Shibiki

Privacy Policy

Last updated : 2026-07-04

1. Who we are

Shibiki is operated during the beta by Mathieu Hara, France as data controller. A SAS Shibiki (in formation) will succeed to the role upon incorporation ; users will be notified when the transition occurs. For data-protection questions write to privacy@shibiki.com.

2. What we collect

We process the categories of personal data below :

  • Account data — email, hashed password (bcrypt-equivalent), session JWTs, profile preferences.
  • Trading data — trades you log or that sync from connected brokers, journal entries, strategy definitions, calibration results.
  • Broker credentials — encrypted at rest using a per-deployment master key. Shibiki staff cannot read them.
  • Payment data — handled exclusively by Stripe ; we receive only a Stripe customer ID and subscription status. We never see your card number.
  • Telemetry — when Sentry is configured we capture error stack traces (no body / form data is sent). When Synti AI is enabled, your chat prompts are sent to Anthropic for response generation (see "Third parties" below).
  • Server logs — IP, user-agent, request path, status code. Kept for 30 days for abuse detection.

3. Why we process it (legal basis)

  • Contract — providing the Service you subscribed to.
  • Legitimate interest — abuse prevention, fraud detection, security.
  • Consent — optional product emails and Synti AI assistant usage (opt-in, revocable).
  • Legal obligation — tax records, retention required by accounting law.

4. Third parties

We share data with the following processors strictly to operate the Service :

Brokers you connect (FTMO, MetaQuotes, Tradovate, ProjectX, cTrader …) are independent controllers — their privacy policies apply to the data they hold on you directly.

5. How long we keep it

  • Active account data — for as long as your account is active.
  • After account closure — personal data is deleted within 30 days ; de-identified analytics may be retained.
  • Payment / tax records — retained per legal obligation (typically 7 years in most jurisdictions).
  • Server logs — 30 days.
  • Backups — Litestream WAL retention up to 30 days, point-in-time restore.

6. Your rights

Under GDPR and similar regimes you can :

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Erase your account and associated personal data.
  • Export your data in a portable format (JSON).
  • Restrict or object to certain processing.
  • Lodge a complaint with your local supervisory authority (e.g. CNIL in France, ICO in the UK).

Email privacy@shibiki.com and we will respond within 30 days.

7. Security

Data in transit uses TLS 1.2+. At rest, the SQLite database is stored on encrypted volumes ; broker credentials are additionally encrypted at the application layer with a per-deployment key. Access to production systems is restricted to authorised operators and audited.

No system is perfectly secure. We will notify affected users without undue delay if a breach materially affects their personal data.

8. International transfers

Production application hosting is in the Paris (CDG) region on Fly.io. Encrypted SQLite WAL backups are replicated to AWS S3 in the eu-west-3 (Paris) region. Sub-processors located outside the EEA (Stripe US, Anthropic US, Sentry US) receive data only for the specific operations described in section 4, under Standard Contractual Clauses.

9. Cookies

Shibiki uses a single first-party JWT cookie equivalent (stored in localStorage) for session continuity. No third-party advertising or analytics cookies are used.

10. Children

The Service is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has registered, contact us and we will delete the account.

11. Changes

We may update this Policy. Material changes will be notified via email or in-app at least 14 days before they take effect. See also the Terms of Service.

12. Contact

privacy@shibiki.com