Privacy Policy

Draft — pending legal review. Last edited 2026-09-04.

1. Who we are

[Company legal name], registered at [Registered address], operates Trebuchet and is the data controller for the personal data described below. Contact us at [contact email] for anything in this policy.

2. What we collect

Account data — your name, email address, and authentication details.
Workspace content — the strategy source you write, and the configuration of the runs, sweeps and validations you submit (symbols, date range, costs, sizing, parameters). A run's results are not stored: every run is recomputed from these inputs, so what persists is only ever enough to reproduce it, not a cached answer.
Uploaded market data — any instrument CSV you import.
Usage and technical data — request logs, timestamps, and the metadata needed to operate the Service (see Section 6).

3. How we use it

To provide and operate the Service: authenticate you, run your backtests, show you your workspace's history, and communicate with you about your account. We do not sell your data, and we do not use your strategy source or uploaded market data to train any model or product outside your own workspace.

4. Legal basis

Where GDPR applies, we process account and workspace data under contract (to provide the Service you signed up for) and, for security logging, under legitimate interest.

5. Retention and deletion

Deleting your workspace (Settings → Delete workspace, or DELETE /v1/tenant) is immediate and thorough: it revokes every API key on the workspace and purges every row — strategies, runs, sweeps, validations, uploaded instruments — rather than just hiding them. [Backups retain purged data for up to N days before they too age out — fill in once the backup policy (Area G3/H6) is set.] Before deleting, you can export your workspace's strategies and run/sweep configuration as a ZIP from Settings (GET /v1/tenant/export).

Today this deletes your workspace. Deleting a single person's account independently of the workspace they belong to isn't offered yet — it needs the real account system this product is still building. If you need that sooner, contact us at [contact email] and we'll handle it by hand.

6. Cookies

Trebuchet sets exactly one cookie: an essential, HttpOnly session cookie that keeps you signed in. It carries no tracking or advertising payload and isn't shared with any third party. We don't run analytics or set any non-essential cookie today; if that changes, a consent banner ships in that same release, not after.

7. Subprocessors

Services that process data on our behalf:

[Hosting / infrastructure provider] — application hosting.
[Managed Postgres provider] — database hosting.
Payment processing (Stripe) and transactional email will be added here once billing and email delivery launch.

8. Your rights

Depending on where you live (GDPR, CCPA and similar laws), you may have the right to access, export, correct or delete your personal data, or to object to or restrict some processing. In-product: export via Settings, delete via Settings → Delete workspace. For anything else, email [contact email] — we aim to respond within 30 days.

9. Data region

[Data region / residency statement — pending the production hosting decision. Data at rest is encrypted using the storage provider's managed encryption.]

10. Children's privacy

The Service is not directed at children under 16, and we don't knowingly collect their data.

11. Changes to this policy

We may update this policy from time to time. We'll post the new version here and update the date above.