아래는 이해를 돕기 위한 요약이며 계약의 정본이 아닙니다. 계약은 영문이 구속력을 가지며, 아래 요약과 영문 본문이 다르면 영문이 우선합니다.
법적 문서는 영문이 정본입니다. 내용이 궁금하신 부분은 support@edgequant.app로 문의해 주시면 한국어로 설명해 드립니다.
Last updated: October 16, 2026
This policy explains what personal data we process when you visit our websites, use the EdgeQuant web application, use the EQ Autopilot desktop application, or join our Telegram or Discord channels. It is written to satisfy Articles 13 and 14 of the General Data Protection Regulation (GDPR).
Controller within the meaning of Art. 4(7) GDPR:
BOK Research GmbH (registered seat: Bad Homburg v. d. Höhe; Amtsgericht Bad Homburg v. d. Höhe, HRB 17674), represented by its managing director Kyo Won Jeong, operating under the brand name EdgeQuant.
Email: support@edgequant.app
Postal address: as printed in the Impressum of this site.
BOK Research GmbH is entered in the German commercial register (Amtsgericht Bad Homburg v. d. Höhe, HRB 17674) and is the controller. The company took over the relationships that existed before that entry. The register court and the commercial register number are also published in the Impressum. The VAT identification number will be added there once it has been issued.
We have not appointed a data protection officer. We are not required to do so: we do not employ twenty or more people who are regularly occupied with the processing of personal data, our core activity does not consist of large-scale regular monitoring of individuals, and we do not process special categories of data on a large scale (Art. 37 GDPR, § 38 BDSG). All data protection enquiries go to support@edgequant.app and are handled by the Managing Director.
To set expectations before the detail:
Each block below states what we process, why, on what legal basis, and for how long. Where a retention period is not yet carried out by an automated routine, we say so expressly and state how the deletion actually happens.
5.1 Signing in and holding a membership
*What:* If you sign in with Telegram, we receive your numeric Telegram user ID. If you sign in with Discord, you authorise us through Discord's OAuth process; for signing in we request the scope identify only, and we receive your numeric Discord user ID. Where you connect Discord after payment or to obtain your application token, we additionally request guilds.join, so that we can add you to our server. Discord access tokens are used once and not stored.
We store that identifier together with the membership tier assigned to it, and two flags recording whether you have completed onboarding: one in the membership record, and one recording that the introductory panel in the dashboard has been shown to you, so that it stays collapsed on later visits.
A small number of legacy accounts use an ID and password instead; for those we store the ID, a password hash, a role and an internal note in a Google Sheet (see section 7).
*Why:* To identify you, determine your tier, grant and withdraw access to member channels, and send you service messages.
*Basis:* Art. 6(1)(b) GDPR (performance of the contract, and steps taken at your request before it).
*How long:* For the duration of your membership. After it ends we keep the minimum needed to honour commitments that survive it and to prevent abuse of offers reserved for first-time subscribers or limited to once per person: your platform identifier, your tier history, your founding-member position and, if one was assigned to you, your member ID with its record (section 5.12). We keep that minimum for three years. The remaining membership data is deleted on request; that deletion is carried out manually and we complete it within 30 days of your request.
*Related items:* A one-time login link contains your platform and identifier and is valid for ten minutes, or until used. If you choose "stay signed in", your browser stores a signed token containing your platform, identifier and an expiry date for thirty days; your access rights are recalculated on every page load, so a cancellation or tier change takes effect immediately. Your EQ Autopilot membership token is stored in our token registry together with your platform identifier, tier, issue date and expiry. When a token is revoked, the registry entry is marked as revoked and remains stored; it is removed together with your membership record.
5.2 Subscriptions and payment
*What:* Payment is handled entirely by Stripe on Stripe-hosted pages. Card details never pass through our servers and we never store them. We send Stripe your Telegram or Discord identifier, a temporary linking token, and, where applicable, a promotion code, tier information, your member ID once one has been assigned to you (section 5.12), the dates of an Autopilot trial and, for an upgrade you schedule during it, the amount shown to you and the time of your request, and, if you claim the prop trader discount, the prop firm, the account size and the last four digits of the prop account number, as subscription metadata, so that a payment can be matched to a membership, a discount to the account that qualifies for it and a scheduled upgrade to the terms you accepted. We read back from Stripe your subscription status, plan and billing period, and the email address held by Stripe on your customer record. We use that address to show it in our administration interface, to send you the contract confirmation that Section 312f BGB requires after a contract is concluded, and to recognise the same person across subscriptions for the checks described below and in sections 5.12 and 5.13. Basis for sending the confirmation: Art. 6(1)(c) GDPR, a legal obligation. We do not store the address itself on our servers; it is read live from Stripe each time. Our send log keeps only a one-way hash of it so that we can tell whether a confirmation has already gone out, and the member ID record keeps a separate one-way hash of it (section 5.12).
Where a promotion is limited to first-time subscribers, we check your subscription history at Stripe, including subscriptions that have already ended, to confirm eligibility. Basis for that check: Art. 6(1)(f) GDPR (preventing misuse of promotional offers).
The Autopilot trial for Operator members (Section 9 of the Terms) is available once per person. Before it starts, we check at Stripe that no trial has been used on any subscription, including ended ones, linked to the same Telegram or Discord identifier, the same Stripe customer record or the same billing email address, and that none of those customer records has paid an invoice for the Autopilot tier. We also check, from the instruments your application reports (section 5.4), that an account is turned on for each of the three instruments. These checks run before we tell you that the trial can be started and again when you press the start button, and are not stored as a separate record; the trial dates are kept on your subscription at Stripe. Basis: Art. 6(1)(b) GDPR for determining whether the offer applies to you, and Art. 6(1)(f) GDPR (making sure the trial is used only once per person) for the comparison with other subscriptions. While you are eligible for or using the trial, we send you service messages about it on Telegram or Discord: that it can be started, before it ends, and the result of an upgrade you scheduled. We keep a log of these messages with the time, the kind of message, a reference to your subscription at Stripe and a short one-way hash of your messenger identifier, so that the same message is not sent twice; it contains no message text and no name. A list of scheduled upgrades, holding only the subscription reference and the relevant times, is kept until the upgrade has been carried out or cancelled. Basis for the messages and these records: Art. 6(1)(b) GDPR. The message log is kept with your membership record and, after your membership ends, with the minimum record for three years (section 5.1); there is no automated deletion routine for it, and we delete it manually.
We also keep a record of your subscription pauses, consisting of your platform identifier and the start, end and resumption dates, so that we can apply the 90-day pause allowance per rolling twelve months (Section 10).
At checkout, the Stripe payment page also asks one required question: where you heard about EdgeQuant. You choose one answer from a fixed list, which includes "prefer not to say". If you reach the payment page through a partner's official link (a link with "via=" in its address), that partner's answer is already selected; you can keep it or choose another, and only the answer you submit counts. We use the value in that link only to pre-select the answer, pass it to Stripe for that purpose and do not store it ourselves, apart from the access logs described in 5.9, which record the address you requested. We store only the code of the answer you submit: on the subscription at Stripe and, once it is linked to your membership, in our own records under a one-way hash of your identifier rather than the identifier itself. We do not store a name or any contact detail for it. We use it to count where our members come from and, where the answer given for the subscription under which you made your first payment names a partner who is compensated for introductions (see the Disclaimer), to attribute you to that partner; a later subscription does not change that attribution. What that partner then sees is described in 5.13. Basis: Art. 6(1)(f) GDPR (understanding which channels bring members, and attributing a partner's compensation correctly). It is kept with your membership record and deleted with it; where it attributes a paid subscription to a partner, that attribution is also part of our records of the partner's compensation and is kept for as long as those records must be kept.
The same page also has one optional free-text field, "Referring friend's member ID (optional)". Section 5.12 explains what happens with an entry in it.
*Why:* To take payment, manage your subscription, apply the pause allowance, and meet our accounting obligations.
*Basis:* Art. 6(1)(b) GDPR for the subscription itself; Art. 6(1)(c) GDPR for accounting and tax record keeping.
*How long:* The pause record is kept for as long as it is needed to apply the pause allowance, and is deleted together with your membership record. We are required by law to retain accounting records: invoices and booking documents for ten years, commercial and business letters for six years (§ 147 AO, § 257 HGB). Those periods run from the end of the calendar year in which the document was created. We are the party subject to that duty and keep our own copies; Stripe additionally retains the payment records it processes under its own obligations.
5.3 Delivery of signals through Telegram and Discord
*What:* Signal cards are posted to tier-specific channels. To let you in or out of those channels we transmit your platform identifier to Telegram or Discord, issue single-use invitation links, assign or remove Discord roles, add you to our Discord server automatically when you complete the Discord authorisation that asks for that permission, and send direct messages (for example your app token, login links, or a PIN reset code).
*Why:* To deliver the service you subscribed to and to enforce tier access.
*Basis:* Art. 6(1)(b) GDPR.
*How long:* Channel membership lasts as long as your tier entitles you to it. Messages remain in the respective platform according to that platform's own retention.
Telegram is optional: you can hold a membership using Discord instead, and signals are shown in the web application as well. A membership does, however, require either a Telegram or a Discord account, because that identifier is what your tier is assigned to (see section 11).
5.4 The EQ Autopilot desktop application
The application runs on your own computer, under your control.
*What stays on your computer and is never sent to us:* your broker and exchange credentials. Secrets - API keys, passwords and tokens - are stored in your operating system's secure credential store (macOS Keychain, Windows Credential Manager, Linux Secret Service); if that store is unavailable, they are encrypted with a key derived from your PIN. Only items that are not secret - host names, account identifiers, user names and sizing settings - are kept in plain text in the application's configuration file inside your own user profile directory. Please protect access to your computer accordingly. Also local: your application log files (deleted automatically after thirty days), the ledger of trades the application placed, your risk-unit history, and your local PIN hash. All orders and account queries go directly from your computer to your broker or exchange. For Interactive Brokers and NinjaTrader the connection does not even leave your machine.
*What the application receives from us:* every few minutes it downloads a small encrypted file containing your current authorisation status, and every few seconds a file containing the current signal. These are downloads. They contain no information about your account, your positions or your broker; as with any web request, your IP address and the hash that identifies your token reach our server and Cloudflare. The files are published under a filename derived from that hash and their contents are encrypted with a key derived from your token.
The authorisation file tells the application whether your membership entitles you to use a given function, for example whether your tier includes automatic execution. It is not specific to your account and is identical for every member on the same tier. Our server cannot send a command directly to your account. The signal the application follows (entry, direction, stop, size multiplier and exit time) and which functions are enabled or locked are, however, set by our server. At the session exit time set in a signal the application closes all positions and cancels all working orders in the accounts it manages, including positions you opened yourself. The size of an order and the account it goes to are determined by the software on your computer from the settings you made. We can suspend an entitlement, for example when a membership ends.
*What the application sends to us:*
Before the application will do anything at all, it asks you to confirm that it runs on your own computer, with your own credentials, on your own accounts.
5.5 Public track record profiles
*What:* If public display is on, a page at app.edgequant.app under your handle shows: your handle, a display name, a role label, your start date, cumulative result in risk units, maximum drawdown, recovery factor, number of trades, win rate, monthly and per-instrument breakdowns, your most recent twelve trades (date, instrument, direction, result), and a size-relative curve. It does not show monetary amounts, account balances, account numbers or credentials. Members whose page is published are also listed in a public directory on the site.
*Where the display name and handle come from:* we obtain them ourselves from Telegram or Discord using your user identifier, because the application does not send us any name. That means your Telegram first and last name, or your Discord display name, and your username, which also forms your page address. We retrieve them whenever your application synchronises its record, including while your page is not published, because they are used to name and address your member record. Where your page is not published, that name is stored in our internal record and is not shown anywhere. Section 10 covers data we obtain from third parties.
*Basis:* Art. 6(1)(b) GDPR for holding the name in your internal member record; Art. 6(1)(a) GDPR, your consent, for showing the page publicly. Publication is voluntary and nothing else about your membership depends on it.
*How publication is switched on:* only with the toggle in your dashboard. A setting in the desktop application does not switch it on; our server does not use the publication flag the application sends. A page that has never been published stays unpublished until you switch it on there.
*What publication means in practice:* a public page can be found and read by anyone, including search engines, and can be copied and archived by third parties. Because your page address is derived from your username, the page can be linked to your account on that platform. Once a page has been indexed, we can ask search engines to remove the copies and cached versions they hold (Art. 17(2) GDPR), but we cannot guarantee that every copy disappears. Trading results say something about your financial situation, so please consider this before switching publication on.
*Withdrawing:* switch the toggle off in your dashboard, or write to us. The page goes offline immediately. We then delete the underlying records within 30 days without you having to ask separately, because the consent that made the publication lawful no longer exists (Art. 17(1)(b) GDPR). That deletion is carried out manually; there is no automated deletion job for it. Withdrawal does not affect the lawfulness of publication before it.
The founder's own account record is published on the same basis and is marked as such.
5.6 Reviews
*What:* If you write a review we store the display name you type, your tier, star rating, review text, language, the date, optionally a link and an uploaded screenshot as evidence, a like counter, our moderation status for the review (whether it has been approved for display, marked as featured, or marked as verified), and, if you have a public track record page, its handle so that the two can be shown together. Reviews are published on our public site.
*Basis:* Art. 6(1)(a) GDPR, your consent.
*Screenshots and moderation:* a review submitted with evidence is held for our review and does not appear until we approve it. We do not publish an image that shows account numbers, names or data about other people. An evidence screenshot is stored exactly as you upload it, including any metadata the file carries, so please black out anything you do not want us to hold before you upload it.
*Connection with your public page:* if your track record page is published, your review is shown together with it.
*How long:* until you ask us to remove the review, or until we remove it. The uploaded image is removed with it.
5.7 Contact requests
*What:* the email address you enter, the topic and your message.
*Why:* to answer you, and, where you send a review for the prop trader offer, to check that you qualify for the ongoing discount or the free month.
*Basis:* Art. 6(1)(b) GDPR where your enquiry concerns a contract or a possible one, otherwise Art. 6(1)(f) GDPR (answering enquiries addressed to us).
*Where it goes:* which route your message takes depends on how you write to us. If you are signed in with a connected messenger, the contact screen is a single message box: no email address is collected, and your message is relayed into a thread inside the private operator group we run on Telegram. That thread is labelled with your tier, your platform and the last four digits of your platform identifier, not with your handle. If you use the email form instead - as a guest, or because no messenger is connected - the address you enter is part of the message: it is emailed to our own mailbox with your address set as the reply address, and the same text including that address is relayed into the same operator thread. Our private operator channel on Discord receives your message only when the Telegram relay is unavailable, and if our mail sending is unavailable the operator thread is the only route by which your message reaches us. Please do not put anything in the message that you would not want carried over those platforms; for sensitive matters, write to support@edgequant.app directly.
*How long:* twelve months after the matter is closed. Where correspondence is subject to commercial retention duties, up to six years.
5.8 Measuring website use
*What:* we count visits, and on the public website we also count how often a few key calls-to-action are clicked and how often each blog post is read. What is stored on our side is a per-page or per-button daily total and running total, with no identifier, no session ID and no stored IP address. So that one visitor is counted only once a day, the server derives a truncated, salted hash of the IP address, keeps it for at most 24 hours to deduplicate that day, and then deletes it; the original IP is never stored, and nothing is stored on your device for this counting. Separately, Cloudflare's dashboard provides aggregate figures for the domain (daily unique visitors and request counts); those are totals, not records about individuals.
*Basis:* Art. 6(1)(f) GDPR (understanding, at the level of totals, how much the site is used and which parts are reached). The short-lived hash uses your IP address for same-day deduplication only; because no marker is stored on your device, no § 25(1) TDDDG consent question arises.
*How long:* the totals contain no personal data and are kept indefinitely; the daily deduplication hash is kept at most 24 hours.
5.9 Security, abuse prevention, IP addresses and server logs
*What:* our sites are delivered through Cloudflare, which necessarily processes visitors' IP addresses to deliver content and defend against attacks. Within our own application, IP addresses are used to slow down repeated failed logins and to limit how often the endpoints used by the desktop application can be called; there they are held in the running process's memory only, are never written to a file or database, and disappear when the process restarts.
Separately from our application code, our web server and Cloudflare keep their own access logs. These contain the requested address, the time, the status code, the browser identification and the IP address. Some requests from the desktop application carry an encrypted payload and a token-derived identifier in the request URL, so those values appear in access logs in encrypted form.
*Basis:* Art. 6(1)(f) GDPR (protecting the service against unauthorised access and abuse, and secure and stable operation).
*How long:* rate-limiting data, minutes to hours and in any case only until the service restarts. Access logs are short-lived and are subject to our server configuration and to Cloudflare's own retention.
5.10 Backups and source control
*What:* once a night we copy operational and configuration files that cannot be kept in source control to a backup computer that we operate ourselves, over an encrypted private network. Those files include membership and account-operation records, application and login tokens, and our tier configuration. No third-party storage provider receives them.
Our server and signal-engine code is kept in private repositories at GitHub and GitLab, which also serve as our off-site backup. The code of the EQ Autopilot application you install is public (github.com/KyowonJeong/eq-autopilot) and contains no member data. Anything that identifies a member by name or handle - the public profile files and the record of who has seen the setup guide - is excluded from those repositories. Operational data that identifies you only by a one-way hash of your application token, such as filled quantities, the gap between reference and fill price, and application error reports, is kept in them so that it can be restored after a failure. Those repositories are private and are accessible only to the operator. The files that do identify you are still backed up, but only in encrypted form: they are combined into a single encrypted blob whose key is held separately on our server and never placed in the repository, so a copy of the repository alone does not reveal any name or handle. When you ask us to delete your data we delete the source files, and the next backup no longer contains them.
*Why:* so that a hardware failure does not destroy the service or your membership status.
*Basis:* Art. 6(1)(b) GDPR, because your membership status and access rights are part of the contract, and Art. 6(1)(f) GDPR for business continuity and data integrity.
*How long:* we keep the last fourteen nightly copies; older ones are overwritten. Where we delete your data on request, the deletion reaches our backups within fourteen days.
The web application at app.edgequant.app runs on hardware we own and operate ourselves and is reachable through a Cloudflare tunnel; it is not hosted with a cloud provider. Our public website edgequant.app is served from Cloudflare Pages.
5.11 Launch announcement and the founding-member waiting list
*What:* if you ask to be told when paid access opens, we store one identifier for you - the platform identifier of the messenger you are signed in with, or the email address you type into the form - together with the tier you were viewing, the time you asked, and whether the announcement has been sent. We do not store a name or a telephone number. Separately, if you are already a member, we may send you a message on the messenger you signed up with about the service you use: for example that a founding tier has opened, or that the desktop application on your account has not been run yet. Those messages are selected by the date you joined, never by watching what you read on the site. Of the sending itself we keep only the campaign identifier, the filter used, the number of recipients and the time; individual recipients appear in that record only as a one-way hash.
*Why:* to send the one announcement you asked for, to see at the level of totals how many people are waiting, and to tell existing members about the service they hold with us.
*Basis:* for the waiting list, Art. 6(1)(a) GDPR - the consent you give by pressing the button - which you can withdraw at any time through the unsubscribe link in your entry or by writing to support@edgequant.app. For messages to existing members about our own service, Art. 6(1)(f) GDPR together with § 7(3) UWG (informing our own customers about our own comparable service); every such message tells you that you can object, and one reply saying so, or one line to support@edgequant.app, ends them at no cost to you.
*How long:* a waiting-list entry is deleted once the announcement has been sent, or as soon as you withdraw. The sending record, which holds no address, is kept for two years so that we can show what was sent and so that the same message is not sent twice.
5.12 Member ID and referrals by friends
*What:* When the first payment of more than zero on a paid subscription of yours has gone through, we assign you a member ID: "EQ-" followed by six characters chosen at random, so that it reveals nothing about you or about how many members we have. It is attached to the Telegram or Discord identifier linked to your membership and stays the same if you subscribe again with that identifier. We keep it in our own records together with those identifiers, references to your subscriptions at Stripe and, as markers only, one-way hashes of the email address and of the customer number held for the payment at Stripe. We also write it into the metadata of your subscription at Stripe. You see your member ID, and a link you can send to a friend, under My Account.
*How the markers are used:* Your member ID is attached only through your messenger identifier. The hashed email address and customer number never join or separate members by themselves. Where they suggest that two payments may belong to the same person, or that a friend entry may be a self-referral or come from a returning member, the case is held for a person on our side, and that person's decision, not the markers, determines the outcome.
*The friend field at checkout:* The payment page has one optional free-text field, "Referring friend's member ID (optional)", for up to 40 characters. If you fill it in, we keep what you typed, as typed, with a reference to the subscription it was entered on, and we compare it with existing member IDs to record which member referred you. An entry that does not match a member ID is held for our manual review. We do not write the entry into the metadata of your subscription; Stripe keeps it as part of the checkout session. If you reach the payment page through a friend's link (a link with "f=" in its address), that friend's member ID is already in the field, provided it exists and is not your own; you can change or clear it, and only what is in the field when you pay counts. We use the value in that link only to pre-fill the field and do not store it ourselves, apart from the access logs described in 5.9. If you also chose a partner as your answer to the question in 5.2, the partner attribution takes precedence and the friend entry is not used for a referral reward. We do not pass your name or contact details to the member whose ID you entered. If that member is, or later becomes, one of our referral partners and the answer given for the subscription under which you made your first payment does not name a partner, we may, at our discretion and for months we choose, also count your payments towards that partner's compensation; that partner then receives for those months the monthly lines and the subscription status described in 5.13, but none of the notices, and never your name or contact details. A friend entry counted in this way is not also used for a friend referral reward.
*Why:* to give each paying member a short identifier that can be passed to a friend; to record who referred whom, so that a friend referral reward, once we announce one, goes to the right member and not to a member referring themselves or a returning member; to recognise the same person across subscriptions where a rule applies once per person; and, where the member whose ID you entered is a referral partner, to count your payments towards that partner's compensation at our discretion (5.13). No friend referral reward is paid at present.
*Basis:* Art. 6(1)(b) GDPR for assigning and showing your member ID; Art. 6(1)(f) GDPR (recording referrals correctly, preventing self-referral and repeated use of offers, and compensating a referral partner whose member ID you entered) for the markers and the friend entries. You can object to the latter (section 13).
*How long:* The member ID record, its markers and the friend entries are kept for as long as you are a member and, after your membership ends, with the minimum record described in 5.1 for three years. There is no automated deletion routine for them; we delete them manually.
5.13 Referral partners
*If you chose a partner at checkout:* We may compensate partners who introduce members (section 11 of the Disclaimer). If the answer given for the subscription under which you made your first payment names a partner (5.2), we calculate that partner's compensation from your payments, and the partner receives, on a personal page on our website and in a monthly statement sent by email, one line per month about you: a member code that we derive one-way from our payment records and that does not reveal who you are, the date of your first subscription payment, your tier, which month of your membership the month is (for example "month 3"), the net amount we received from you for that month after tax, payment fees and refunds, and, where a payment is not counted, only the kind of reason, such as a refund or a withdrawal. The page also shows, for each member code, whether the subscription is active, paused or has ended, and the date it ended. When your first payment is recorded, the partner also receives an automatic notice with the member code, the date of that payment and your tier. The partner receives a similar notice with the member code and the date when your subscription ends, stating only the kind of reason (a cancellation at the end of the billing period, a withdrawal or refund, failed payments or another immediate ending), and when your tier goes up or down, stating the new tier. The partner does not receive your name, email address, messenger identifier or any other contact detail, your payment details, or anything about your trading, and is bound by contract not to try to identify you from these lines and not to contact you on the basis of them. Because a partner who knows you could still connect such a line with you, we treat it as personal data. Nothing is passed to a partner you did not choose, except that, where 5.12 says so, the partner whose member ID you entered in the friend field receives the monthly lines and the subscription status described here for the months we count, but none of the notices.
*Our own checks:* To calculate these figures we read from Stripe the amounts, fees, taxes, refunds and disputes of the payments concerned and the billing country. To check that an attributed payment is not one the partner agreement excludes, for example the partner's own subscription, a repeated signup by an earlier member or a test payment, we compare it with earlier payments at Stripe, including other members' payments, by the billing email address and the card fingerprint that Stripe derives from a card number without revealing it. That comparison runs in memory when we prepare the figures; it produces only a warning for our own review and is never shown to the partner. We record each attributed first payment in an append-only log that holds only the member code and a code for the subscription, and that log is timestamped daily by an external service so that it cannot be changed unnoticed.
*Basis:* Art. 6(1)(f) GDPR (paying partners correctly and verifiably, and letting them check their compensation); Art. 6(1)(c) GDPR for keeping the statements, which are self-billed invoices, as accounting records. You can object (section 13); we then weigh your situation against the partner's contractual claim to a statement that can be checked.
*Recipients:* the partner you chose or, where 5.12 applies, the partner whose member ID you entered in the friend field (section 8 covers transfers outside the EEA), our email provider for the statements, and Telegram or Discord for the notices.
*How long:* the statements and the records behind them, including the log of attributed first payments, for as long as accounting records must be kept (section 5.2).
*If you are a partner:* We process the personal data you give us under your referral agreement, such as your name, address, email address, messenger accounts and tax details, to perform that agreement and to keep the records the law requires (Art. 6(1)(b) and (c) GDPR); your agreement describes this in its data protection section. Your partner page opens only with your own login, and your access to it ends on the date your agreement ends. Automatic notices about your referred members go to the Telegram or Discord account named in your agreement. We send them to a Telegram account only after you have given us, in text form, your explicit consent to that transfer, having been informed of the risks described in section 8 (Art. 49(1)(a) GDPR). You can withdraw that consent at any time by telling us; notices then go only to a Discord account you name, and your partner page and the statements by email continue. Access on the Partner tier (Section 6 of the Terms) is linked to the Telegram or Discord account named in your agreement. For it we keep the account, the start and end dates and an append-only log of each grant and withdrawal, stating who made it, when, and which application token it concerned (as a reference, not the token itself). Basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR (being able to show what access was given and when) for the log. We keep this record for the term of your agreement and then for three years from the end of the year in which it ended; there is no automated deletion routine for it, and we delete it manually.
Storage of and access to information on your device is governed by § 25 TDDDG. We classify what we store as follows.
Strictly necessary, stored under § 25(2) no. 2 TDDDG (no consent required):
We store nothing on your device beyond what the functions you actively use require, so we do not ask for storage consent - there is nothing it would cover. In particular, we set no visitor-counting marker on your device: daily unique visitors - for the application, the public website and the blog alike, together with how often the website's key buttons are clicked - are estimated server-side from a truncated, salted hash of your IP address that is kept for at most 24 hours and then deleted (Art. 6(1)(f) GDPR - basic reach measurement with no device access and no persistent identifier; see section 5.8).
Our application code sets no cookies of its own, and we use no advertising, analytics or tracking cookies, no tracking pixels and no ad networks. Cloudflare, which sits in front of our sites, and the web framework the application is built on set strictly necessary technical cookies for security and session continuity; these are not used for advertising or cross-site tracking.
Apart from the sign-in token, which you send back to us when you load the site, none of these entries are transmitted anywhere. You can delete them at any time through your browser settings; signing out removes the session token.
For the member channels we operate on Discord and Telegram we are, together with the respective platform, jointly responsible within the meaning of Art. 26 GDPR for the data processed when you visit those channels. In that arrangement we decide who is admitted and what is posted; the platform decides how its own service works. You may exercise your rights against us or against the platform. We will forward a request we cannot answer ourselves, and the essential content of the arrangement is available from us at support@edgequant.app.
Our market data providers receive only instrument and time-range queries. No member data is transmitted to them.
Beyond this we disclose personal data only where we are legally obliged to, or to enforce or defend legal claims.
Some of the providers above are established outside the European Economic Area or process data there, in particular in the United States. The instrument we rely on for each is:
You may request a copy of the relevant clauses from us at support@edgequant.app.
Telegram is operated from outside the EEA by a company established in a country for which no adequacy decision exists, and no appropriate safeguards under Art. 46 GDPR are in place. If you connect Telegram, your Telegram user ID and the messages we send you are transferred there. You should be aware that Telegram may be required to disclose data to authorities in that country, that there is no supervisory authority you can turn to there, and that you may be unable to enforce your rights against it. We make that transfer only where you have given your explicit consent to this specific transfer after being informed of these risks (Art. 49(1)(a) GDPR). Discord and the web application provide the identical service without this transfer, and you can withdraw at any time by disconnecting Telegram from your membership.
Where a statutory retention duty prevents deletion, we restrict processing of the data under Art. 18 GDPR instead and delete it when the duty ends.
The following categories reach us from sources other than you, or are recorded for a statutory purpose that needs its own note (Art. 14 GDPR):
Providing either a Telegram or a Discord identifier, or legacy account credentials, and providing payment data to Stripe, is a contractual requirement. Without it we cannot identify you, cannot assign a tier, and cannot deliver the service, so a subscription is not possible. Which of the two platforms you use is your choice.
Everything else is voluntary. Publishing a track record, writing a review, uploading an evidence screenshot, connecting a broker, entering a friend's member ID at checkout, and sending us a contact message are all optional. Declining has no effect on the content of the signals you receive, which is identical for every member. Some of these can earn an advantage under an offer published on our website: turning on an account for an instrument in the desktop application makes that instrument's signals appear earlier there on the free tier, as a voluntary bonus outside the contract that we can change or end at any time; turning on an account for each of the three instruments makes an Operator subscription eligible for the Autopilot trial; and under the prop trader offer a screenshot of a qualifying prop account, or a review after a pass or a first payout, can earn a discount. These are advantages, never conditions; if you decline, the price that otherwise applies to you stays unchanged.
We do not provide investment advice. The signals are produced from market data alone, are identical for every member, and are not a personal recommendation within the meaning of § 2(2) no. 4 WpIG or § 1(1a) sentence 2 no. 1a KWG: they take no account of your financial circumstances, your investment objectives, your knowledge or your experience. Tiers differ only in delivery timing and in how a signal may be executed, never in its content.
We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22(1) GDPR. Your access level is derived automatically from your subscription status, but that is the direct execution of the contract you concluded and involves no evaluation of your personal characteristics. We do not profile you for advertising, scoring or creditworthiness purposes.
The desktop application does not determine order size from your financial circumstances. It contains a position-size calculator which runs entirely on your computer. When you open that calculator, the application may read your account balance from your broker in order to pre-fill an input field, and in prop-account mode it may read the balance before an order to remind you about payout thresholds; that figure stays on your computer, is never transmitted to us, and never sets an order size by itself. The size that reaches your broker is always the one you entered and confirmed.
Where your dashboard shows the current or last value of a position in money, that figure is calculated from the quantity your application reported (see 5.4) and the market price. Your account number, your account balance and the overall profit and loss of your account are not among the data the application reports to us (see 5.4, including its limits for error texts returned by your broker). We do see what it reports, including your open positions, fill prices and results.
Under the GDPR you have the right to:
Right to object (Art. 21 GDPR). *You have the right to object at any time, on grounds relating to your particular situation, to processing of your data which we base on Art. 6(1)(f) GDPR. This concerns the processing described in sections 5.2 (promotion and trial eligibility checks, and the answer to the checkout question), 5.4 (execution measurement and error reports), 5.8, 5.9, 5.10, 5.11 (messages to existing members about our own service), 5.12 (member ID markers and friend entries) and 5.13 (what a partner sees, and our checks of attributed payments). If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An objection can be made informally to support@edgequant.app. Messages to existing members about our own service, described in section 5.11, stop as soon as you object, without our weighing any grounds against yours and at no cost to you. Apart from those messages and the announcement you can ask for yourself, we do not process personal data for marketing, and we never pass your data to anyone else for their marketing.*
To exercise any of these rights, write to support@edgequant.app. We answer within one month; if a request is complex we may extend that by up to two further months and will tell you why. Exercising these rights is normally free of charge; where a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee or refuse to act, as Art. 12(5) GDPR permits. We may ask you to confirm your identity, for example from the account you signed in with, before we act on a request, so that we do not disclose or delete someone else's data.
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement.
For our company, the competent authority is the data protection authority of the German federal state in which our place of business is located. We name that authority, with its contact details, in the Impressum. You may in any case contact the authority of your own place of residence, which will forward the matter if necessary.
The measures we take under Art. 32 GDPR include: encrypted transport (TLS) for all connections; an additional layer of encryption and message authentication on the traffic between the desktop application and our servers; a design in which broker credentials never reach us at all; storage of passwords as hashes rather than in clear text, with a key-derivation function (PBKDF2) for administrative access; membership tokens that we can revoke or rotate immediately if one is exposed; rate limiting on public endpoints; automatic removal of longer digit sequences from error reports; and restriction of administrative access to a small number of authorised persons who are bound by confidentiality obligations and who have access only to what their role requires.
No system is completely secure. If a breach occurs that is likely to result in a high risk to your rights, we will notify you as required by Art. 34 GDPR.
Our services are directed exclusively at persons who have reached the age of 18 and who have full legal capacity. When you register you must confirm your age; we do not knowingly enter into contracts with minors. Where we become aware that a user is under 18, we block the account, take any public page offline and delete the data. Consent given by a person under the age of 16 for an information society service is not valid without the authorisation of the holder of parental responsibility (Art. 8(1) GDPR).
This policy is published in English, and the English version is the binding one, which matches Section 23 of our Terms and Section 17 of our Disclaimer. We do not publish a German translation of this policy, and we do not want to claim one that does not exist.
What we do publish in German, because German law requires it in German: the Impressum (Section 5 DDG), the statutory withdrawal instruction and the model withdrawal form (Article 246a EGBGB), and the cancellation page under Section 312k BGB. Those German texts are the binding ones for what they cover. If you would like this policy explained in German, write to support@edgequant.app and we will answer in German.
We will inform you of any material change to this policy in text form, by email to the address held for you, at least six weeks before it takes effect, together with a clear statement of what is changing. You may object in text form before the change takes effect; if you object, we may terminate the contract with effect from the date on which the change was to take effect. Your silence is not treated as agreement to a change that reduces your rights. Where a change requires your consent, the processing concerned does not begin until you have given it. The date of the current version is recorded at the top of this page.
For any question about this policy, or to exercise any of the rights in section 13:
support@edgequant.app
Cancel contracts (Verträge hier kündigen) · 계약 해지 · Withdraw from contract (Vertrag widerrufen) · 계약 철회 · Cancellation address (해지 접수 주소) · Terms of Service (이용약관) · Privacy Policy (개인정보) · Disclaimer (면책 고지) · Impressum
edgequant.app · 한국어 홈으로 →
The address named in the Impressum, where this document can also be saved and printed: app.edgequant.app · 한국어 화면
This page carries the same text from the same source and stays reachable when the application is not.
이 페이지는 웹 화면과 같은 본문을 한 출처에서 생성한 사본이며, 웹에 접속할 수 없을 때에도 열립니다. Impressum이 문서 소재지로 기재한 주소는 app.edgequant.app입니다.