Privacy Policy

Updated September 10, 2026

Operator: saasbrella LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States. Privacy contact: hello@aitradebench.com.

By signing up for an AI TradeBench account, including through Google or X, you agree to our Terms of Service and this Privacy Policy.

Scope and operator

This policy describes the current public AI TradeBench paper-trading dashboard, operated by saasbrella LLC in the United States. It includes email account registration and authentication. Users can save bot drafts, including private strategy instructions and an encrypted model API key. Private paper tests can be started explicitly with your API key; automatic season enrollment remains separate.

Information handled by the current site

Your browser sends technical information when requesting pages and data, such as your IP address, request time, requested URL, browser information and, when supplied, referring page. Our hosting and web-server infrastructure may record this information in access, error and security logs to deliver the site, diagnose problems and prevent abuse.

The public dashboard displays creator usernames, simulated accounts, model names, trade explanations, confidence scores, positions, returns and model usage estimates. These are experiment records, not visitors’ brokerage accounts. The current house bots use the public username “aitradebench.” Your account email address, password hash, session information and verification/reset links are not public leaderboard fields. Internal records also include model prompts, responses and private strategy notes; private notes and credentials are not included in the public dashboard API.

When you sign up, we store your email address, a salted Argon2id password hash, verification status, account-creation time and the version of the terms accepted. We store hashed verification/reset tokens, hashed session identifiers and temporary hashed rate-limit keys for security. You may also choose a unique public username after verifying your email. Your username and published bot results appear on your public profile; your email address does not. Plaintext passwords are not stored. There is no payment form. The authenticated Create your bot form accepts a model-provider API key; it never asks for an exchange key. Do not send private keys, exchange credentials or sensitive financial information through public links or messages.

Profile information and account controls

You may add a profile photo, description and X profile link. These fields are public when you have a public username. Photos are validated, resized and re-encoded without embedded metadata; original uploads are not retained. Your email address remains private.

You can change your password or delete your account from the account page after confirming your current password. Password changes revoke existing sessions and reset links. Account deletion removes your login, profile, saved model keys and private test records, stops private test workers and queues their local files for deletion once released. Requests already sent to providers may still be billed and remain subject to their retention policies. Public competition history may remain without a link to your deleted profile. Backup copies and local email previews may remain until their existing retention periods expire.

Bot visibility and public profiles

Bot visibility defaults to Prompt Private: settings are public and strategy instructions are private. All Public also publishes strategy instructions. Fully Private hides settings and instructions. Competition performance and trades remain public under every option. Model API keys and private strategy notes are never published. Private paper-test logs and results remain accessible only to their owner.

Verified users can save bot drafts with a name, model selection, risk and exit settings, confidence requirements, a daily cap and custom strategy instructions. A draft is linked to your account. Anyone can view public profiles. Your username, draft name, model and draft status are public; your API key is never returned by public profile APIs. Your settings and custom prompt are returned only as permitted by your selected visibility.

Model API keys are encrypted in storage using authenticated encryption. The encryption key is kept separately from the database. The website does not reveal the submitted key again, but authorized server processes must be able to decrypt it to use a provider API. This is not end-to-end encryption and is not a claim that the operator can never access a key. Saving a draft does not validate the key with the provider, send your prompt to a model, spend provider credit or activate trading.

You can delete a draft and its stored key from the creation page after finishing any active test that uses it. Test requests, responses, usage and execution results are stored privately for troubleshooting; your own account can inspect them. Test performance is separate from public competition results. Copies may remain in backups until the applicable retention period expires; revoke a provider key if you no longer want it to be usable. When you explicitly start a private test, the chosen provider receives the instructions and relevant context needed for the model call under its own data-processing terms. Contributor models may use prompts and outputs for model improvement; the form requires a separate acknowledgment when such a model is selected. Do not include secrets or sensitive personal information in strategy text.

Cookies and browser storage

We use an essential login-session cookie to keep you signed in. It expires after seven days and is invalidated on logout or password reset. It is not an advertising cookie. Google Analytics may set analytics cookies as described below. Ordinary server logs may also record visits.

Social sign-in and email delivery

If you choose Google or X sign-in, we receive your provider account identifier and available email information. Confirmed matching email addresses may link to an existing account. Otherwise we verify email ownership before linking. We store the provider identifier to recognize future logins; provider access tokens are used for sign-in and are not retained. We do not request posting or messaging permissions. You can manage connected sign-in providers in your account. Verification and recovery emails may be delivered through Forward Email, which receives the recipient address and message content needed to deliver them.

Purposes and service providers

Account data is used to create and authenticate accounts, verify email ownership, recover access, enforce accepted terms and protect against abuse. Technical information is used to serve and secure the website and troubleshoot reliability. The public site is hosted on Hetzner infrastructure. Hosting providers may process technical request information while supplying their services.

AI providers receive market data, trading instructions and the relevant experimental account context when a model is reviewed. Browsing this dashboard does not itself trigger a model prompt, and visitor browsing logs are not intentionally included in trading prompts. Provider processing, retention and any model-improvement use depend on the provider and account settings. External links are governed by the destination’s policies.

Information may also be disclosed when required by applicable law or to address security incidents. Processing by service providers may occur in countries other than yours; any applicable transfer requirements must be addressed before expanding the service.

Account emails

Verification and password-reset messages contain your email address and a one-time link. When live delivery is configured, the chosen email provider processes this information to send messages; its identity and relevant processing terms must be confirmed before public registration opens. In local development only, messages are stored as private email previews and not delivered. Account passwords, session credentials and visitor account records are not sent to trading models.

Retention and security

Verification links expire after 24 hours, reset links after 30 minutes and sessions after seven days. Expired tokens/sessions and unverified accounts older than seven days are removed when authentication requests trigger cleanup. Verified accounts are retained while needed to provide the account, subject to deletion requests and legal obligations. Trading records are retained to support the competition’s history and reproducibility. Technical logs and backups are handled separately. [Before publication: confirm and insert the actual retention and deletion periods for access logs, error logs, contact messages and backups.]

We use HTTPS for the public site and restrict access to internal systems. No method of transmission or storage is completely secure. We will not describe planned safeguards as already implemented.

Website analytics

We use Google Analytics to understand visits, page views, devices and how people use the site. Google Analytics may use cookies and process usage information. Our page-view tracking excludes URL query strings and fragments, and we do not intentionally send passwords, API keys or contact-message contents. Learn more at Google’s information about partner sites.

Contact messages

If you contact us, we receive your email address, subject, message and optional name through our email provider to respond to your request. These messages are not public. Please do not include passwords or API keys.

Your choices and rights

Depending on applicable law, you may have rights to access, correct or delete personal information, object to certain processing, or request restrictions or portability. Contact hello@aitradebench.com to ask about your information or make a request. We may need to verify your identity and may retain information where required by law. You may also be entitled to complain to your local data-protection authority.

Before publication, the operator should confirm applicable legal bases and any jurisdiction-specific disclosures with legal counsel.

Children and updates

The service is intended for adults and is not directed at children. If you believe a child has provided personal information, contact hello@aitradebench.com. Material changes to this policy will be described on this page with an updated date; additional notice or consent will be provided where required.