1. Our Data Minimization Principle
ScalpLens was engineered from the ground up on the principle of data minimization. As an institutional-grade market scanner and closed-candle intelligence desk, our core mission is algorithmic market pattern analysis, not the harvesting or monetizing of user data.
We do not sell personal information, license trading data to market makers, or engage in cross-site tracking across the internet.
2. Categories of Information We Process
We collect and process only the minimal data points necessary to maintain terminal security, authenticate authorized operators, and deliver real-time WebSocket market intelligence:
| Category | Data Elements | Primary Purpose | Retention |
|---|---|---|---|
| Credentials | Operator Email, Argon2id Password Hash | Authentication & Access Control | Until account termination |
| Session State | HttpOnly Session Token, Device Binding Token | Mitigating session hijacking & unauthorized sharing | Session lifespan (max 30 days) |
| Desk Preferences | Audio Alert Volume, Active Filters, Column Sorts | Preserving personalized trader terminal UX | Local browser storage only |
| Security Logs | Anonymized IP Address, Request Timestamps, User-Agent | DDoS defense & rate-limit enforcement | Rolling 14-day log retention |
3. Strictly Necessary Operational Cookies
ScalpLens strictly employs operational first-party cookies essential for delivering authenticated market scanner feeds. Because these cookies are strictly necessary for core functionality and cybersecurity, they cannot be opted out of without disabling access to the trading desk.
| Cookie Key | Category | Security Attributes | Functional Description |
|---|---|---|---|
| v1_session | Strictly Necessary | HttpOnly, Secure, SameSite=Lax | Authenticates secure API endpoints & WebSocket channels. |
| v1_device | Strictly Necessary | HttpOnly, Secure, SameSite=Lax | Cryptographic hardware token verifying authorized terminal binding. |
4. Cryptographic Security Standards & Infrastructure
We protect all data at rest and in transit using rigorous security protocols:
- Argon2id Hashing: Passwords are never stored in plaintext. Passwords undergo memory-hard Argon2id key derivation resistant to GPU/ASIC cracking.
- TLS 1.3 Transport Encryption: All browser-to-server communications and WebSocket streams are encrypted using modern Transport Layer Security (TLS 1.3).
- Zero-Trust Device Binding: Each login establishes a cryptographically signed device fingerprint preventing credential sharing across unauthorized terminals.
- Rate Limiting & DDoS Shielding: Strict burst limits and IP reputation filters protect terminal availability without logging unnecessary personally identifiable information.
5. Global Privacy Rights (GDPR & CCPA Compliance)
Under global data protection regulations (including the EU General Data Protection Regulation and California Consumer Privacy Act), operators and users possess the following rights:
- Right to Access / Portability: You may request a machine-readable export of all account credentials and security records associated with your account.
- Right to Erasure ("Right to be Forgotten"): You may request immediate deletion of your account record and associated device fingerprints.
- Right to Rectification: You may correct inaccurate or obsolete profile metadata at any time.
To exercise any of these rights, contact our compliance team at privacy@scalplens.com. Requests are verified and fulfilled within 30 calendar days.
Frequently Asked Privacy Questions
Does ScalpLens sell, rent, or monetize personal user data?
No. ScalpLens adheres to a strict data minimization philosophy. We never sell, rent, lease, or monetize trader credentials, usage logs, or market desk telemetry with third parties, brokerages, or advertiser networks.
Does ScalpLens store exchange API private keys or cryptocurrency wallet seed phrases?
No. ScalpLens operates exclusively as an analytical market intelligence terminal monitoring public Binance Spot and MEXC Spot market feeds. It never requests, accesses, or stores private API trading keys, withdrawal credentials, or personal crypto wallet seed phrases.
What cookies and session identifiers are utilized by ScalpLens?
ScalpLens deploys only strictly necessary operational cookies: 'v1_session' (an encrypted HttpOnly session credential validating authenticated terminal and WebSocket stream access) and 'v1_device' (a hardware device token preventing unauthorized concurrent session hijacking). No third-party marketing or tracking cookies are used.
How does ScalpLens encrypt and protect stored user credentials?
All operator credentials are protected with Argon2id password hashing, constant-time verification against timing attacks, SameSite=Lax cookie policies, and strict HTTPS/TLS encryption across all endpoints.
How can users exercise data access or deletion rights under GDPR / CCPA?
Operators and users may request data export or permanent deletion of their account records at any time by contacting privacy@scalplens.com.
6. Related Legal Policies
For comprehensive terms governing platform usage and financial software disclaimers, please consult our Terms of Service and Financial Technology Risk Disclosure.