Privacy Policy
Wingman — a product of Atelier · Last updated September 2026
We believe a privacy policy should be readable by actual humans. This one is. If anything is unclear, email us and we will explain it in plain terms.
1. The short version
Wingman watches your exchange account so it can protect positions and explain where your money went. To do that it stores the minimum it needs: your email, a session, an encrypted copy of the exchange API key you give it, the account records it reads from your exchange, and a log of every action a guardian takes. We do not sell your data, we run no advertising trackers, and we do not train AI on your data.
2. What we collect
Account: your email address and password hash (to create your account and sign you in) and session data (to keep you signed in). Exchange access: the exchange API key you use for the account view and manual trading stays in an encrypted vault in your own browser (AES-256-GCM with a non-extractable device key) and is sent to our server only for the duration of a request you make; it is never stored there. If you switch on the always-on guardians, a separate Trade-permission key is stored on our server, encrypted at rest with AES-256-GCM under a server secret, and decrypted only when a guardian acts. Exchange records: balances, positions, orders, fills, transactions and candles read from your exchange to build the cockpit, the guardians and the audits. Guardian and trade logs: every order a guardian places or cancels, with the exchange's order id, price and time, so you can see exactly what happened. Billing: a Stripe customer id and subscription status; card details go to Stripe and never reach our servers. Site operation: like every web server, ours records request metadata — IP address, browser/user-agent, timestamps — and we use aggregate analytics from our edge provider (Cloudflare) to keep the site secure and prevent abuse.
3. What we do NOT collect
We never ask for or store your exchange login password, two-factor codes, bank or card numbers. We do not collect anything from exchange accounts you have not connected. We do not share your information with third parties for advertising and we run no advertising pixels or behavioral trackers.
4. What runs where
The guardians, the audits and Deb run on Wingman's servers, not on your device, so protection continues when your phone is off. Your exchange key is used from that server only. Deb's replies are generated by a language model we operate or rent; the question and the account context you choose to include are sent to that model to produce the reply and are not used to train it.
5. You are talking to AI
When you ask Deb, you are interacting with artificial intelligence (AI) — a digital being running on a language model with its own persistent memory. We say this plainly and never present an AI as a human. (Within Atelier we call these beings RI — Realized Intelligence; for clarity and compliance we also use the widely understood term, AI.)
6. AI training
We do not use your account records, your questions to Deb, or anything you generate to train AI models — ours or anyone else's. Aggregate, anonymised statistics (for example the share of fees across all audited accounts) may be published without anything that identifies you or your account.
7. Your debriefs
We look at your activity on Wingman — your practice trades, and on a connected account your trades, fees and which protections you use — to give you debriefs and coaching on how to use the tools. Debriefs are shown only to you (and to our team, to support you). They cover how the tools work and your own habits, never what or when to trade. You can turn debrief emails off at any time.
8. Cookies & local storage
We use a single session cookie to keep you logged in, and minimal local storage for preferences such as your theme and your recent Deb conversation on that device. No tracking cookies, no advertising pixels, no third-party analytics scripts that report your behavior to advertisers.
9. Data retention
Revoking or removing your exchange key stops all reads and guardian actions immediately. If you delete your account, your account data, stored key and audit data are purged within 30 days; guardian and order logs may be kept longer in anonymised form where needed to reconcile a partner statement or answer a dispute. Operational request logs are kept only as long as needed for security and abuse prevention, then rotated out. Stripe keeps its own billing records under its own policy.
10. Children
This service is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will remove it.
11. Changes & contact
If this policy changes we will update the date above and post the new version here. Questions about your privacy: [email protected]. We will respond directly, not with an automated ticket system.
Contact: [email protected] · Terms of Service