Nefarious Copytrading Privacy Policy

Controller: Nefarious Digital (Nefarious). Email: Business@nefarious.trading.

The wider site and community are described in the site Privacy Policy. This Policy is only about the copytrading process.

This Policy applies when:

• you are an operator who connected a cTrader account so this process can send orders;
• you host the stack or can read its data volume;
• you posted a matching trade embed in the one signal channel the process is configured to poll (typically the analyst card, not ordinary member chat).

It does not apply as a consumer signup. Ordinary Discord members are not end users of this application. We do not ask them for broker credentials, and we do not build a public profile of them from this bot.

A. Trading credentials (operator secrets — not end-user data)

To talk to cTrader (Spotware Open API), the host holds the operators’ application credentials and OAuth tokens (client id, client secret, access token, refresh token, account id, host type). Refreshed tokens are written to a local tokens.json on the data volume so a container rebuild does not kill trading.

Those values are secrets for the people who already operate the live or demo account. They are not collected from the public. They are not Discord passwords. They are not printed on this site and must not be committed to git.

B. Discord signal copies (limited)

The process stores enough of the watched channel to avoid double-entering a card and to debug fills:

• state.json — last Discord message id, a rolling list of up to 2000 processed message ids, and open-signal fields (pair, side, prices).
• trades.json — append-only operational events (parsed signal fields, update text, execution metadata, errors). Unmatched messages may log the first ~200 characters plus embed titles.
• Discord channel ids and the bot token on the host (operator secret; not published here).

That is a limited operational copy of analyst cards and operator logs — not a server-wide message archive and not a public user table.

C. What we do not store as “public user data”

• Member email lists, billing records, or a consumer account for this bot.
• Other members’ broker logins or API keys (we do not collect them).
• DMs, presence, roles, or a guild member roster.
• A searchable archive of ordinary Discord chat.

• Public end-user signup data — this is not a public product.
• Payment cards, government ids, or health data.
• Presence, online status, devices, or streaming activity.
• Voice audio.
• Message text for advertising, resale, or AI/ML training.

• Message Content: used. Limited use: the process polls GET /channels/{id}/messages on one operator-configured signal channel and must read embed titles and descriptions (Pair, Order, Entry, SL, TPs) so it can copy those signals to the operators’ cTrader account. Discord blanks those fields without Message Content. There are no prefix or slash commands. The bot does not scan the rest of the server, DMs, or ordinary chat.
• Server Members: not used. The process never lists members, assigns roles, welcomes joins, or reads nicknames. It does not open a Gateway connection with Server Members.
• Presence: not used. The process never reads online, idle, DND, device, or streaming status.

Paste-ready Discord form answers: /legal/nefarious-copytrading/intents. Server-wide matrix: /legal/intents.

• Run the operators’ copy process (parse cards, send orders, move stops, cancel pendings).
• Deduplicate signals after a restart.
• Operator diagnostics in the private log channel and on-disk event log.
• Respond to deletion, security, or legal requests.

We do not use this data to advertise to the public, to train a public model, or to sell a data product.

• trades.json: append-only in the running code — not limited to 30 days. Answer Discord’s “30 days or less?” question No.
• state.json: last 2000 processed message ids and current open signals, while the process is operated.
• cTrader tokens: until operators rotate them or retire the stack.
• Discord bot token / env: while the stack is operated, then removed.

Access is limited to operators — people who can reach the host volume that mounts nefarious-copytrading data, plus anyone they authorize to read the private log channel. Ordinary members cannot list trades.json, cannot see tokens, and cannot run the bot.

Hosting staff who administer that machine can technically read those files. We do not share them with advertisers, data brokers, or other Discord communities.

We do not sell Discord data, signal copies, or trading credentials, and we do not share them with data brokers or advertisers.

We disclose information only:

• To Discord, as needed to read the signal channel and write the log channel.
• To Spotware / the broker, as needed to authenticate and send orders on the operators’ account.
• To operators and hosting providers that run the process.
• If required by law, to defend a legal claim, or to stop abuse.

Tokens and event files sit on operator-controlled disk. We do not claim encryption at rest unless that volume is actually encrypted. Discord’s privileged-intent form should say “Yes” to encryption only if that is true on the host.

A host compromise could expose broker tokens and the event log. That is one reason this application is not a public product and why we do not publish keys here.

Email Business@nefarious.trading with “Nefarious Copytrading deletion” in the subject and include:

• your Discord user id (if the request is about a signal message you posted);
• a message link or approximate time, if you want a specific event purged from trades.json;
• if you are an operator, which secrets you want rotated (we will not email secrets back).

We will delete or redact what we control on the operator host unless we must keep a record of the request or of unlawful activity. We cannot erase the original Discord message, broker fill history on cTrader, or copies other people screenshotted.

There is no public in-bot opt-out because there is no public user product. Practical opt-out for a poster: do not post in the watched channel, or ask operators to point the process at a different channel.

If you are in the EEA, UK, or a U.S. state with a comprehensive privacy law, you may also ask for access, correction, or a portable copy of personal data we hold about you in this process’s files. We will not discriminate against you for asking. You may complain to your local supervisory authority.

Discord requires users to meet its minimum age (generally 13+). Nefarious Copytrading is not directed at children under 13 and is not a children’s trading product. If you believe we stored a child’s data, contact Business@nefarious.trading and we will delete what we have.

We will post updates at this URL and change the “Last updated” date. If we ever collected public end-user credentials or scanned more than the configured signal channel, we would say so here honestly.