Effective date: 2026-10-09 Version: v1.0.6
Tianyue Consulting L.L.C-FZ ("we", "us") operates the Trading Master mobile app, website and related services (the "Service"). This policy explains what personal data we collect, why, how we use, store, share and delete it, and your rights.
We collect only what is needed to run the Service. The Service contains no advertising SDKs, does not track you across apps or websites, and does not sell personal data.
| Category | What | Source | Purpose |
|---|---|---|---|
| Account | Email, username/nickname, phone number (if provided), country or region, membership tier, preferences (language, currency, notifications) | You | Sign-up and sign-in, verification, profile display, service scope and permissions |
| Credentials | Password (never stored in plain text; passwords set or used to sign in recently are stored as salted hashes, and older formats are upgraded automatically at the next sign-in); session tokens, device identifier and device name; push device token (when notifications are on) | You / generated | Sign-in, staying signed in, managing devices, sending push notifications, security |
| Exchange API credentials | API key, secret and passphrase for OKX, Binance or other exchanges you connect, plus the related account identifier | You | Query your account, place orders and manage positions and protective orders through the exchange API, on your instruction or under automation you switch on |
| Trading data | Balances, positions, orders, fills, protective-order state, P&L, reconciliation records | Exchange / generated | Display your account, execute and reconcile orders, risk control, dispute handling, legal record-keeping |
| AI input | Questions you send to the AI assistant and content you choose to submit for analysis | You | Generate AI answers and market analysis |
| Community content | Avatar, posts, images, comments, likes, favorites, follow/block relationships, reports | You | Community features, moderation and safety |
| Support and notifications | Tickets, messages, verification-code delivery records, notification read state | You / generated | Handle requests, send codes and service notices |
| Security and operational logs | Request time, IP address, errors, audit events | Automatic | Security, troubleshooting, fraud prevention, audit |
We never ask for your exchange login password, and we do not accept API keys with withdrawal permission (see section 4).
Photos: we access only the image you actively pick for an avatar or post.
We do not collect: precise location, health data, or advertising identifiers (IDFA/AAID). We do not read your device's address book; community follow relationships (who follows whom) are stored linked to your account (see "Community content" above). Your country or region is chosen by you.
We will ask for your consent before using data for a purpose not listed here.
We do not sell personal data. We share it only as follows:
| Recipient | What | Why |
|---|---|---|
| Exchanges you connect (OKX, Binance, etc.) | API credentials, trade instructions | Execute your trades; exchanges process data under their own policies |
| Amazon Web Services (Singapore region) | All Service data stored on our servers | Cloud hosting |
| Cloudflare | Network requests (including IP address) | DNS, performance and security |
| Google (Gemini API) | Questions and content you submit to the AI | Generate AI answers. We do not send your API credentials, password or contact details |
| Google (Gmail), email delivery provider | Email address, verification code | Send codes and service notices |
| Apple / Google app stores | Handled under their own policies | App distribution and (if any) in-app purchases |
| Apple Push Notification service (APNs) | Push device token, and the notification title, body, ID and category | Deliver notifications to your device |
| Authorities | Data required by law | Legal compliance, court orders, regulatory requests |
In a merger, acquisition or asset transfer, we will require the recipient to keep honouring this policy or ask for your consent again.
Our servers are in Singapore (AWS ap-southeast-1); the AI service is provided by Google; exchanges operate from their own locations. Your data may therefore be processed outside your country or region. Our contracts with these providers require them to protect your data to a standard no lower than this policy and to process it only as needed to provide their services.
| Data | Retention |
|---|---|
| Account, profile, community content, sessions and devices | While your account exists; deleted on account deletion |
| Exchange API credentials | Until you disconnect the exchange or delete your account |
| Orders, fills, protective-order and reconciliation records | 5 years for disputes, audit and legal obligations; not deleted with ordinary profile data |
| Security logs | Kept as rolling, size-limited logs; the oldest entries are overwritten once the size limit is reached |
| Backups | Rolling 30 days; until expiry a backup may still contain deleted data |
| Deletion receipts | Only an irreversible token hash, a non-reusable user ID and the completion time, to stop deleted data from being recreated |
Depending on applicable law, you may: access and obtain a copy; correct; delete; withdraw consent; restrict or object to processing; data portability; delete your account; ask for an explanation of automated decisions (such as automated trading rules); and complain to a supervisory authority. Contact tianyueconsult@gmail.com; we reply within 30 days. We may verify your identity first to protect your account.
HTTPS for all traffic; hashed passwords (older formats are upgraded to salted hashes at the next sign-in); encrypted, isolated API-credential storage; server-side storage of session-token digests only; audit logging of administrator actions; minimal open ports and snapshot backups. No system is perfectly secure. If a personal-data breach occurs, we will notify you and regulators as the law requires.
The Service is only for users aged 18 or older (or the age of majority where you live, whichever is higher) with full legal capacity. We do not knowingly collect data from minors and will delete it if found.
The app stores on your device: the sign-in token (iOS Keychain), the account name if you choose "remember account", preferences such as language, and avatar and unsent-content caches. It does not store your password.
We will show material changes prominently in the app and ask for consent again where required. We keep every version and a record of which version you accepted and when.
This policy is governed by the laws of the Dubai International Financial Centre (DIFC).