Privacy Policy

Scope and Who We Are

This Privacy Policy describes how Put Credit Spreadz ("we," "us," or "our") collects, uses, stores, and protects your information when you use our mobile application (the "App"). It applies to all users regardless of which version or feature set you are using, including the current paper trading simulation mode and any future live trading features.

Put Credit Spreadz is an individually owned and operated mobile software product, operating as a sole proprietorship under the trade name "Put Credit Spreadz" in the State of New York. It is not a registered investment advisor, broker-dealer, corporation, or other formal financial entity. For privacy-related questions or requests, please contact us at putcreditspreadz@gmail.com.

By creating an account or using the App, you agree to the data practices described in this Privacy Policy. If you do not agree, please do not use the App.

About This App — Current and Future Versions

Put Credit Spreadz is being developed in phases.

Current Version — Paper Trading Simulation

The current version of the App is a paper trading simulation only. It does not execute real trades, access real brokerage accounts, or handle real money of any kind. All trades, balances, and performance figures are simulated and fictional. In simulation mode, we collect only the minimal data necessary to operate the simulation: your email address, your strategy settings, and your simulated trading activity.

Future Versions — Live Trading Automation

This Privacy Policy is written to cover both the current simulation experience and planned future live trading features. Sections describing data that is not yet collected are clearly labeled as future functionality. When live trading features are activated in your version of the App, those sections of this policy will become applicable to you.

Information We Collect

Information You Provide Directly

• Email address: Collected when you create an account. Used for authentication and to identify your data. We do not send marketing emails.
• Account password: Stored as a hashed, salted credential by our authentication provider (Supabase). We never store or have access to your plaintext password.

Information Generated by Your Use of the App

• Strategy settings: The parameters you configure, including target delta, days to expiration, minimum credit, entry window times, spread widths, ETF symbol selection, and frequency.
• Simulated positions: Paper trading positions opened and closed by your automated bot, including strike prices, expiration dates, credit received, and simulated P&L.
• Trade history and events: A log of all simulated trade activity, strategy check results, and system events associated with your account.
• Bot state: Your paper trading balance, whether your bot is active or paused, and kill-switch status.
• Safety events: Records of automated risk controls that were triggered (e.g., kill-switch activations or manual position closures).

Device and Technical Information

• Push notification token: If you grant notification permissions, we store your device's push token to deliver trade alerts. You can revoke this at any time via your device settings.
• Device platform: We record whether your device is iOS or Android to format notifications correctly.
• Error and diagnostic data: If the App encounters an error, limited diagnostic information may be logged to identify and fix bugs. This does not include personally identifiable information beyond your user ID.

What We Do Not Collect (Current Version)

Brokerage Account Data (Future Feature)

When live trading features are introduced, users who choose to connect a brokerage account will be required to explicitly authorize the App through that brokerage's official OAuth or API system. This authorization will be entirely optional and can be revoked at any time through both the App and the brokerage's own account settings.

What Brokerage Data We Will Collect

• OAuth access tokens: Encrypted tokens issued by the brokerage that allow the App to place trades on your behalf. We do not store your brokerage username or password — OAuth tokens are issued directly by the brokerage without sharing your credentials with us.
• Account identifiers: Brokerage-assigned account numbers (partially masked) necessary to route orders to the correct account.
• Real position and order data: A record of orders placed by the App and their resulting positions, used to track your live strategy performance and manage open positions.
• Real-time balance snapshots: Periodic account balance data retrieved from the brokerage, used solely to enforce risk controls and position sizing.

What We Will Never Collect

• Your brokerage username or password
• Full, unmasked account numbers in any persistent storage
• Social Security numbers or tax identification numbers
• Any data from your brokerage account beyond what is necessary to operate the put credit spread automation strategy

How Brokerage Data Will Be Used

Data retrieved from a connected brokerage account will be used exclusively to execute your authorized strategy on your behalf, monitor and close open positions according to your exit criteria, enforce your configured risk controls, and display your live trading performance within the App. We will never use brokerage data for advertising, profiling, or any purpose beyond operating your trading automation.

Revoking Brokerage Access

When live trading is available, you will be able to disconnect your brokerage account at any time from within the App. Upon disconnection, your OAuth access token will be deleted from our systems immediately and all pending automation will stop. We also recommend revoking the App's access from your brokerage's authorized apps settings directly.

How We Use Your Information

We use the information we collect only for the following purposes:

• Providing the App: To authenticate you, store your settings, run strategy checks, and display your trading history (simulated or live).
• Executing your trading strategy (future live trading): To place, monitor, and close options positions in your connected brokerage account on your behalf, strictly according to your configured parameters.
• Push notifications: To notify you of trade events, risk events, or kill-switch activations, only if you have granted notification permission.
• Risk management: To enforce the safety controls you configure, including automatic bot pausing when thresholds are exceeded.
• Debugging and reliability: To identify and fix errors or unexpected behavior in the App.
• Legal compliance: To comply with applicable laws, respond to lawful requests from authorities, or enforce our Terms of Use.
• Account deletion: To process your request to permanently delete your account and all associated data.

We do not use your data for advertising, behavioral profiling, or any purpose not listed above.

How We Share Information

We do not sell, rent, trade, or share your personal information with third parties for their marketing or commercial purposes.

Service Providers

We share data with vendors who help operate the App (see Section 7). These vendors are contractually restricted from using your data for any purpose beyond providing their services to us.

Your Brokerage (Future Live Trading)

When you authorize a brokerage connection, we transmit trade instructions to that brokerage on your behalf. This is the core function of the live trading feature and occurs only with your explicit prior authorization.

Legal Obligations

We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Put Credit Spreadz, our users, or the public.

Business Transfers

If Put Credit Spreadz is acquired or its assets transferred, your information may be transferred as part of that transaction. We will notify you of any such change before the transfer occurs.

Third-Party Services

Supabase

All user data — including account credentials, strategy settings, positions, and trade history — is stored in Supabase. Supabase provides our database, authentication system, and serverless functions. Data is encrypted in transit (TLS) and at rest (AES-256). Supabase is SOC 2 Type II certified. See supabase.com/privacy.

Expo Push Notifications

Expo provides push notification infrastructure. If you grant notification permission, your device token is stored in our database and passed to Expo's servers solely to deliver your alerts. No other personal information is shared with Expo. See expo.dev/privacy.

Yahoo Finance (Public Market Data)

The App retrieves publicly available ETF price data from Yahoo Finance to power simulated options pricing calculations. No personal information is transmitted to Yahoo Finance — only the ticker symbol being queried.

Brokerage API Providers (Future Feature)

Apple (iOS Platform)

As an iOS application, the App interacts with Apple system services (e.g., push notification delivery via APNs). See apple.com/legal/privacy.

Data Retention

We retain your data for as long as your account remains active:

• Account data (email, hashed credentials): Retained until you delete your account.
• Strategy settings and trading data: Retained until you delete your account.
• Push notification tokens: Retained until you delete your account or revoke notification permissions on your device.
• OAuth brokerage tokens (future): Retained until you disconnect your brokerage account or delete your Put Credit Spreadz account, whichever comes first.
• Error and diagnostic logs: Retained for up to 90 days for debugging purposes, then purged.

Upon account deletion, all data associated with your account is permanently and irreversibly removed from our systems.

Account and Data Deletion

You have the right to delete your account and all associated data at any time. Per Apple App Store Guideline 5.1.1(v), we provide an in-app method to do so — no email or external process required.

What Gets Deleted

Upon account deletion, the following is permanently and irreversibly removed:

• Your authentication account (email, hashed password)
• All strategy settings and configuration
• All simulated and live positions (open and closed)
• All trade history, order records, and event logs
• Your trading balance and bot state
• Your push notification token(s)
• Any stored brokerage OAuth tokens (if connected — future feature)

Deletion by Email Request

If you cannot access the App, contact us at putcreditspreadz@gmail.com with the subject line "Account Deletion Request" and your registered email address. We will process your request within 30 days.

Push Notifications

With your explicit permission, the App sends push notifications when your bot opens or closes a position, when a kill-switch or safety event is triggered, or (in future live trading) when a real order is executed. Notifications relate only to activity initiated by the App on your behalf.

You can opt out of push notifications at any time by going to your device's Settings → Notifications → Put Credit Spreadz. Your push token will be removed from our servers when you delete your account.

Security

We implement reasonable technical and organizational measures to protect your information:

• All data transmitted between the App and our servers is encrypted using TLS.
• All data stored in our database is encrypted at rest using AES-256 via Supabase.
• Authentication is handled by Supabase Auth using industry-standard hashed and salted password storage.
• All API endpoints require authenticated user tokens (JWT) scoped so users can only access their own data.
• Brokerage OAuth tokens (future feature) will be stored encrypted and used exclusively by server-side functions inaccessible to other users.
• Access to our database and backend systems is restricted to authorized service accounts only.

No method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your information. If you believe your account has been compromised, contact us immediately at putcreditspreadz@gmail.com.

Children's Privacy

Put Credit Spreadz is intended solely for users who are 18 years of age or older. The App is not directed at, marketed to, or designed for children or minors. We do not knowingly collect personal information from anyone under the age of 18. If we discover we have inadvertently collected information from a minor, we will promptly delete that information and terminate the associated account.

If you believe a minor has created an account, please contact us at putcreditspreadz@gmail.com.

California Privacy Rights (CCPA / CPRA)

If you are a California resident, the CCPA and CPRA provide you with specific rights regarding your personal information.

Your California Rights

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected, the sources, our purposes, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we have collected. You can exercise this right directly in-app (see Section 9) or by contacting us.
• Right to Correct: You may request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising. No opt-out action is necessary.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To Submit a California Privacy Request

Contact us at putcreditspreadz@gmail.com with the subject line "California Privacy Request." We will respond within 45 days as required by law.

International Users

Put Credit Spreadz is operated from the United States. If you access the App from outside the United States, your information may be transferred to, stored in, and processed in the United States and other jurisdictions where our service providers operate.

The current version of Put Credit Spreadz is intended for use by U.S.-based users familiar with U.S. equity ETF options markets. The simulated options chain and live trading features (when available) are calibrated for U.S. market hours and products.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes — particularly when new data collection begins with the introduction of live trading features — we will update the "Last Updated" date at the top of this page and provide notice via a push notification or prominent in-app message before the changes take effect.

Your continued use of the App after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree, you should delete your account before the effective date.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: putcreditspreadz@gmail.com
• Privacy requests: Subject line "Privacy Request — Put Credit Spreadz"
• Response time: We aim to respond to all inquiries within 5 business days, and all formal privacy rights requests within 30 days (45 days for California residents).