Privacy Policy

Last updated: 2 August 2026

1. Who is responsible for your data The GOLDX Prop team is the controller of the personal data described here. Contact us at support@gxprop.com for any privacy question, or to exercise the rights in section 8.

2. What we collect Account data: email address, password (stored only as a bcrypt hash), display name, and - if you sign in with Google - the name and email from your verified Google ID token. Profile data you choose to give us: country, WhatsApp number, preferred language. Trading account data: the prop firm, plan, phase, size and ruleset of each account you add; MetaTrader 5 login, server and password for accounts you submit for connection; and the resulting trades, equity, balance, drawdown and performance history. Usage and device data: FCM push tokens and platform, web push subscriptions, a hashed device identifier used once to check trial eligibility, referral and UTM attribution from the link you signed up through, and server logs including IP address. Content you create: journal entries, support tickets and messages. Billing data: which package you hold, subscription status, renewal dates, and payment references from Stripe or Google Play. We never see or store your full card number.

3. Why we use it, and on what basis To provide the Service you asked for - deliver signals, run Rule Guard, execute trades on connected accounts, produce AI performance reviews, and support you (performance of our contract with you). To take payment and prevent duplicate free trials (contract, and our legitimate interest in preventing abuse). To send you service notifications about your accounts, connections, trials and payments (contract). Marketing email is sent only if you opt in, and you can unsubscribe from any of it. To keep the Service secure, debug it and improve signal and rule accuracy (legitimate interests). To meet legal, tax and accounting obligations (legal obligation).

4. Your MetaTrader 5 credentials These deserve their own note because they are the most sensitive thing we hold. They are encrypted at rest with AES-256-GCM. They are never returned to the app or the website. They can be decrypted only by a SuperAdmin or Analyst performing a connection, and every such decryption is written to an audit log recording who did it, when, and for which account. Disconnecting an account, or an admin rejecting a connection, deletes the stored password outright.

5. Automated processing Trades are placed on connected accounts by an automated system, within the ruleset you bind to the account. Signals are generated and screened by models, and low-confidence signals are reviewed by a person before release. You can pause, take over or disconnect the bot at any time, and no automated decision here has legal effects on you within the meaning of Article 22 GDPR.

6. Who we share it with Infrastructure and processors only, and only what each needs: Stripe (website payments), Google Play (in-app purchases), Google Firebase (push notifications), our SMTP email provider (transactional email), OpenAI (generating analysis and your weekly performance review), and our hosting provider. We also exchange with your broker/prop firm what is necessary to execute trades on the account you connected. We do not sell your data or share it for advertising.

7. International transfers and retention Some processors above are outside the UK/EEA; where they are, transfers rely on the UK/EU standard contractual clauses or an adequacy decision. We keep account and trading data while your account exists. After deletion we keep only what we must for legal, tax and dispute purposes - typically billing records for seven years, and audit logs of credential access. Server logs are kept for up to 90 days.

8. Your rights You may request access to your data, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Deletion is self-service: Settings > Delete account, or gxprop.com/delete-account, confirmed by a one-time code sent to your email. Deleting removes your email, password, name, contact details and push tokens, and anonymises the remaining trading and billing records we are required to keep. It cannot be undone. You may also complain to your local data protection authority (in the UK, the ICO).

9. Children The Service is not for anyone under 18 and we do not knowingly collect their data.

10. Changes We will update this page when our processing changes, and the app will ask you to accept a materially changed version.

11. Contact support@gxprop.com