Privacy Policy.

We collect what's needed to run Lucra, encrypt what's sensitive, sell none of it, and delete it when you ask us to.

This Privacy Policy explains what information Lucra Trading, Inc. ("Lucra") collects when you use our Service, how we use it, who we share it with, and the choices you have.

We collect the categories of information below.

Account information

• Email address and authentication identifiers (via Clerk).
• Display name and any optional profile details you provide.
• Billing information, processed by our payment provider.

Trading data

• Trades, positions, alerts, annotations, and notes you create or import.
• Market data we fetch on your behalf — prices, order fills, conditional-order events.

Usage & device

• Log data: IP address, browser, device type, pages visited.
• Cookies and similar technologies for session management and basic product analytics.

We use your information to:

• Operate the Service — authenticate you and show your data.
• Improve the product, debug issues, and measure feature adoption in aggregate.
• Communicate about your account — receipts, security alerts, critical product changes.
• Comply with legal obligations and enforce our Terms.

We do not sell your personal information. We do not share your trading data with third parties for their marketing.

When you use LucraGPT, we send the relevant context — your question, attached charts, and a snapshot of the trading data you're asking about — to our language-model providers to generate a response.

We do not use your private trading data to train foundation models. Model providers are contractually prohibited from using Lucra content for their own training, per standard enterprise API agreements.

We only share personal information with service providers that help us operate Lucra, each under contractual confidentiality:

• Hosting & infrastructure: Vercel, Railway, Supabase (Postgres and storage).
• Authentication: Clerk.
• Payments: Stripe (or equivalent) — Lucra never stores full card numbers.
• AI providers: Anthropic and/or OpenAI for LucraGPT features.
• Product analytics: an aggregated-analytics vendor, configured to exclude personally identifying trading content.

We may also disclose information when required by law, to enforce our Terms, or to protect the rights and safety of users.

Security is not a checkbox. The practical controls in place today:

• TLS everywhere in transit; data encrypted at rest at the database layer.
• Role-based access to production systems, with audit logging.
• Regular dependency and vulnerability scanning, with a documented response process.

No system is perfectly secure. If you believe you've found a vulnerability, please reach us via the contact page.

We retain personal information for as long as your account is active and for a reasonable period after, so we can meet legal, accounting, and security obligations. When you delete your account, your trading history and personal data are removed from production systems within thirty (30) days, with residual copies expiring from encrypted backups on our standard rotation.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct or update inaccurate information.
• Delete your account and associated data.
• Export your trading history in a portable format.
• Object to or restrict certain processing.

Most of these are available directly in your account settings. For anything else, reach us via the contact page and we'll respond within thirty (30) days.

We use a minimal set of cookies — session cookies for authentication, a preference cookie for theme/UI state, and an analytics cookie that measures aggregate product usage. No advertising cookies. No third-party tracking pixels.

You can disable cookies in your browser, though parts of the Service (notably sign-in) may stop working without them.

Lucra is operated from the United States. If you access the Service from another country, your information will be transferred to and processed in the United States under appropriate safeguards.

Lucra is not intended for and is not directed at anyone under eighteen (18). We do not knowingly collect personal information from children.

When we make material changes, we'll update the "last updated" date above and notify active users by email or in-app notice. Continued use of the Service after the effective date means you accept the updated policy.

Questions or requests: use the contact page.