Legal

Privacy

Openhisa stores what the desk needs to sign you in and to run automations on your behalf. It does not sell personal data. It is not a social network and not a marketplace.

What we keep

• Email, name, and a password hash (not the password)
• Session cookies (JWT access + refresh) and a CSRF cookie
• Alpaca paper and (if unlocked) live keys, encrypted with a server key (OPENHISA_KMS_KEY). Only the last four of the key ID are shown again.
• Risk limits (including live unlock timestamp and cooler live caps), recipes, orders, and an audit log you can read
• Market quotes, bars, and headlines in a local cache so the desk is not a live scrape of Yahoo on every click

What we do not do

• Put secrets in the browser, in emails, or in logs
• Send Alpaca secrets to Yahoo or other research vendors
• Use research prints as the only price on a live market order
• Hide the paper / live banner

Mail (verification, password reset, morning brief, risk skips) is sent from this host. You can turn the morning brief off in Settings. Remove keys any time. Delete the account by asking the operator if you cannot do it in the desk yet.

Effective 10 September 2026. Terms