Nefarious Copytrading Privacy Policy

Controller: Nefarious Digital (Nefarious). Email: Business@nefarious.trading.

The wider site and community are described in the site Privacy Policy. This Policy is only about the copytrading process.

This Policy applies when:

• you are an operator who connected a cTrader account so this process can send orders;
• you host the stack or can read its data volume;
• you posted any message in the one signal channel the process is configured to poll, including a message that does not match a trade card.

It does not apply as a consumer signup. Ordinary Discord members are not end users of this application. We do not ask them for broker credentials, and we do not build a public profile of them from this bot.

A. Operator account information and credentials

To talk to cTrader (Spotware Open API), the host holds the operators’ application credentials and OAuth tokens (client id, client secret, access token, refresh token, account id, host type). Refreshed tokens are written to a local tokens.json on the data volume so a container rebuild does not kill trading.

Those values are secrets for the people who already operate the live or demo account. They are not collected from the public. They are not Discord passwords. They are not printed on this site and must not be committed to git.

B. Discord signal copies (limited)

The process stores enough of the watched channel to avoid double-entering a card and to debug fills:

• state.json — last Discord message id, a rolling list of up to 2000 processed message ids, and open-signal fields (pair, side, prices).
• trades.json — append-only operational events (parsed signal fields, update text, execution metadata, errors). Unmatched messages may log the first ~200 characters plus embed titles.
• Discord channel ids and the bot token on the host (operator secret; not published here).
• Manual fallback requests include the selected source message or manually supplied embed title/text. Permission and channel metadata are checked before a private preview and confirmation. Confirmed processing records the administrator's Discord user ID, source message ID and whether text was supplied manually. The preview expires after 90 seconds; pending requests are held in a bounded in-memory queue and source age is checked again before processing.

That is a limited operational copy of analyst cards and operator logs — not a server-wide message archive and not a public user table.

Discord message responses also contain author and message metadata while being processed. The parser has no author allowlist or per-user exclusion. Restricting the channel does not mean every message received is a trade signal. Application output and hosting logs may also contain operational excerpts and errors.

C. Data this tool does not require

• Member email lists, billing records, or a consumer account for this bot.
• Other members’ broker logins or API keys (we do not collect them).
• DM content, presence or a full guild member roster. Interaction-provided administrator permission is checked.
• A server-wide message archive; diagnostic excerpts from the watched channel are described above.

• Public end-user signup data — this is not a public product.
• Payment cards, government ids, or health data.
• Presence, online status, devices, or streaming activity.
• Voice audio.
• Message text for advertising, resale, or AI/ML training.

• Message Content: used. The REST poller reads trade embed titles and descriptions from one configured signal channel. These contain pair, order, entry, stop and target values needed for the connected operator account. Message Content restrictions apply to REST responses, including embeds, subject to Discord’s documented exceptions. It does not poll other channels or DMs. All messages in the watched channel are examined; unmatched messages can leave a 200-character diagnostic excerpt.
• Server Members: not used. The process never lists members, assigns roles, welcomes joins, or reads nicknames. It does not open a Gateway connection with Server Members.
• Presence: not used. The process never reads online, idle, DND, device, or streaming status.

Paste-ready Discord form answers: /legal/nefarious-copytrading/intents. Server-wide matrix: /legal/intents.

• Run the operators’ copy process (parse cards, send orders, move stops, cancel pendings).
• Deduplicate signals after a restart.
• Operator diagnostics in the on-disk event log and private interaction responses. Automatic log-channel posting was disabled at the October 26 check.
• Respond to deletion, security, or legal requests.

We do not use this data to train machine-learning or AI models, advertise to the public, or sell a data product.

• trades.json: events accumulate until manually removed; the reviewed implementation has no automatic age-based deletion and records can remain longer than 30 days.
• state.json: last 2000 processed message ids and current open signals, while the process is operated.
• cTrader tokens: until operators rotate them or retire the stack.
• Discord bot token / env: while the stack is operated, then removed.
• Manual requests: preview and queue payloads are temporary in-memory data. Once processed, parsed fields and the administrator/source-ID audit event follow the event-log retention above; the 90-second preview expiry and five-minute source limit do not delete those records.

Hosting logs and backups, where maintained, have separate retention settings. This review has not established an automatic deletion schedule for them. Deleting a Discord source message does not automatically erase a stored event. Contact us about records that are no longer needed.

Access is limited to operators — people who can reach the host volume that mounts nefarious-copytrading data, plus anyone they authorize to read the private log channel. Ordinary members cannot list trades.json, cannot see tokens, and cannot run the bot.

Hosting staff who administer that machine can technically read those files. We do not share them with advertisers, data brokers, or other Discord communities.

We do not sell Discord data, signal copies, or trading credentials, and we do not share them with data brokers or advertisers.

We disclose information only:

• To Discord, as needed to read the signal channel and respond to administrator interactions. Automatic log-channel posting is currently disabled.
• To Spotware / the broker, as needed to authenticate and send orders on the operators’ account.
• To operators and hosting providers that run the process.
• If required by law, to defend a legal claim, or to stop abuse.

Tokens and event files are written to operator-controlled storage. The application stores these as JSON and does not itself encrypt the file contents. The October 25 storage check found the app data dataset unencrypted. The October 26 interaction deployment preserved the data mount and did not fix encryption or backup protections. Access must be restricted to authorized operators.

A host compromise could expose broker tokens and the event log. That is one reason this application is not a public product and why we do not publish keys here.

Email Business@nefarious.trading with “Nefarious Copytrading deletion” in the subject and include:

• your Discord user id (if the request is about a signal message you posted);
• a message link or approximate time, if you want a specific event purged from trades.json;
• if you are an operator, which secrets you want rotated (we will not email secrets back).

We may ask for enough information to verify your relationship to the records. We will respond to access, correction and deletion requests under applicable law, and explain any information retained for a legal obligation or legitimate dispute. Broker records, Discord originals and independently held copies are subject to those services or holders. Do not send account passwords or tokens.

There is no automated per-user opt-out. Ask us to stop collection or change the watched channel. Operators can stop the process or remove its channel access. Avoiding new posts does not remove existing copies. Admin-only operation does not remove a poster’s privacy rights.

If you are in the EEA, UK, or a U.S. state with a comprehensive privacy law, you may also ask for access, correction, or a portable copy of personal data we hold about you in this process’s files. We will not discriminate against you for asking. You may complain to your local supervisory authority.

This internal trading tool is intended for authorized adult operators who satisfy their broker’s eligibility requirements. Discord users must meet Discord’s minimum age for their country. If you believe we stored a child’s data, contact Business@nefarious.trading and we will delete what we have.

We will post updates at this URL and change the “Last updated” date. Material changes to the data processed, purposes or recipients will be reflected here and communicated as applicable law requires.