Privacy policy

This page explains in plain language what data Nova processes, why, who we share it with and what your rights are. It applies to the novatradingapp.com website and the Nova app.

Who is responsible?

Nova trading, Waterstraat 30, 2490 Balen, Belgium, is the controller of your data.

Questions about privacy? Email nova@novatradingapp.com.

Your account

If you create an account, we store: your username, email address, password (only as a one-way hash, never readable), the secret key for two-factor authentication, your language and currency preference, your plan (free or Pro), when you accepted the terms, your settings and risk limits, and your simulated (paper) orders and positions.

If you connect an exchange, we store your API keys encrypted. We only use them for the actions you ask for. We always ask for keys without withdrawal rights.

Why: to make your account and the app work (performance of the contract).

Security

We keep a security log of sign-in attempts and important actions, with time and IP address. This helps prevent and investigate abuse and break-ins (legitimate interest).

Newsletter

If you subscribe to the newsletter, we store your email address, the website language at the time you subscribed, and the time and IP address of your subscription and confirmation. You first get an email to confirm your subscription.

The newsletter is sent with MailerLite (UAB MailerLite, EU), which processes the data only on our behalf. MailerLite also measures whether an email is opened and which links you click.

Why: because you gave your consent. You can unsubscribe at any time with one click at the bottom of every email. We keep your address until you unsubscribe; after that MailerLite only records that you unsubscribed, so you get no more emails.

Wallets (Swap and My wallet)

We never ask for your private key or recovery phrase. You sign every transaction yourself in your own wallet.

On the public Swap page and in My wallet we use your public wallet address only to read public blockchain data (such as balances) and to request a swap quote. We do not store that address or write it to logs. To do this, the address is sent to blockchain data providers (public RPC nodes or Alchemy) and, for a quote, to the swap service 0x. If you connect with WalletConnect, that connection runs through WalletConnect (Reown).

Exception: if, in your account, you accept the EURO risk notice by signing with your wallet, we store that wallet address, the signature, the time and your IP address as proof of that acceptance.

Completed swaps are counted without personal data (only a shortened hash of the transaction, to avoid counting twice).

Statistics

On the public website we count article views, swaps and sign-ups per week, without IP address, user id or other personal data.

If you arrive through a link with a campaign code (utm), we remember that code for 30 days in a cookie. If you create an account in that period, we link the code to your account so we know which channel works.

When you are signed in, we use Amplitude for product analytics: which screens and buttons are used, and session recordings in which text, input fields, amounts and addresses are masked. In the app we never send sign-in details, balances, wallet addresses, orders or codes to Amplitude. Amplitude may process data in the United States. Why: to improve the app (legitimate interest).

Payments and account emails

A Pro plan is paid through RevenueCat and Stripe, or through the app store. We never receive your card details, only the status of your plan.

Emails about your account (such as confirming your email address or resetting your password) are sent through Resend.

Cookies

We only use cookies that are necessary or explained above: a session cookie to keep you signed in, a “stay signed in” cookie (up to 30 days), a cookie with your invite code (30 days, only after an invite link) and the campaign cookie (30 days, only after a link with a campaign code). No advertising cookies and no third-party trackers on the public pages.

Who do we share data with?

Only with service providers we need to run Nova, and only what they need: hosting and database (Railway and our database provider), MailerLite (newsletter), Resend (account emails), Amplitude (product analytics), RevenueCat and Stripe (payments), and for Swap and wallets: 0x, WalletConnect (Reown) and blockchain data providers. If you connect an exchange, your orders go to that exchange.

Some providers process data outside the EU, for example in the United States. We only work with parties that offer appropriate safeguards, such as the EU Standard Contractual Clauses.

We never sell your data.

How long do we keep data?

Account data: as long as your account exists. If you ask us to delete your account, we erase your data, except what we are legally required to keep.

Newsletter: until you unsubscribe.

Security log: as long as needed for the security of the service.

Weekly statistics without personal data: up to two years.

Your rights

You have the right to access your data, have it corrected or erased, restrict its processing, object, take your data with you and withdraw a consent you gave. Email nova@novatradingapp.com to do so. We reply within one month.

If you are not satisfied, you can file a complaint with the Belgian Data Protection Authority (Rue de la Presse 35, 1000 Brussels, dataprotectionauthority.be).

How we protect your data

Passwords are only stored as a hash (argon2id), two-factor authentication is mandatory, exchange keys are encrypted and all traffic uses HTTPS.

Changes

If we change this policy, you will see it in the date at the top. For major changes we will let you know.