Privacy policy
What we collect, why we collect it, and what we cannot delete even if you ask — stated plainly, because the last part is unusual and you should know it before you sign up.
Last updated 1 August 2026
Draft — pending legal review
This policy describes what the platform actually does today and is published so beta testers can read it. It has not yet been reviewed by counsel, and the governing-law and data-controller details are not final. It will be replaced with a reviewed version before paid accounts open.
What we collect
Account details. Your email address and an authentication record, held by our authentication provider. Your password is set and verified by that provider directly — it never reaches OrbitFx's own servers, and we cannot read it.
Trading activity. Every order you submit, every fill it produces, funding charges, equity over time, and the outcome of your accounts. This is the substance of the service: it is what your evaluation is scored from and what a disputed fill is re-derived from.
API credentials. If you issue keys for automated trading, we store a label, a prefix and a one-way hash of the secret. We do not store the secret itself and cannot show it to you again after issuance.
Technical data. Session cookies to keep you signed in, and server logs from our hosting providers that record requests for security and debugging.
We do not use advertising trackers, we do not sell data, and we do not share your activity with other traders.
Why we hold it
To operate your account — evaluate it against the rules, execute your orders, and show you your position. To settle disputes: the ability to re-derive any fill years later is the platform's central promise and it requires keeping the inputs. To detect abuse of the evaluation structure, such as one strategy run across many accounts. To email you about outcomes that affect your account, such as a breach or a pass.
Who processes it
We use a small number of providers, each doing one job: authentication and database hosting; application hosting for the trading engine and the website; and a transactional email service for account notifications. Market data comes from public exchange feeds — we send them nothing about you.
Data is stored in the European Union and the United States depending on the service. Named providers and their locations will be listed explicitly in the reviewed version of this policy.
The part that is genuinely different
Orders, fills and breach decisions are written to an append-only log that is enforced by the database itself. Nobody can alter or delete entries in it — not you, not our support staff, not our administrators. That immutability is exactly what makes a trader able to challenge us and win.
The consequence is honest but real: if you ask us to erase your data, we can remove your profile and disconnect your identity from the record, but the trading records themselves remain as an unattributed audit trail. How this interacts with erasure rights in each jurisdiction is one of the questions counsel is reviewing, and this section will be updated with a definitive answer.
What you can ask for
You can ask us for a copy of your data, ask us to correct it, ask us to close your account, or object to a particular use of it. You can revoke any API key instantly from your dashboard. Depending on where you live you may have additional statutory rights, including the right to complain to a data protection authority.
Your own trading data is already available to you without asking: the evidence pack on each account page contains the orders, fills and index history the account was judged on.
How long we keep it
Account and trading records are retained for as long as they may be needed to substantiate an outcome — a passed or breached evaluation is something either side may need to evidence long after the fact. Server logs are retained for a short operational period. Specific retention periods will be stated in the reviewed version.
Contact
Questions about this policy, or a request about your data, can be sent to the address published with the reviewed version of this policy. Beta testers can raise anything through the channel they were onboarded on.
See also our terms of service and the published trading rules.