Privacy policy

Signing in

You sign in with Google, Microsoft, Discord, or an email address and password. The identity provider proves who you are; we receive and keep your provider account identifier, your email address and your display name. If Discord has not verified your account's email address, we do not keep it. We never see your Google, Microsoft or Discord password. Email accounts are held for us by Microsoft Entra External ID, which stores the password, verifies the address and handles resets under Microsoft's privacy terms.

Signing in sets a session cookie on your browser that keeps you signed in for up to 72 hours, and never more than thirty days after you signed in, plus the short-lived cookies the sign-in flow itself needs. There are no advertising or tracking cookies.

Exchange accounts

To trade, you give Aura API keys for your exchange accounts. The keys are encrypted the moment they reach the trading server for that exchange, with a key that is kept in a cloud key vault and is never written to the server's disk, and they are used only to place, amend and cancel your orders and to read your balances, positions and fills. They are not shown back to you or to us after you enter them. Removing an exchange account from the terminal deletes its keys; you can also revoke a key at the exchange at any time.

Trading data

We keep the orders you place through the terminal, the child orders and fills they produce at the exchange, the balances and positions the exchange reports for your accounts, and the analysis derived from them (such as execution-cost statistics). This is your order history and the record the terminal needs to manage working orders and to recover them after a restart. It is kept for as long as your account exists.

Preferences

Terminal layouts, watchlists and display preferences are stored with your account so they follow you between browsers, and some are mirrored in your browser's local storage so the terminal opens where you left it. Clearing site data in your browser removes the local copy.

Where it is kept and who else sees it

The service runs on Microsoft Azure in the United States. The identity providers you choose (Google, Microsoft, Discord) see that you signed in to Aura. The exchanges you connect receive your orders under your own API keys, exactly as if you had placed them at the exchange. We do not sell or share your data for advertising, and we do not use analytics or tracking services on the terminal or on this site.

Your choices

You can disconnect an exchange account at any time, which deletes its keys. To have your account and its history removed, or to ask what we hold about you, email support@auraterminal.io from the address you sign in with. Removal is permanent: order history cannot be restored afterwards.

Changes

When this page changes, the date at the top changes with it. A change that affects what we collect or who sees it is announced in the terminal before it takes effect.