Privacy Policy

This policy describes what data NythosX collects, why, and your rights. It is written to be compatible with the EU General Data Protection Regulation (GDPR), the Philippine Data Privacy Act (RA 10173), and comparable frameworks. We aim to collect the minimum necessary to run the service.

1. What we collect

• Account data — email, display name, hashed password, tier, and timestamps.
• Configuration — the instruments, targets, and alert preferences you set.
• Positions — trades you log, including amounts, prices, and notes.
• Usage logs — sign-in events, admin actions, alert firings, and API key usage. Stored in our audit table.
• Session data — IP address and user-agent for each session, used to detect compromise.
• Payment data — handled entirely by Stripe. We never see card numbers.
• Facebook sign-in (optional) — if you choose “Continue with Facebook”, we receive your Facebook user ID, name, and email address from Meta. We do not receive your Facebook password, friends list, or posts, and we never post on your behalf.
• Facebook Messenger alerts (optional) — if you connect Messenger, we store the page-scoped ID Meta assigns to your chat with the NythosX Alerts page, your Messenger display name, and the time of your last message (needed to respect Messenger’s 24-hour reply window). Alerts waiting for delivery are kept for up to 7 days.

2. What we do NOT collect

• Exchange API keys.
• Bank account details.
• Identity documents.
• Location data beyond IP-derived country.

3. How we use it

• Deliver alerts you configured.
• Show your portfolio and analytics.
• Prevent fraud and abuse.
• Bill subscriptions and send service emails.
• Improve the product through aggregated, anonymised usage statistics.

4. Sharing

We share data only with:

• Cloudflare — hosting and D1 database.
• Resend — transactional email delivery.
• Stripe — payment processing.
• Meta Platforms (Facebook / Messenger) — only if you use Facebook sign-in or Messenger alerts. The alert messages you asked for (price alerts, news headlines, earnings reminders) are sent through Meta’s Messenger Platform and are subject to Meta’s Privacy Policy.

We do not sell your data to third parties or ad networks.

5. Retention

Account data is retained while your account is active. Audit logs are retained for 90 days. On account deletion, we purge your configuration, positions, API keys, and sessions from production within 30 days. A hashed record of deletion is kept for compliance.

5a. Deleting your Facebook data

You can remove the Facebook data we hold at any time:

• Messenger: Account → Notification channels → Messenger → Disconnect. This deletes your Messenger ID, name, and any pending alerts immediately.
• Facebook sign-in: Account → Profile → Facebook → Unlink. This deletes your Facebook user ID and name immediately.
• Everything: delete your account from Account → Sessions & data, or remove NythosX Alerts from your Facebook settings (Settings & privacy → Settings → Apps and websites) and email privacy@nythosx.com from your account email. We delete the data within 30 days and confirm by email.

6. Your rights (GDPR / RA 10173 / CCPA)

• Access — export all your data from Account → Sessions & data.
• Rectification — edit your profile from Account → Profile.
• Erasure — delete your account at any time. See retention above.
• Portability — same as access; export is machine-readable JSON.
• Objection — email privacy@nythosx.com.

7. Security

Passwords are hashed with PBKDF2-SHA-256 at 100,000 iterations. Sessions are stored as SHA-256 hashes. API keys are hashed at rest and shown only once. All traffic is served over HTTPS.

8. Cookies

We use nx_session to keep you signed in, nx_csrf to protect forms against cross-site requests, and, only during Facebook sign-in, a short-lived nx_fbstate cookie (10 minutes) to verify the sign-in came from you. They are Secure and SameSite=Lax. We do not use tracking cookies or third-party analytics cookies.

9. Children

NythosX is not for anyone under 18. We do not knowingly collect data from minors.

10. Contact

Data Protection Officer: privacy@nythosx.com.