from its data center nearest you, and its servers log requests, which include IP addresses, as any web server does. Those logs hold the full URL of each request, calendar feed links included, for Cloudflare's retention period. Stripe: payments, if you subscribe. Financial Modeling Prep (FMP): earnings dates and estimates; it receives ticker symbols and nothing about you. Alpaca Markets: your broker. Market data and orders go from your browser straight to Alpaca using your own keys, and are governed by your agreement with them, not this one.
Fonts are loaded from Google Fonts, which means Google's servers see the IP address of anyone loading the page.
OpenAI: the default language-model provider, used only if the operator has configured a model key. Asking for a written check on a drift footnote then sends that ticker's fact sheet (market numbers, not your email, keys, or tax inputs) to OpenAI to draft the sentences. Any sentence that states a number the sheet does not hold is discarded. With no model key configured, the request is never made and nothing is sent.
Resend: sends email. Used only if you are on Pro and turn on “Email me matches after the close” on a saved preset. Resend then receives your email address, the names of the presets you opted in, and that day's list of tickers and scores, once each trading day. Turn it off on the preset and nothing more is sent.
Nydex does not sell personal data, does not share it for advertising, and has no advertising or analytics partners to share it with.
4. How long it is kept
Your account data is kept until you delete it. Deleting the account removes your settings, your trade log and your encrypted API keys immediately, cancels any active subscription, and deletes the login itself. It cannot be undone and there is no backup copy to restore from.
Stripe keeps a record of payments it processed, because tax and accounting law requires it. That record sits with Stripe and is not used for anything else.
5. Where it is processed
Nydex's database, sign-in and payments are in the United States, and every processor named above except Cloudflare stores this data there. Cloudflare answers each request from its data center nearest you, which may be outside the United States. If you use Nydex from the UK, the EU or anywhere else, your data is transferred to and processed in the United States. Supabase, Cloudflare and Stripe each publish standard contractual clauses covering that transfer, and Nydex relies on them.
Nydex is offered from the United States and is not marketed to any other country. It is not aimed at anyone in a jurisdiction where offering it would require a registration nobody here holds.
6. Why any of it is held
Your email exists so you can sign in. Your settings and trade log exist so the app can do the thing you asked it to do. Billing identifiers exist so a subscription can be started and stopped. Rate-limit counters exist so one person cannot run the backend into the ground for everyone else, and so the shared market-data key survives.
Under the UK and EU GDPR that is: performance of a contract for the account, the settings and the billing, and legitimate interests for the rate-limit counters and the server logs, to keep a free service standing. Nothing here is used for profiling, automated decision-making with legal effect, or marketing.
7. What you can do
Download your data. Settings → Account → Download my data produces a JSON file of the settings record held against your account: watchlists, configurations, the trade log, and preferences. Broker credentials are deliberately excluded. An export file is the last place one belongs, and Alpaca can always show you yours.
Delete the account. Settings → Account → Delete account. It takes effect at once, with no waiting period and no retention window.
Correct anything. Everything stored is something you typed, and every field is editable in the app.
If you are in the UK, the EU, California or anywhere else with statutory data rights, the two buttons above are the access, portability and erasure rights in working form: no account tier, no fee, no waiting period, and using them never degrades the service you get. To exercise anything they do not cover (objection, restriction, or a correction the app will not let you make yourself), email support@nydex.app and it is done inside 30 days. You can also complain to your data protection authority, or, in California, to the Attorney General.
Nydex does not sell personal information and does not share it for cross-context behavioural advertising, as California defines both terms, and has not in the preceding twelve months. There is nothing for a “do not sell” signal to switch off; Global Privacy Control is honoured by there being no such processing to begin with. Nydex does not collect sensitive personal information beyond your broker API keys, which exist only to talk to your broker.
8. Cookies
Nydex sets no tracking or advertising cookies. Your sign-in session is stored in your browser so you stay signed in; clearing site data signs you out. Your settings and, in local mode, your API keys are kept in your browser’s own storage rather than in a cookie. Nothing here follows you to any other site, so there is no cross-site tracking for a Do Not Track or Global Privacy Control signal to stop. That is the whole of it.
9. Children
Nydex is not for anyone under 18, in line with the terms of use, and accounts are not knowingly created for them.
10. Security, and what happens if it fails
Broker credentials are encrypted at rest and every table is restricted so one account cannot read another. No system is beyond reach, and Nydex is run by one person rather than a security team. Keep your Alpaca keys scoped to what you need, and revoke a key, or the Nydex connection itself, from your Alpaca dashboard if anything looks wrong. That revocation is instant and does not depend on Nydex.
If there is a breach affecting your data, you will be told. Notice goes to the email address on your account without undue delay and, where the law sets a clock (72 hours to a supervisory authority under the UK and EU GDPR, the state deadlines in the US), inside it. It will say what happened, what was reached, and what to do, and the first instruction will be to revoke your broker keys, which you can do without waiting for anyone here.
11. Changes and contact
If this policy changes in a way that affects what is collected or who receives it, the change will be visible here with a new date before it takes effect. Questions, requests and complaints go to support@nydex.app, and reach a person.