Privacy Policy

Last prepared: October 30, 2026

Scope: This policy describes the intended private, read-only Alpaca Connect integration. That connection is not currently active. We will update this policy before enabling any additional functionality.

1. Who operates FNR Trade

FNR Trade is privately operated software for investment research and personal account monitoring. For inquiries about this policy, contact forrestroth@yahoo.com.

2. Information processed

When an account connection is enabled and authorized, the platform is designed to receive brokerage account identifiers and status, balances and buying power, positions, open and historical orders, and technical metadata necessary for connection and reconciliation. It may also process locally generated research signals, audit records and operational diagnostics. We do not request your Alpaca password.

3. Purpose and limits

We use this information to display account information, check discrepancies, monitor exposure, and evaluate trading-system safety. The proposed OAuth connection requests read-only permissions; it does not request the trading or account-write scopes. LIVE order submission is separate and remains disabled.

4. Disclosure to third parties

We do not sell brokerage-account information or use it for advertising. Alpaca processes brokerage information when an account connection is authorized. Infrastructure providers may process technical information needed to host and secure the service. No Alpaca Connect account authorization is currently active.

5. Security and credentials

The public website uses HTTPS. OAuth authorization is currently disabled. If a read-only connection is enabled, the gateway is designed to store access tokens encrypted on the server with restricted file permissions. Application secrets and access tokens are not intended for exposure through public pages. No security measure can guarantee absolute protection.

6. Retention and deletion

Public website requests may generate server logs containing IP addresses, timestamps, requested URLs, and browser information. Standard Nginx logs are currently rotated daily with up to 14 rotated copies; actual retention may also depend on backups and operational conditions. If OAuth authorization is enabled, temporary authorization states expire after five minutes, while encrypted access tokens may remain stored until manually removed. Revoking access through Alpaca does not automatically guarantee deletion of locally stored records. Research and diagnostic records may be retained separately without a fixed automatic deletion schedule. Contact forrestroth@yahoo.com to request review or deletion of information associated with the FNR Trade integration.

7. Your choices

Authorization is optional. You may decline the connection or revoke the app's account access through Alpaca's connected-application settings. Contact forrestroth@yahoo.com for information or deletion requests relating to FNR Trade.

8. Updates

We may update this policy to reflect actual features, integrations, and data-handling practices. Material changes will be presented before any expanded authorization.