1. Who we are
ArbTrader (arbtrader.co) is operated by Connor Kim, a sole proprietor, who is the controller of the personal data described here. Contact for anything in this policy, including data requests: support@arbtrader.co.
2. What we collect
Your account. Your email address; your password, stored only as a salted PBKDF2 hash (we never see or store the password itself); whether you’ve confirmed your email; when you signed up; and a record that you confirmed you’re 18 or older and accepted our Terms and this policy, with the date and document versions.
Your subscription. Your Stripe customer ID and your plan’s status. Your card details are entered on and held by Stripe, never by us.
Settings you choose to save (Pro). Your alert preferences (thresholds, whether to email you, and a Discord webhook URL if you add one) and any Kalshi–Polymarket market pairs you confirm.
Technical data. Your IP address, used briefly to limit repeated login and sign-up attempts; these counters expire within two hours. Our host, Cloudflare, processes standard request data (such as IP address and browser type) to deliver and protect the site.
Emails. If you email us, we keep the conversation to help you.
3. What we don’t collect
We don’t use analytics, advertising or tracking tools, and we don’t build profiles of you. We don’t receive your exchange API keys or secrets, your wallet address, your positions, trade history or P&L. Those are stored only in your own browser (IndexedDB), and requests your browser signs are passed through our server without being stored. We don’t sell or share personal data, and we don’t use it for advertising.
4. How we use it, and why
- To provide the service you signed up for (contract): your account, login, subscription, the dashboard, and alerts you turn on.
- To send account emails (contract): email confirmation, password resets, account-deletion confirmations and, if you turn them on, alert emails. You can stop alert emails with the unsubscribe link in each one.
- To keep the service secure (legitimate interests): rate-limiting and preventing abuse.
- To meet legal obligations: tax and accounting records kept by Stripe, and responding to lawful requests.
We don’t send marketing emails. If that ever changes, we’ll ask first and every message will have an unsubscribe link.
6. How long we keep it
- Account data and saved settings: until you delete your account. Deletion takes effect immediately.
- Rate-limit counters: up to 2 hours. Alert de-duplication markers: up to 6 hours.
- Email confirmation and password-reset links: 24 hours and 1 hour.
- Billing records: kept by Stripe for as long as tax and accounting law require, even after you delete your account.
- Support emails: up to 2 years, then deleted.
7. Your rights and choices
You can, at any time:
- Access or export your data — Account → Your data → Download my data.
- Delete your account — Account → Your data → Delete account. Any active subscription or trial is cancelled first, then your account and saved settings are erased, and the keys held in that browser are cleared.
- Correct your data — change your password on the account page, or email us to change your email address.
- Stop alert emails — use the unsubscribe link in any alert email, or turn email off in the Alerts tab.
- Remove browser-held data — disconnect keys on the Connections tab, or clear this site’s data in your browser.
You can also email support@arbtrader.co to make any request, including objecting to or restricting processing. We’ll confirm the request comes from the account’s email address and reply within 30 days. Depending on where you live (for example under the GDPR in the EU/UK or the CCPA in California), you have these rights by law, and you won’t be treated differently for using them. If you’re in the EU or UK you can also complain to your data-protection authority.
8. Security
Pages run only our own code under a strict Content Security Policy; connections use HTTPS with HSTS; sessions use signed, HttpOnly, Secure cookies; passwords are hashed with PBKDF2; and exchange keys are stored in your browser as non-extractable keys. No system is perfectly secure: use a unique password, lock your computer, and disconnect keys on shared machines.
9. Where data is processed
We and our providers process data in the United States and other countries where they operate. Where the law requires it, transfers rely on safeguards such as the providers’ standard contractual clauses.
10. Adults only
ArbTrader is only for people 18 and older, and everyone confirms their age when they sign up. We don’t knowingly collect data from anyone under 18; if we learn we have, we’ll delete the account and its data. If you believe a minor has an account, email us.
11. Changes to this policy
If we change this policy we’ll update the date above, and for material changes we’ll email account holders before the change takes effect.