What we keep, and who can see it

• Your account: your email address and your public handle. If you set a password, we store only a scrypt hash of it, never the password itself.
• If you sign in with Google: Google’s id for your account, your profile picture’s address, and your name, which is used only to suggest a handle and is never shown.
• API keys: a hash and the first few characters, so you can tell your keys apart. The key itself is shown to you once and not kept.
• What you save: strategies and backtests you choose to save, their results and trades, and forward tests you start. A backtest you don’t save is not stored; it is only counted towards your monthly limit.
• Whether you’ve confirmed your email, and when.
• Whether you want product updates by email, and when you said so.

Your handle, your profile page and your public strategies and results. Your email address is never shown to anyone.

On the free plan, strategies you save are public; saving privately needs a paid plan. You are told which each time you save. A strategy you make private or delete comes off the public pages, results included.

One cookie keeps you signed in, for up to 30 days. A second, which says only that someone is signed in on this browser and nothing about who, lets pages show the right menu straight away. Signing in with Google adds two more that last ten minutes and are removed when you get back.

Session recordings add Microsoft Clarity’s cookies, and only if you allow them (see below). Your answer to that question is kept in your browser. Nothing else: visit counts use no cookies.

Only if you press Allow when asked. Microsoft Clarity then records how you use the pages — what you click, how far you scroll, which pages you open, and technical details such as your browser and screen size — so we can see where the site is confusing and fix it.

• The text on every page is hidden from the recording before it leaves your browser, and nothing you type into a field is recorded. Your strategies and results are not readable in a recording.
• Pages opened from an emailed link, such as a password reset, are never recorded.
• Clarity sets two cookies on this site to tie the pages of a visit together, and keeps one on its own address (clarity.ms) that tells it whether it has seen your browser before. Microsoft processes the recordings for us; see the Microsoft Privacy Statement.
• Nothing is used for advertising: we tell Clarity so, and the site blocks the request that would set Microsoft’s advertising identifier in your browser.
• You can change your answer at any time with “Cookie choices” at the foot of any page. Saying no stops the recording and removes the cookies Clarity set on this site. The one on clarity.ms is Microsoft’s to remove: it stays until it expires or you clear your browser’s cookies, but this site sends it nothing more.
• We ask again after six months, and a browser that sends the Global Privacy Control signal is treated as a no without being asked.

Emails about your account — confirming your address, password resets, changes to your plan — are sent because the account needs them.

Product updates and tips are sent only if you ticked the box when signing up or switched them on in your account. Each one has an unsubscribe link that works in one click, and the switch stays on your account page.

• Vercel runs the website. Like any web host it keeps short-lived request logs, which include IP addresses. Its Web Analytics counts page views and where visitors came from, without cookies and without storing who you are.
• Resend sends our emails — the link to confirm your address, password resets, notes about your plan and, if you asked for them, product updates — so it sees your email address and the message.
• Sentry receives a report when a page or request fails: what broke and on which page. We strip addresses’ query strings, cookies, headers and form contents before anything is sent.
• Neon hosts the database, in the United States.
• GitHub runs the job that updates forward tests, a few times a day.
• Cloudflare manages our domain and stores market data, which contains nothing about you. On the sign-up and password-reset forms, its Turnstile check looks at your browser to tell people from scripts.
• Google, only if you choose to sign in with it.
• Microsoft (Clarity), only if you allow session recordings: it receives the recording described above.

Market prices come from Binance’s public archive. Binance learns nothing about you from it.

You can change your handle and delete strategies yourself. To delete your account and everything in it, email support@aibacktester.app from the address on the account, and it will be done within 30 days.

AI Backtester is not meant for anyone under 18.

If what we collect changes, this page changes first, with a new date at the top. Questions go to support@aibacktester.app. See also the terms.