Privacy Policy

The Service is operated by Nefarious / Nefarious Trading under the brand associated with nefarious.trading. Where a formal legal entity name is not separately published on the site, references to “Nefarious” mean the operator of this Service.

• Website: https://www.nefarious.trading
• Privacy contact: Business@nefarious.trading
• Membership / billing may also be handled through Whop (see Third parties).

This Policy covers information we process when you:

• Visit nefarious.trading or related pages we operate
• Sign in with Discord OAuth
• Use VIP / Whop-gated tools (e.g. congress trading, economic calendar, interest rates, Trump schedule, affiliates, workout tracker)
• Log workouts, routines, body measures, streaks, statistics, or leaderboard activity
• Optionally share workout cards to Discord via our webhooks
• Optionally connect Google Health / Google Fit-style health APIs for steps and sleep (when available)
• Interact with research, blog, prop firm, or marketing pages

Third-party platforms you use alongside Nefarious (Discord, Whop, Google, social networks, brokers) have their own privacy policies. This Policy does not govern those services.

A. Account & Discord authentication

When you sign in with Discord, we receive identity data from Discord under the scopes we request (currently including identify and guilds.members.read). This typically includes:

• Discord user ID
• Username
• Avatar identifier / image URL (if provided)
• Guild membership / role IDs for the Nefarious Discord server (used to determine product access, such as workout access)

We store a signed session cookie (nefarious_session) on your device so you remain signed in. We do not sell Discord credentials, and we do not receive your Discord password.

B. VIP / Whop membership data

Access to certain tools depends on membership status. We may process Discord IDs associated with active Whop / VIP membership (synced from our membership systems) and compare them to your signed-in Discord account. We may also maintain limited staff or affiliate allowlists. We generally do not store full payment card numbers on our servers; payments are processed by Whop.

C. Workout tracker data

If you use the workout tracker, we may store:

• Workout sessions (dates/times, duration, notes, rest days)
• Exercises, sets, reps, weight, distance, duration, RPE, and related training metrics
• Routines / templates you create or duplicate
• Body measures and profile metrics you enter (e.g. weight or other self-reported measures)
• Streaks, statistics, and leaderboard-relevant aggregates derived from your logs
• Share-card images or payloads you choose to send to Discord webhooks
• Exercise name requests you submit to our team via webhook

Workout content is generally keyed to your Discord user ID and is intended for your account and community features you enable (for example leaderboards or Discord shares).

D. Health data (Google Health / steps & sleep)

We may offer an optional connection to Google Health / Google Fit-compatible APIs to import steps and sleep metrics only. This is sensitive personal data. See the dedicated Health data section below. We will not request health scopes until you explicitly consent through Google’s OAuth consent flow.

E. Usage, device & analytics data

We automatically collect limited technical information, such as:

• IP address, browser type, device type, and approximate location derived from IP
• Pages viewed, referrers, and timestamps
• Cookie / session identifiers needed for login and security
• Aggregated analytics via Vercel Analytics (privacy-oriented web analytics hosted by our hosting provider)

F. Content you submit

If you submit content (blog editor materials for authorized users, affiliate notes, exercise requests, feedback, or similar), we process that content to operate the relevant feature.

G. Public market / research data

Features such as congress trading, economic calendar, interest rates, and Trump schedule primarily display public or licensed market/event information. Using those pages may still generate ordinary usage and analytics logs as described above.

If and when Google Health / related Google OAuth scopes are enabled, the following rules apply to health information we receive:

• Limited scope. We intend to request and process only steps and sleep-related metrics needed to show progress, recovery context, or similar fitness features inside the workout experience — not broader medical records.
• Consent required. Health data is collected only after you authorize the connection. You may revoke Google access at any time in your Google Account permissions and/or request deletion from us.
• Not sold. We do not sell health data.
• Not used for ads. We do not use health data for advertising, ad personalization, or resale to data brokers.
• Purpose limitation. Health data is used to provide the fitness-related features you enable, to maintain security/integrity of the Service, and to comply with law. It is not used to train unrelated advertising models.
• Access control. Access to health data is limited to systems and personnel who need it to operate or support the feature.
• Retention. Health metrics are retained while your connection/account remains active and as needed to provide the feature, then deleted or de-identified within a reasonable period after you disconnect, delete related data, or close your account — unless a longer period is required for security, dispute resolution, or legal compliance (typically not longer than necessary; operational target: delete or anonymize within 30–90 days after a verified deletion request, subject to backups rolling off).
• Sharing. We do not share health data with third parties except: (i) infrastructure processors that host the Service under confidentiality obligations (e.g. database/hosting), (ii) when you explicitly direct a share, or (iii) when required by law. Discord workout share cards are separate user-initiated shares of workout summaries you choose to send and are not a substitute for Google Health data exports.

Workout logs you manually enter (lifts, body measures you type in) are treated as fitness/account data under this Policy. Google-sourced steps/sleep are treated as restricted health data under this section.

We use personal information to:

• Authenticate users and maintain sessions
• Determine VIP / role-based access to member tools
• Operate the workout tracker, statistics, leaderboards, and optional Discord shares
• Provide congress trading, calendars, rates, schedules, affiliates, research, and related tools
• Improve reliability, security, fraud prevention, and abuse detection
• Understand aggregate usage via analytics (Vercel Analytics)
• Communicate about access issues, security notices, or material Service changes
• Comply with legal obligations and enforce our Terms

Where GDPR/UK GDPR or similar laws apply, our legal bases typically include: contract performance (providing the Service you request), legitimate interests (security, product improvement, community operations that do not override your rights), consent (optional health connections and similar optional features), and legal obligation where applicable.

We use cookies and similar technologies that are necessary or helpful to operate the Service:

• Session cookie (nefarious_session): signed, HTTP-only cookie storing Discord identity needed for authenticated pages (typical lifetime ~14 days).
• Auth redirect cookie (auth_next): short-lived cookie remembering where to send you after Discord OAuth.
• Analytics: Vercel Analytics may collect privacy-oriented usage metrics. It is not used to build advertising profiles for health data.

You can control cookies through your browser settings. Blocking necessary cookies may prevent login or member features from working.

We share information only as needed to run the Service:

• Discord — authentication provider; optional webhook deliveries when you share workout cards or submit exercise requests.
• Whop — membership / commerce platform used for Nefarious access products; membership status may be synced to authorize site features.
• Vercel — hosting, edge/server infrastructure, and Vercel Analytics.
• Google — if you connect Google Health / Google OAuth for steps and sleep; Google processes authorization under Google’s terms and privacy policy.
• Database / infrastructure processors — e.g. managed Postgres or similar storage used to persist workouts and account-linked data.
• Community features you enable — e.g. leaderboard displays or Discord shares you initiate may make certain workout summaries visible to other members or Discord channels.
• Legal & safety — if required by law, or to protect rights, safety, and integrity of users or the Service.

We do not sell personal information. We do not sell health data.

Key third parties include:

• Discord (Discord Inc.) — OAuth login and community/webhook delivery
• Whop — membership checkout and membership records
• Vercel — application hosting and analytics
• Google — optional Health / OAuth for steps and sleep
• Affiliate / partner destinations you choose to visit from our pages

Your use of those services is subject to their own terms and privacy policies. Links to external sites (including affiliates or brokers) are provided for convenience; we are not responsible for their privacy practices.

We retain information for as long as reasonably necessary to:

• Provide authenticated features and maintain your workout history
• Enforce access control and prevent abuse
• Meet legal, tax, accounting, or security requirements
• Resolve disputes

Session cookies expire according to their configured lifetime (or sooner if you log out). Workout and account data generally persist until you request deletion or your access is terminated and cleanup is completed. Backup systems may retain residual copies for a limited rollover period.

We use reasonable administrative, technical, and organizational measures appropriate to the nature of the data, including HTTPS in production, HTTP-only session cookies, signed session tokens, and access-gated APIs for member tools. No method of transmission or storage is 100% secure; if you believe your account was compromised, contact us promptly.

Depending on your location, you may have rights to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete data (subject to legal exceptions)
• Object to or restrict certain processing
• Withdraw consent (e.g. disconnect Google Health)
• Export a copy of data you provided (portability), where applicable
• Lodge a complaint with a supervisory authority

To exercise rights, email Business@nefarious.trading from a contact method that helps us verify you control the relevant Discord account. We may need to confirm identity before fulfilling requests.

You can also sign out (session cleared), revoke Discord or Google app permissions in those platforms, and stop using optional share features.

We may process and store information in the United States and other countries where we or our processors operate (including Vercel and database providers). If you access the Service from outside the U.S., you understand that your information may be transferred to jurisdictions with different data-protection laws. Where required, we rely on appropriate transfer mechanisms or contractual safeguards with processors.

The Service is not directed to children under 13 (or under 16 where stricter rules apply), and we do not knowingly collect personal information from children. If you believe a child provided personal data to us, contact Business@nefarious.trading and we will take appropriate steps to delete it.

If you are a California resident (or resident of another U.S. state with similar privacy laws), you may have rights to know, delete, and correct personal information, and to opt out of “sale” or “sharing” for cross-context behavioral advertising. We do not sell personal information and do not use health data for advertising. To submit a request, contact Business@nefarious.trading. We will not discriminate against you for exercising privacy rights.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may be highlighted on this page or communicated through reasonable means. Continued use of the Service after an update means you acknowledge the revised Policy.

Privacy questions, deletion requests, and Google OAuth / health-data inquiries: Business@nefarious.trading

Related terms: Terms of Service