Privacy Policy

This policy explains what personal data BlackOutFX collects through this website, the BlackOutFX VIP Trading App at app.blackoutfx.net (the “app”) and the BlackOutFX bot on Telegram, why, how long we keep it and the rights you have. “We” and “us” mean BlackOutFX.

Server logs. Like almost every website, our server records each request: your IP address, the page requested, the time, the referring page and your browser's user agent. We use these logs to keep the site and the app running and secure, for example to find errors and block abuse.

Error reports. When a page fails, an error report is sent to Sentry, our error-monitoring service. It contains the page address, the error details and your browser and operating system. We configure Sentry not to store your IP address.

Analytics, only if you accept. If you click Accept in the cookie banner, we use Google Analytics to understand how visitors use the website: pages viewed, how you arrived, device and browser type, and approximate location (country or city). Google Analytics uses a random identifier stored in a cookie, not your name. Google Signals and ad personalisation are turned off. If you reject or ignore the banner, Google Analytics is not loaded and nothing is sent to Google.

Account details. Your username, email address and password. The password is stored only as a one-way hash, so nobody can read it. When you choose a password, we check it against known data breaches by sending only the first characters of its hash, never the password. If you turn on two-factor authentication, we store its secret key and your backup codes.

Profile and settings. Your time zone, language, profile picture, chat title, notification settings and the other choices you make in the app.

Membership. Your role (member or VIP) and when your VIP access ends, so we can open the right pages and remind you before it ends.

Sign-in sessions. Each session stores the IP address and browser it was started from, so you can see your active sessions and sign out of the others.

Security log. We record security events, such as sign-ins, failed sign-ins, password and two-factor changes and admin actions, with the time and the IP address. We use it to protect accounts, for example to slow down password guessing.

Spam check. Sign-up, sign-in and password reset use Cloudflare Turnstile to tell people from bots. It processes your IP address and technical details of your browser.

Trading journal. Your entries, folders and screenshots. Only you can see them in the app. We don't look at them unless you ask us to, or to keep the service running, secure or restored.

Academy progress. Which lessons you have completed.

Members' chat. The messages and images you post, which other members can see, and which messages you have read. Moderators can remove messages and mute accounts.

Purchases. Plans are bought through the BlackOutFX bot on Telegram and paid in cryptocurrency to our wallet. The bot uses your Telegram account and the plan you choose to complete the purchase. We never receive card or bank details. A crypto payment is recorded on its public blockchain, where the sending address, amount and time are visible to anyone and can't be deleted, by us or anyone else.

Alerts. If you connect Telegram on your account page, we store your Telegram user ID, the chat ID the bot messages you in and the alerts you chose. You can unlink at any time, which deletes them.

What you share on Telegram itself, including your profile, is handled under Telegram's own privacy policy.

We email you only about your account: address confirmation, password resets, security notices and reminders before your VIP access ends. We don't send marketing emails. The emails are sent through Spaceship's email service.

• bofx_consent (ours, strictly necessary): remembers whether you accepted or rejected analytics. Kept for 6 months.
• bofx.session_token (ours, strictly necessary, app only): keeps you signed in. Removed when you sign out or the session ends.
• bofx.sidebar and bofx.locale (ours, app only): remember your sidebar layout and language.
• _ga and _ga_<ID> (Google Analytics, website only): set only after you accept. They tell visits apart. Kept for 13 months, or until you withdraw consent.

The app also keeps some settings, such as your calculator inputs and alert choices, in your browser's own storage, where only you can see them. We use no advertising or tracking cookies. To change your analytics choice, use Cookie settings at the bottom of any website page. If you withdraw consent, we delete the Google Analytics cookies from your browser.

• Your account, membership, journal, chat and alerts: to provide the app you signed up for (our contract with you).
• Server logs, error reports, sessions, the security log and the spam check: our legitimate interest in a working, secure service and in protecting your account.
• Google Analytics: your consent, which you can withdraw at any time.
• The consent cookie: needed to respect your choice.

• Your account and what you added in the app (journal, screenshots, progress, settings, chat messages): while your account exists. Moderators may remove chat messages sooner.
• Sign-in sessions: until you sign out, or at most 30 days (7 days without use).
• Security log: 12 months, then deleted automatically.
• Server logs: 14 days, then deleted automatically.
• Error reports: up to 90 days.
• Google Analytics data: 2 months.

To delete your account, contact [email protected]. We delete it, with your journal, screenshots, progress, settings, chat messages and Telegram link, within one month.

We don't sell your data or share it for advertising. It is processed by the services we use to run the website and the app: our hosting provider (Hetzner), Cloudflare (network protection and the spam check), Spaceship (email), Sentry (error reports), Telegram (when you use the bot) and, only if you accept, Google (analytics). Some of them may process data in the United States; Cloudflare, Sentry and Google take part in the EU-US Data Privacy Framework.

Under the GDPR and similar laws you can ask us to give you a copy of your personal data, correct it, delete it, limit how we use it, or move it to another service. You can also object to how we use it. Where we rely on your consent, you can withdraw it at any time. You can change most of your account details and settings yourself in the app.

To use any of these rights, contact [email protected]. We answer within one month. You can also complain to the data protection authority in the country where you live.

For data that isn't linked to your account, such as server logs, we may ask for details, like your IP address and the time of your visit, to find it.

We may update this policy. The date at the top shows the latest version. If a change matters for members, we also announce it in the app or by email.