Privacy Policy

1. Summary

2. Your Fanout account

When you sign up we store your email address, your password as a salted scrypt hash (never the password itself), when you created the account and when you accepted the Terms and Risk Disclosure.

When you sign in we set one cookie, session, holding a random token. We store only a SHA-256 hash of that token, with your user ID and an expiry time, so a copy of our database can’t be used to sign in as you. Sessions last 30 days. We delete a session when you log out, and expired sessions are removed within a day.

3. The waitlist

If you join the waitlist we store your email address and, if you tell us, your prop firm (Vest, Breakout or other) and roughly how many accounts you run, plus which form you used and when. We use it only to invite you and to decide which firms to support next.

If you arrive through a creator’s referral link, we store its referral code with your waitlist entry or account and use it only to credit that creator. We don’t share your personal data with the creator.

4. Your venue connections

Vest

The Fanout Connector reads the session tokens your own signed-in Vest tab already uses and sends them to our server. Our servers never receive your Vest password or wallet keys. For your Vest connection we store:

• Your short-lived Vest access token (a JWT) and your Vest refresh token, both encrypted at rest with AES-256-GCM, and the access token’s expiry time. For cookie-based Vest sessions there is no refresh token to store, and only your Vest tab refreshes the session. Expired tokens we can no longer renew are erased within an hour.
• Your Vest user ID, the connection status and when it was last refreshed.

Per-account Vest tokens that we create from your session are kept only in our server’s memory. Your live Vest positions, balances and closed trades are read from Vest when you need them; we cache them in memory briefly and don’t store them in our database. Orders you place through Fanout are recorded in the order journal (see “Orders and trading data”).

When you disconnect, we erase the stored Vest tokens from our database and stop using them.

Breakout

Breakout orders run in your own signed-in Breakout tab. We don’t store any Breakout login, password or session token on our servers. The Connector sends us a snapshot of your Breakout accounts, which we store: account ID and name, status, balance, equity, unrealized P&L, starting balance, profit target, drawdown and daily-loss limits, and your open positions (pair, side, size, entry, mark, P&L, margin, leverage) and working orders. Breakout prices and candles the Connector relays are kept only in our server’s memory.

Connector and Runner pairing

Pairing uses a single-use link code and then a connector key. We store only SHA-256 hashes of both, plus when the key was created, last used or revoked. Each copy of the Connector also has an install ID: a Connect-page download carries one, and a Web Store copy gets one when it first links. We store each install ID with your account, how it was installed and when it was issued, last seen or revoked, and which copy linked each key.

5. Orders and trading data

To send orders safely and recover from dropped connections, we keep an order journal. For each order it stores:

• the account, venue and order type, and the order’s parameters (symbol, side, size, prices, leverage, take-profit and stop-loss);
• its status, the result the venue returned, any error code, and when it was created, sent and completed;
• any recovery decision you made for an order whose outcome was uncertain.

To debug failed orders, we also keep diagnostic logs of order requests and responses, with secrets removed, for 14 days: for each request the Fanout Connector sent to Vest or Breakout, its method, path, status, timing and header names and the venue’s response, with tokens, cookies, CSRF values, signatures and other secrets removed; for an accepted Vest market order, whether it filled; and changes in the shape (never the values) of the order and CSRF requests the Vest and Breakout pages themselves send.

We also store stop entries you place that the Fanout Runner holds for you, and the notes and tags you add in your trade journal.

6. Server logs

Our servers log each request, including your IP address, the page or API path (with its query string, except on admin pages), the response and its timing, and sometimes your Fanout user ID, venue account IDs and order details. We use logs to keep the Service running, debug problems and prevent abuse. We also count sign-in, sign-up and waitlist attempts per IP address in memory to rate-limit them.

7. Data kept on your device

Your browser

The web app saves your preferences in your browser’s local storage: per-account sizing, account nicknames, which accounts are picked (their venue account IDs), symbol, chart interval, layout and template, favourites, size and book units, order-ticket modes, quantity presets, hotkeys, sound and one-click settings. If you arrived through a referral link, it also keeps that referral code and sends it to us when you sign up or join the waitlist; nothing else there is sent to us. Logging out doesn’t clear it; your browser settings can. One dismissed notice is remembered in session storage, which clears when you close the tab.

The Fanout Connector

The Connector uses Chrome’s extension storage on your computer. Local storage holds your connector key and the linked email and user ID, a Web Store copy’s install token, your captured Vest session tokens, Breakout’s csrf-auth value, the query shapes of Breakout’s own price and candle requests, the shapes (never the values) of the venue pages’ order and CSRF requests, and an executor journal of orders it has run (orders still in progress keep a copy of your connector key). Session storage, which Chrome clears when the browser closes, holds Breakout’s per-order CSRF token and connection status. Breakout values are only ever sent back to Breakout. Unlinking the Connector clears the captured session tokens, Breakout’s CSRF values and the copies of your connector key. Removing the extension deletes all of this storage.

The Fanout Runner

The Runner stores its credentials in your Windows profile, encrypted with Windows Data Protection (DPAPI) for your user. Deleting its folder removes them.

8. No analytics, ads or selling

Fanout doesn’t use third-party analytics, advertising pixels, session recording or ad trackers, and our fonts are served from our own domain. We don’t sell your personal information, and we don’t share it for cross-context behavioural advertising.

Our marketing page asks our own server whether you’re signed in, so it can show “Open dashboard”. No other party sees that request.

9. Cookies

We use one cookie, session, and only after you sign in. It is strictly necessary to keep you signed in: it’s signed, HttpOnly, Secure, SameSite=Lax, and expires after 30 days or when you log out. We don’t use advertising, analytics or third-party cookies, which is why there’s no cookie banner. The local storage described above holds your preferences and any referral code, and isn’t used to track you.

10. How we use your data

• To create and secure your account and keep you signed in.
• To show your accounts and positions, and to send, track and reconcile the orders you place.
• To send you invites and service messages (for example security notices or changes to these terms).
• To keep the Service running, fix problems and prevent abuse.
• To meet legal obligations.

11. Who we share it with

• Our hosting provider. Fanout runs on Railway, which hosts our servers and our database in the United States and processes the data above on our behalf.
• Our payment processor. Stripe processes payments for paid plans. You enter your card on Stripe’s own checkout and billing pages; we never see or store your card number. Stripe receives your email and the plan you choose, and handles your payment data under its own privacy policy.
• The venues you connect. We send Vest your session token when we read your accounts and create per-account tokens for you. Your orders go to the venue from your own browser or PC.
• When the law requires it, or to protect the rights, safety or property of our users, Fanout or others.
• In a business transfer, such as a merger or sale, where the buyer keeps this policy’s protections.

12. How long we keep it

• Account data, venue connection data, the order journal and journal notes: for as long as you have an account. Deleting your account removes them.
• Plan and billing records: for as long as you have an account. Deleting your account cancels your plan with Stripe at once and deletes your Stripe customer record; Stripe keeps the payment records the law requires. If you took a founding seat, a record that the seat was used is kept, with nothing that identifies you, so the 100-seat count stays right.
• Sessions: 30 days, or until you log out; expired sessions are removed within a day.
• Order diagnostic logs (requests and responses, secrets removed): 14 days.
• Pairing link codes: they expire after 5 minutes and are removed within a day. Connector keys: until you revoke them or delete your account; revoked keys are removed within a day. Connector install IDs: until you delete your account (a revoked one is kept so that copy stays refused).
• Waitlist entries: up to 12 months after you join, or until you ask us to remove you or delete your account.
• Server logs: for the retention period of our hosting provider’s logs.

13. Your data rights

Fanout never sees your exchange passwords or wallet keys. Your orders run from your own machine, and the session tokens we keep are encrypted. You can disconnect or delete your account at any time.

• Get a copy. Email support@fanout.trade from the address on your account to request a copy of what we store about you. We respond within the time the law requires (45 days for California residents). Passwords, tokens and keys are left out.
• Delete. In the app, open the Account menu and choose Delete account. It asks for your password, cancels any paid plan at once, then permanently deletes your account and the data linked to it, including your waitlist entry. Server logs and our hosting provider’s backups age out on their own schedule. We may keep limited records where the law requires it.
• Correct it, or if you can’t sign in. Email support@fanout.trade from the address on your account.
• Do Not Sell or Share. We don’t sell your personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of.

Our data practices are GDPR and CCPA aligned. You can also clear the browser data yourself in your browser settings, and remove the Connector or Runner from your devices at any time.

14. Security

We protect your data with HTTPS in transit, salted scrypt password hashes, hashed session tokens, link codes and connector keys, AES-256-GCM encryption for stored venue session tokens, per-user access checks, rate limits on sign-in, and browser security headers. Orders run from your own browser or PC rather than from our servers.

No system is perfectly secure. Our server decrypts your venue session tokens while it uses them, and data in the Connector’s extension storage is protected by your browser profile and computer rather than by us. If a breach affects your personal information, we will tell you as the law requires.

15. Children

Fanout is for adults. We don’t knowingly collect data from anyone under 18. If you think a child has given us their data, contact us and we will delete it.

16. Your US state privacy rights

Depending on where you live (for example California, under the CCPA as amended by the CPRA), you may have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• have it corrected or deleted;
• opt out of its sale or sharing for targeted advertising (we do neither);
• limit the use of sensitive personal information (we use your account log-in and venue session data only to provide the Service);
• not be treated differently for using these rights.

In the last 12 months we collected the categories described above: identifiers (email, IP address, user IDs), account log-in credentials (password hash, venue session tokens), commercial and trading information (account snapshots, orders), and internet activity (server logs). We collected them from you, your devices and the venues you connect, for the purposes in “How we use your data”, and disclosed them only to the parties in “Who we share it with”.

To make a request, email support@fanout.trade (to delete your account, you can also use Delete account in the app’s Account menu). We respond within the time the law requires, which is 45 days for California residents. We will verify your request by confirming it from your account’s email address. You can use an authorized agent, and if we decline your request you can appeal by replying to our decision.

17. Where data is processed

Fanout is operated from the United States, and your data is processed in the United States.

18. Changes and contact

We will update the “Last updated” date when this policy changes and tell you about material changes by email or in the app before they take effect. Questions or requests: support@fanout.trade. Notices: support@fanout.trade.