Privacy Policy

1. Who we are

kappi.me (“kappi”, “we”, “us”) operates this trade-journaling platform and is the data controller for the personal data described here. For privacy questions or to exercise your rights, contact:

support@kappi.me
David Rose
2010 El Camino Real
Santa Clara, CA 95050

2. Information we collect

Account data you provide at sign-up: name, email address, and phone number. Authentication data: a hashed password, or — if you use Google or GitHub sign-in — the verified email address those providers return to us. Activity data: your platform-access subscription status, verification status, the trade journal entries you submit and their recorded receipt times, your computed scores (e.g. RME), and delivery/connection status. Payment data: handled by our payment processor (Whop); we receive confirmation and subscription status, not your full card details. Matrix data: an account identifier (MXID) and the encrypted message ciphertext plus routing metadata (sender/recipient identifiers, timestamps) held on our homeserver. Technical data needed to run the service, such as your IP address and session cookies. Analytics data (pages visited, clicks, errors) — only if you accept analytics cookies; reject and none is collected.

3. Legal bases for processing (GDPR Art. 6)

We process your data to perform our contract with you (creating your account, recording and delivering your trades, billing your platform subscription); under our legitimate interests in securing and improving the service and preventing abuse; with your consent where we ask for it (e.g. analytics cookies, sending SMS notifications, and delivering your messages to a third-party Matrix client); and to meet our legal obligations. You may withdraw consent at any time without affecting prior processing.

4. How we use your information

To operate the platform, verify your identity, process your platform subscription, record and deliver your own trades, compute your scores and track record, send account and trade-related notifications, and keep the service secure. We do not use your data for advertising, and we do not sell your personal information. The leaderboard and scoring are computed from trade data and do not involve automated decisions that produce legal or similarly significant effects on you.

5. The browser extension

Our optional browser extension helps you journal your own paper trades. When connected, and only on the supported sites you have open (such as Discord and X/Twitter), it reads the trade-related text you direct it to so it can be parsed into a structured trade journal entry, uses your kappi.me session to submit it and to mint a Matrix login, and delivers it to your kappi record and Matrix inbox. It does not collect your general browsing history, and it sends data only to kappi.me, our Matrix homeserver, and — when you choose to open it — your Matrix client. See the extension privacy policy for details.

6. Matrix delivery & third-party clients

Trades are delivered as end-to-end-encrypted Matrix messages. Our homeserver relays only ciphertext and the routing metadata needed to deliver it; it cannot read message contents. To read your trades you sign in to a third-party Matrix client (e.g. Cinny or Element). Once a message is decrypted on your device by that client, its contents are handled by that client and your device, outside kappi.me's control and subject to that client's own privacy practices. By using such a client you consent to your trade messages being delivered to and decrypted by it.

7. Sharing & sub-processors

We do not sell your data or share it for advertising. We rely on service providers (processors) who handle the minimum data needed for their task:

• Whop — payment processing for your platform subscription (subject to Whop’s own terms and privacy policy).
• Twilio — SMS verification codes and notifications.
• SendGrid — transactional email.
• PostHog — product analytics (which pages get used, what errors happen), US located. Loaded only if you accept analytics cookies — reject and it never runs. See the Cookie Policy to change your choice at any time.
• Google / GitHub — optional single sign-on (we receive your verified email).
• Our Matrix (Synapse) homeserver and hosting provider — storing ciphertext and routing metadata. Google Cloud, US located.
• Public networks — to make your track record verifiable, integrity data may be published to the drand randomness network and a public distributed ledger (e.g. Hedera). Do not treat anything you time-seal as private after its unlock time.

We do not sell personal information, including under the CCPA/CPRA.

8. International transfers

Some providers above are located in the United States, so your data may be transferred outside your country. Where required, such transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses (and the UK Addendum). Contact us for details.

9. Data retention

We keep account data for as long as your account is active and as needed to provide the service, then delete or anonymize it within a reasonable period unless a longer term is required by law (e.g. payment and tax records). Encrypted trade messages and routing metadata are retained only as needed to operate delivery. You can request deletion as described below.

10. Your rights

Subject to applicable law (including the GDPR, UK GDPR, and CCPA/CPRA), you may request access to, correction of, deletion of, or a portable copy of your personal data; object to or restrict certain processing; and withdraw consent. To exercise any right, email support@kappi.me. We will not discriminate against you for exercising these rights. If you are in the EEA/UK, you also have the right to complain to your local data protection supervisory authority.

11. Security

Passwords are stored hashed; session tokens are kept in secure, HTTP-only cookies. Trade messages are end-to-end-encrypted in transit between Matrix devices, and a Trader's public track record is additionally time-encrypted until unlocked by a decentralized network. No system is perfectly secure, and you are responsible for the security of the device and Matrix client you use.

12. Children

kappi.me is not directed to children and is intended only for adults. We do not knowingly collect data from anyone under 18 (or the age of majority in your jurisdiction). If you believe a minor has provided us data, contact us and we will delete it.

13. Changes

We may update this policy from time to time and will post the revised version here with a new “last updated” date.