Project YPrivacy Policy
Version 2026-10-24 · Effective 2026-10-24
1. Who we are
Project Y is run by Atipatr Noratos, an individual based in Thailand. We decide how your personal data is used and are responsible for it. Contact us about privacy at support@useprojecty.com.
2. What we collect
- Account: your name, email address, whether it is verified, your password (stored only as a hash) and two-factor settings. If you sign in with Google, we receive your name, email address and profile picture from Google.
- Sign-in and security: your sessions, with the IP address and browser details they were opened from.
- Exchange connections: the API keys you connect, encrypted with AES-256-GCM before they are stored, and the exchange account identifiers we use to confirm which account a live bot trades on.
- What you build: your strategy descriptions, chats with Agent Y, generated rules and code, backtests, audits, validation runs, bots, paper trades and live orders.
- Billing: your plan, its status and the Stripe customer and payment references. Stripe holds your card details, and we do not see your full card number.
- Records: your AI usage cost, notifications and notification settings, which legal documents you accepted and when, and whether you were let into early access.
- Messages to us: anything you send to support.
- Referral tag: if you arrive from a link with a
reforutm_sourcetag, we keep that tag and attach it to a purchase, so we know which channel it came from.
3. How we use it
- to run Project Y: build strategies, run backtests and bots, and place the orders you approve;
- to take payments and give refunds;
- to send emails about your account, security, billing and your bots, as set in your notification settings;
- to keep the service secure, prevent abuse and fix errors;
- to follow the law, including tax and accounting rules.
We do this to provide the service you signed up for, to meet legal duties, and for our legitimate interest in keeping Project Y safe and working. We do not sell your personal data, and we do not use it for advertising.
4. AI
When you use AI features, your descriptions, chats and the strategy they are about are sent to Anthropic to produce a response. Anthropic processes this under its commercial terms for API customers. Do not put personal details, passwords or API keys into a chat.
If you turn on “Help improve Agent Y” in Settings, we also save your Agent Y chats so our team can find and fix the AI’s mistakes. This is off unless you turn it on, it applies only during early access, and you can turn it off at any time. Saved chats are kept in our logs and expire with them (see section 8); passwords and API keys are removed before saving.
5. Who we share it with
These service providers process data for us, only to provide their service:
| Provider | What for | Where |
|---|---|---|
| Railway | Hosts the web app, the bot engine and the Redis queueSingapore | Singapore |
| Neon | Hosts our Postgres databaseSingapore | Singapore |
| Anthropic | AI that turns your descriptions and chats into strategies and answersUnited States | United States |
| Stripe | Payments, invoices and refundsUnited States and other countries | United States and other countries |
| Resend | Sends account, security, billing and bot alert emailsUnited States | United States |
| Sentry | Error reports, so we can fix what breaksUnited States | United States |
| Better Stack | Application logsUnited States and the European Union | United States and the European Union |
| Sign in with Google, if you choose itUnited States and other countries | United States and other countries |
When you connect an exchange such as Binance, your orders and account requests go to that exchange under its own privacy policy. Market prices come from public exchange data and contain no personal data. We may also share data when the law requires it, or with a buyer if Project Y is sold, under this policy.
6. Where your data is
Our database and servers are in Singapore. Some providers above process data in the United States or other countries. Where the law requires it, we rely on safeguards such as standard contractual clauses offered by those providers.
7. Cookies and storage on your device
- Sign-in cookies: keep you signed in. Needed for the service to work.
- Sign-up consent cookie: remembers for up to 30 minutes that you agreed to the terms while you finish signing up.
- Referral cookie: holds a referral tag for 30 days.
- Local storage: keeps drafts and layout choices on your device only.
We use no analytics or advertising cookies. If a page breaks, an error report goes to Sentry so we can fix it.
8. How long we keep it
We keep your data while your account is open. When you ask us to delete your account, we delete or anonymise your personal data within 30 days, except billing and legal acceptance records, which we keep as long as tax and accounting law requires. Logs, error reports and backups expire on their own, within 90 days.
9. Your rights
You can ask to see, correct, export or delete your data, or object to how we use it. Email support@useprojecty.com. We answer within 30 days and may ask you to confirm it is you. You can also complain to the data protection authority where you live.
10. Security
Exchange keys are encrypted at rest, passwords are stored only as hashes, connections use HTTPS and two-factor authentication is available. No system is perfectly secure. If you think your account or keys are at risk, revoke the keys on your exchange and email us.
11. Children
Project Y is for people aged 18 and over. If we learn that someone under 18 has an account, we close it and delete their data.
12. Changes
When we change this policy, we publish a new version with a new date. For changes that matter, we ask you to accept the new version in the app.