Privacy Policy

Last updated: 4 October 2026 · Copymoar, 34365 Istanbul, Turkey · support@copymoar.com

Copymoar is a trade-copying app for futures traders. It is not a broker, not an investment adviser, and gives no trading advice. On the desktop plan the copier runs entirely on your own machine; on hosted plans, where offered, the copier runs on infrastructure we manage for you, and this policy describes both honestly. Our guiding rule is to collect as little as possible to run your account, deliver the app, bill you correctly, and defend ourselves when a charge is disputed — and nothing more.

Who we are

Copymoar is operated by Copymoar ("Copymoar", "we", "us", "our"), 34365 Istanbul, Turkey, the entity responsible for the personal data described here. If you have any question about this policy or wish to exercise a privacy right, you can reach us using the details in the Contact section below.

The short version

• On the desktop plan, your broker logins, your order flow, and your funds never touch our servers. Copymoar runs locally on your computer and connects directly to your brokers. We do not receive, store, or have any access to your broker credentials or the contents of your orders.
• On hosted plans, where offered, your copier engine runs on infrastructure we operate, so it — not your PC — holds your broker sessions and processes your orders there, in an environment isolated per customer.
• On every plan, your money moves only between you and your broker — never through us. We never custody, route, or touch funds.
• We keep a small set of account, acceptance, sign-in, and billing records so that we can prove what you bought, that you agreed to our terms, and that the product was delivered.

What we collect

• Account email address — to create your account, sign you in, send essential service and billing notices, and respond to support requests.
• Subscription and payment events (via Whop) — which plan you hold; whether it is active, in trial, expired, cancelled, refunded, or disputed; and the timestamps of those events. This comes to us from Whop, our billing provider; we never see or store your card number.
• Acceptance records — the fact, time, and document version of your acceptance of our Terms of Service, Return & Refund Policy, Privacy Policy, Risk Disclosure, and EULA, whether given at checkout (recorded by Whop and passed to us) or at first launch of the app (recorded by the app and sent to our account server when the app is signed in).
• Device identifier and sign-in records — a per-install identifier (X-Client-Id) that we generate to bind your session to your device and to prevent token theft and credential sharing, together with the time of each sign-in and of last activity, and the IP address the request came from. The identifier is not a hardware fingerprint and does not identify you personally.
• Licence activation and update records — when the app checked its entitlement and which version it installed, so we can show that the product was delivered and support you.
• Optional support logs — if you contact us with a problem, you may choose to send us diagnostic logs (a support bundle). These are provided by you, only when you decide to share them, and are used only to resolve your issue. Support bundles may contain broker account identifiers and order details from your machine; the app masks credentials before export.
• Support correspondence — emails and community messages you send us.
• Basic operational logs — standard server logs (timestamps, IP address, request path and status) generated when the app or your browser talks to our account, licensing, or website servers, retained for security and troubleshooting.

What we never collect or handle on the desktop plan

On the desktop plan, the following never leaves your computer and is never transmitted to, stored by, or accessible to Copymoar:

• Your broker usernames, passwords, API keys, and access tokens.
• Your order flow — the orders, fills, positions, and live P&L generated by your trading.
• Your funds. Money moves only between you and your broker; we are not a broker and never custody, route, or touch your funds.
• Your copy configuration (leaders, followers, sizing, and risk rules).

All of the above is stored locally on your own machine and is used by the app to copy trades and enforce your risk rules. You control it directly, and you can remove it at any time by deleting it in the app. One exception you control: when you connect a broker through its "Sign in with" (OAuth) flow, the broker's token passes through our server once, in memory only, to reach your app, and is deleted the moment your app has collected it.

Hosted plans (where offered)

Hosted plans exist so your copier can run without your PC staying on. That necessarily means the copier engine — and the trading state it needs — runs on servers we operate. Plainly:

• Where your engine runs. A hosted plan provisions an isolated, single-customer engine environment on infrastructure we operate with our hosting providers (currently in the United States).
• Broker credentials. When you connect a broker to a hosted engine, your credentials travel over an encrypted, sealed channel from your browser to your engine. Our web and account servers pass the sealed payload through and cannot read it. Your engine holds the broker session so it can trade for you; you can disconnect a broker at any time from the app, which removes the stored credentials from your engine.
• Order flow and configuration. Your hosted engine processes and stores your orders, fills, positions, and copy configuration in your isolated engine environment, because that is what it needs to copy trades and enforce your risk rules. This data is used to run your copier — never for advertising, profiling, or sale.
• The browser viewer. The paired viewer shows your engine's live state in your browser over an encrypted connection tied to your account session. Viewer traffic passes through our relay to reach your engine; the relay exists only to connect the two ends of your own session.
• Infrastructure access. Our operations team can access the underlying servers for provisioning, maintenance, and support, limited to what operating the service requires. If you ask us to troubleshoot your engine, we may view its logs and state as part of resolving your issue.
• Retention and deletion. Your engine and its data exist for as long as your hosted subscription is active. When it ends, your dedicated engine environment is decommissioned and its stored broker credentials and trading state are deleted, subject to short-lived backups and operational logs which expire on a rolling basis.

Payments

Billing is handled by Whop, our merchant of record. When you subscribe, Whop processes your payment and card details under its own privacy policy — we never see or store your card number. We receive your subscription status and payment events so we can unlock the app and keep accurate billing records. See Whop's privacy terms at whop.com/privacy.

How we use what we collect

• To create and authenticate your account and keep your session secure.
• To deliver the app, signed auto-updates, and the features your plan includes.
• To provide support and send essential service or billing notifications.
• To protect the service against fraud, abuse, credential theft, and account sharing.
• To keep accurate billing records and to respond to refund requests, payment disputes, and chargebacks with evidence of acceptance, delivery, and use.
• To comply with legal obligations and to establish, exercise, or defend legal claims.

We do not sell, rent, or trade your personal data, and we do not use it for third-party advertising or profiling.

Email practices

We send two kinds of email. Transactional email — account, security, support, billing, and trial-status notices that are necessary to operate the service you signed up for; these cannot be opted out of while you hold an account. Occasional product announcements — updates about the service sent to account holders; every such email includes an unsubscribe link that works immediately. All email we send uses honest, accurate sender names and subject lines and clearly identifies Copymoar as the sender. To opt out of non-essential mail, use the unsubscribe link in the email, or contact us at support@copymoar.com.

Sharing

We share data only with the service providers needed to run Copymoar — our billing provider (Whop), our hosting and infrastructure providers, and our email delivery provider — and only to the extent they need it to perform their function on our behalf. When a payment is disputed, we share the acceptance, sign-in, activation, and support records described above with Whop, the card network, and the bank or payment provider deciding the dispute, because that is what those processes require. We do not sell personal data. We may disclose information where we are legally required to do so, or to protect our rights, users, or the security of the service.

Lawful basis for processing

Where applicable data-protection law (such as the EU/UK GDPR) requires a lawful basis, we rely on: performance of a contract — to create your account, deliver the app, bill you, and provide the features and support you signed up for; legitimate interests — to secure the service, prevent fraud, credential theft, and account sharing, troubleshoot problems, and establish, exercise, or defend legal claims including payment disputes, balanced against your rights; legal obligation — to keep limited records we are required by law to retain and to respond to lawful requests; and consent — for anything optional, such as diagnostic logs you choose to send us, which you can withdraw at any time.

Retention

We keep account data for as long as your account is active. Acceptance, sign-in, activation, subscription, and support records are kept for the life of your account and for twenty-four (24) months after it closes, or for as long as a refund request, payment dispute, chargeback, or legal claim remains open, whichever is longer, because card networks allow disputes for months after a payment. If you ask us to delete your account, we remove your account record and retain only these dispute-defence records and anything we are legally required to keep (for example, limited billing records held by Whop). Operational logs are kept only for as long as needed for security and troubleshooting and are then deleted or anonymised.

Your rights

Subject to applicable law, you may ask us to access, correct, export, or delete the account information we hold about you, to restrict or object to certain processing, and to withdraw consent for anything optional. Where the GDPR applies, you also have the right to lodge a complaint with your local data-protection authority. To exercise any right, contact us at support@copymoar.com. On the desktop plan your broker credentials and trade data live only on your own machine, so you control those directly by removing them in the app; on hosted plans you can disconnect brokers from the app at any time, and ending your hosted subscription decommissions your engine as described above.

Security

The desktop app is Apple-notarized and ships signed, verified auto-updates, so the version you run is the version we published. Sessions are bound to your device to limit token theft, and traffic to our account/licensing API is encrypted in transit. On the desktop plan, sensitive trading data — your credentials, orders, and configuration — stays on your computer and never reaches us. On hosted plans, credentials travel over an encrypted sealed channel to your isolated engine environment. No method of transmission or storage is perfectly secure, so while we work hard to protect your data we cannot guarantee absolute security.

International transfers

Copymoar and our service providers may process data in countries other than your own, including the United States and Turkey. Where we transfer personal data across borders, we take steps to ensure it remains protected in line with applicable law.

Children

Copymoar is intended for adults and is not directed to children. We do not knowingly collect personal data from anyone under the age of majority in their jurisdiction.

Governing law

This policy and any dispute relating to it are governed by the laws of the State of Delaware, USA, without regard to its conflict-of-laws rules, without prejudice to any mandatory data-protection rights you have under the law of your country.

Changes

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above and, where appropriate, communicated to you.

Contact

Copymoar, 34365 Istanbul, Turkey. Email: support@copymoar.com. Community support: the Copymoar Discord.