Privacy Policy

Last updated: July 8, 2026

This Privacy Policy explains how Tohora Karetao (the "Service") collects, uses, and shares information when you use it.

1. Information We Collect

We collect the following categories of information:

  • Account information: your email address and a securely hashed password.
  • Two-factor authentication data: an encrypted TOTP secret and hashed backup codes, if you choose to enable two-factor authentication.
  • Brokerage connection information: your Alpaca account identifier, and, if you connect an account manually, your Alpaca API key and secret (stored encrypted). If you connect via Alpaca's OAuth integration, we receive a temporary access token used only to look up your account identifier — we do not store this token.
  • Trading strategy and activity data: the strategies you configure and the resulting orders, positions, and performance data associated with your connected accounts.
  • Usage data: log data such as IP address, browser type, and pages visited.

2. How We Use Information

We use the information we collect to:

  • Provide, operate, and maintain the Service, including running your trading strategies;
  • Authenticate you and secure your account;
  • Communicate with you about your account, including confirmation and security emails;
  • Monitor and improve the Service; and
  • Comply with legal obligations.

3. How We Share Information

We share your brokerage connection information with Alpaca Securities LLC and/or Alpaca Crypto LLC ("Alpaca") solely to execute the trading activity you configure. We do not sell your personal information. We may share information with service providers who help us operate the Service, or when required by law, subpoena, or other legal process.

4. Data Security

We use industry-standard measures to protect your information, including encrypting sensitive fields such as API credentials and two-factor secrets at rest, and hashing passwords and backup codes. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. If you close your account, we will delete or anonymize your information within a reasonable period, except where we are required to retain it to comply with legal obligations, resolve disputes, or enforce our agreements.

6. Your Rights and Choices

You can review and update your account information, disconnect a brokerage account, or close your account at any time from your Account settings. You may contact us to request access to, correction of, or deletion of your personal information.

7. Cookies

We use essential cookies to keep you signed in and to protect the Service against cross-site request forgery. We do not use third-party advertising or tracking cookies.

8. Children's Privacy

The Service is not directed to, and we do not knowingly collect personal information from, anyone under the age of 18.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above.

10. Contact Us

Questions about this Privacy Policy can be sent via our contact page.