Privacy Policy
This policy explains what DripBot collects, why, and what we do with it. We collect as little as possible.
1. What we collect
- Account details — your name, email address, and a hashed password. We never store passwords in readable form.
- Exchange API credentials — the API key and secret you choose to connect.
- Trading activity — records of positions the software opens and closes on your account, so your dashboard can display them.
- Payment records — subscription status and payment confirmations. Cryptocurrency payments are processed by NOWPayments; we do not see or store wallet credentials.
We do not use advertising trackers or third-party analytics that profile you.
2. How API keys are protected
Your API key and secret are encrypted with AES-256-GCM before being written to disk. The encryption key is stored separately from the database, outside the application, readable only by the service account. Keys are decrypted only inside the isolated process that trades your account — never in the web application, and never displayed back to you.
Before any key is stored, we verify its permissions directly with the exchange. Keys with withdrawal permission are rejected. We recommend restricting your key to our server's IP address.
3. Why we hold this data
We process your data to provide the Service you asked for: authenticating you, running the software on your account, showing your results, and managing your subscription. We keep payment records where required for accounting purposes.
4. Who we share it with
We do not sell your data or share it for marketing. Limited data is handled by infrastructure providers acting on our behalf: our hosting provider (Hetzner, Germany), our network and DNS provider (Cloudflare), and our payment processor (NOWPayments) for subscription payments. Public Telegram channels show our own trading activity, never yours.
5. Your rights
You can request a copy of your data, correct it, or have it deleted, by emailing hello@dripbot.app. If you are in the EU or UK, you have these rights under the GDPR, including the right to complain to your local data protection authority.
You can remove your API credentials from our systems at any time by deleting the key on your exchange and deleting your account. Deleting your account removes your credentials and personal data; anonymised records may be retained where required by law.
6. Retention
Account and trading data is kept while your account is active. On deletion, credentials are removed immediately and remaining personal data within 30 days, except where law requires longer.
7. Contact
Data questions: hello@dripbot.app