Privacy Policy

1. Who we are

This Privacy Policy explains how TABU Trading API Bot ("TABU", "the App", "we", "us", or "our") uses personal data when you use the App and the TABU server software.

The App only connects to the server address you enter. www.tabuapp.uk makes the App and the server software, but does not run your server and receives none of your data. The person or organisation running the server you use (for example you, on your own rented server) decides how it is used and is responsible for the personal data on it (the "data controller"). In this policy, "we" and "our server" mean whoever runs that server.

Questions about the App or the software: www.tabuapp.uk, Email: tabu@tabuapp.uk

We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. The App itself

The App does not collect anything for www.tabuapp.uk: it has no analytics, no advertising and no tracking, and it talks only to the server you enter. On your phone it keeps only your login token and the server address, in the phone's secure storage.

3. What data we hold

Your account

• your email address (your username);
• your password, stored only as a salted fingerprint (hash), never in readable form;
• your optional password-reset security word, also stored only as a salted fingerprint;
• login records: when you are logged in (session fingerprints and their expiry), failed login counts and temporary lockouts, password-reset requests and reset codes (stored only as fingerprints, valid for 30 minutes), and failed security-word attempts;
• when you accepted the Terms and Conditions and confirmed live trading;
• whether you are an administrator of the server.

Your Trading 212 connection

• your Trading 212 API key and secret, stored encrypted on the server (they are never kept on your phone);
• whether you use the demo or live environment, your account currency and when you connected.

Data from your Trading 212 account (read with your API key so the App can show it)

• cash, account value and open positions;
• orders and fills, including prices, quantities, fees, currency-conversion fees and exchange rates;
• deposits, withdrawals, transfers, dividends and interest;
• a daily record of your account value.

Your bots

• bot settings and tickers, open bot positions, buys, closed sells and profits;
• bot logs (activity, warnings and errors) and the bot's status;
• bot code you upload yourself (on servers that allow uploads).

Your use of the App

• your watchlist, price and dividend alerts and the alerts that fired;
• your tax-year setting;
• when you last closed the "Since your last visit" window and which bot versions you asked not to be reminded about.

Technical data

• the server's system log records each request to the server, including your IP address, the time and the address requested;
• your phone keeps your login token and the server address in its secure storage.

We do not collect your name, postal address, phone number, bank or card details, location, contacts or photos. The App has no advertising, no analytics or tracking tools and no cookies.

4. Why we use it and our legal basis

• To provide the service you asked for (legal basis: contract): your account and login, connecting to Trading 212, running your bots, syncing and showing your trading data, the wallet, watchlist and alerts, and password resets.
• To keep the service and your account secure (legal basis: legitimate interests): login lockouts, limits on reset attempts, server logs, finding and fixing errors.
• To meet legal obligations (legal basis: legal obligation), where the law requires us to keep or disclose information.

Your bots place orders only on the instructions and settings you give them. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

5. Who we share it with

We do not sell your data and we do not share it for marketing.

• Trading 212: the server uses your API key to read your account and, when you run a bot, to place the orders your bot decides on. Trading 212 handles that data under its own privacy policy.
• Our hosting provider (the company that rents us the server) stores and runs the server.
• Our email provider sends password-reset emails, so it receives your email address and the reset link.
• Yahoo Finance: the server asks Yahoo for market prices and dividend dates of ticker symbols. No personal data about you is sent.
• Authorities, where the law requires it.

The "Create bot using Claude AI" feature only shows you text to copy. The App sends nothing to Claude or Anthropic; whatever you paste there is between you and that service.

6. Transfers outside the UK

Your data is stored on our rented server. If any of our providers process personal data outside the UK, we make sure appropriate safeguards are in place as required by UK data protection law.

7. How long we keep it

• Account, Trading 212 data, bot data, watchlist and alerts: until you delete your account (in the App: Settings, Account, Delete account; we then delete them at once, and from backups within 30 days).
• Trading 212 API key and secret: deleted at once when you disconnect Trading 212 in Settings.
• Bot logs: all cleared every Sunday.
• Login sessions: end after 30 days with "Keep me logged in", otherwise after 24 hours at the latest.
• Reset codes: valid for 30 minutes.
• Server system log: for a limited time, normally a few weeks, then deleted automatically.
• Bots you remove from the User Bot library are kept in your account folder until your account is deleted.

8. How we protect it

• All traffic between the App and the server is encrypted (https).
• Passwords, security words, reset codes and login tokens are stored only as fingerprints.
• Trading 212 keys are stored encrypted and stay on the server.
• The App never holds your Trading 212 key or any market-data key.

No system is completely secure. If a data breach is likely to put your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.

9. Your rights

Under UK data protection law you have the right to:

• get a copy of your personal data;
• have wrong data corrected;
• have your data deleted;
• restrict or object to how we use it;
• receive the data you gave us in a common format (data portability).

You can delete your account and all its data yourself at any time in the App: Settings, Account, Delete account. It is deleted from the server at once.

To use any of the other rights, email tabu@tabuapp.uk from the email address of your account. We will answer within one month.

If you are unhappy with how we handle your data, please contact us first. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113.

10. Age

TABU is not intended for anyone under 18. We do not knowingly hold data about children.

11. Changes to this Privacy Policy

We may update this Privacy Policy. The App tells you about a new version in the "Since your last visit" window, with the date it changed.

12. Contact

www.tabuapp.uk

Email: tabu@tabuapp.uk