AlgoReconPrivacy Policy
Last updated: 13 September 2026
Photon Services Limited ("we", "us", "our"), a company registered in England and Wales, operates AlgoRecon (the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, and how we use and protect it. We act as the data controller for the personal data described here.
1. What data we collect
| Data | Purpose | Legal basis (UK GDPR) |
|---|---|---|
| Email address | Identify your licence, send receipts and important service communications | Contract |
| First name, last name (optional) | Personalise communications and invoices | Contract |
| Device fingerprint (a one-way hash of your machine identifiers) | Activate your licence on a specific device, enforce the 2-device limit, and prevent trial abuse | Legitimate interest in preventing fraud and licence sharing |
| Licence activation history | Allow you to deactivate devices you no longer use | Contract |
| Payment information | Card details are entered into our payment processor's secure checkout - we never see or store full card numbers. We retain only transaction metadata (amount, date, last 4 digits of card, billing country) | Contract |
| Support correspondence | Respond to enquiries and improve the Service | Legitimate interest |
Local trading data and credentials. The desktop app stores imported trade history, strategy data and broker information in a local SQLite database; it does not cloud-sync your trading records. When you connect an MT5 account, you enter its login, server and password in AlgoRecon. The password is stored locally using Windows Data Protection, bound to your Windows account, and decrypted locally when needed to connect through an app-managed MT5 terminal. These credentials are not sent to AlgoRecon's servers; MT5 uses them to authenticate with your broker. We recommend a read-only investor password. Diagnostic reports you explicitly choose to send can contain the account details described below.
Diagnostic reports you choose to send. If you use the "Send diagnostic report" button in Settings, AlgoRecon sends your recent application log file, app version, licence key and any note you type to our support service. Your key verifies the upload; new reports in our support storage (Cloudflare R2) retain a licence reference instead. Older reports may still contain the submitted key. This is used to help resolve a problem you have reported. The log may include technical details such as your MT5 account number, broker, server name and StrategyQuant activity. AlgoRecon does not intentionally log MT5 passwords. You can preview the report before sending it; upload happens only when you choose to send. Please do not include passwords or other secrets in your note.
Optional anonymous diagnostics. The app can send two kinds of anonymous diagnostics: usage statistics (that the app launched and which features are opened, to understand adoption) and crash reports (a scrubbed technical diagnostic if the app crashes). These never include your account numbers, broker, trades, P&L, licence key, file contents, email address, or any personal identifier. Usage statistics consist of the event name plus anonymous technical metadata automatically attached by our analytics provider - application version, operating system and version, device language/locale, the web-view engine version, and a temporary session identifier that resets each session (it cannot be used to track you across sessions). Crash reports contain only a scrubbed error type, a path- and value-free stack trace, the app version, and the operating system. Both usage statistics and crash reports are on by default, because both are anonymous and contain no personal data (the crash scrubber strips messages, paths, and variables, keeping only the error type, a path-free stack, and the app/operating-system version). You can turn either off at any time in Settings → Privacy & Telemetry.
2. Who we share data with
We share personal data only with a small number of processors that we need to operate the Service:
- Stripe - handles checkout, recurring billing, receipts and refunds. Stripe Privacy Policy.
- Resend - delivers licence and recovery emails, processing the recipient address and message contents. Resend Privacy Policy.
- Keygen LLC - our licensing service. Stores your email, fingerprint hash, and licence status. Keygen Privacy Policy.
- Cloudflare, Inc. - hosts our licensing API worker. Receives request metadata (IP address, request body) for the purpose of fulfilling licence operations and rate-limiting abuse. Cloudflare Privacy Policy.
- Aptabase (only if usage statistics are enabled) - privacy-first, EU-hosted usage analytics. Receives only the anonymous app/feature events described above; collects no personal data. Aptabase Privacy Policy.
- Sentry (only if crash reports are enabled) - crash-diagnostics service. Receives only scrubbed, anonymous crash data - no personal or financial information. Sentry Privacy Policy.
- Google Analytics (only with website analytics consent) - measures website interactions as described below. Google Privacy Policy.
We do not sell your personal data. If you accept website analytics, we use Google Analytics and its Google Ads integration to assess our marketing. Advertising personalisation is disabled.
The marketing site and its stylesheet are hosted through Cloudflare. Requests to serve these pages and assets include connection metadata such as your IP address and browser user agent. The site uses system fonts and does not load the Tailwind browser CDN.
We also use Cloudflare Web Analytics to measure page views and website performance. Cloudflare adds an analytics script to the published pages that sends these measurements to its analytics service.
The desktop app also checks for updates and downloads AlgoRecon installers from our Cloudflare-hosted download service. When setting up an MT5 connection it can download an MT5 installer from MetaQuotes' download service. Those services receive the connection metadata needed to fulfil the requests. MT5 then connects to the broker you selected.
Website analytics (optional)
With your consent, we use Google Analytics 4, provided by Google, to measure page visits, Windows download clicks, email-link clicks, successful copy-link actions and subscription checkout clicks. These are website interactions: a click does not confirm a completed download, sent email, trial activation or purchase. Analytics data includes a cookie-based browser identifier, device/browser information, coarse location and approved campaign labels. We do not send email addresses, licence keys, trading data or arbitrary URL parameters in these events.
Google Analytics is blocked until you accept analytics. Rejecting does not affect downloads or checkout. You can withdraw consent using Analytics settings in the footer; this stops Google Analytics and removes its cookies from this site. We do not replay interactions that happened before you accepted. We keep Cloudflare Web Analytics separately for aggregate website traffic and performance measurement.
Our legal basis for optional website analytics is consent. Google may process data outside the UK/EEA. See Google’s Privacy Policy and how Google uses information from partner sites. We do not enable Google signals, enhanced conversions or advertising personalisation. Analytics does not connect your website activity to your desktop trading records.
3. International transfers
Some of our processors are based outside the UK or EEA. Where personal data is transferred internationally we rely on the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or equivalent safeguards as required by UK GDPR.
4. How long we keep data
- Active licence data is kept for as long as your subscription is active.
- After cancellation we retain licence and transaction records for up to 7 years to comply with UK accounting and tax law.
- Trial accounts without a subsequent purchase are retained for up to 24 months, then deleted.
- Google Analytics user and event data retention is set to two months, without extending it on new activity. Aggregate reports may be retained longer.
5. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Request that we correct inaccurate data.
- Request that we delete your data (subject to legal retention obligations above).
- Object to or restrict processing based on legitimate interest.
- Request a copy of your data in a portable format.
- Withdraw consent at any time, where we rely on consent.
- Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).
To exercise any of these rights, email [email protected]. We respond within 30 days.
6. Security
The Service uses HTTPS for all communications with our licensing worker. Your local licence cache is encrypted with AES-256-GCM using a key derived from your device's hardware fingerprint - this means the cache cannot be read if copied to another machine. We restrict employee access to personal data on a need-to-know basis.
7. Cookies
We remember your analytics preference in your browser’s local storage for 180 days, whether you accept or reject. This preference storage is necessary to honour your choice and does not identify you. If storage is unavailable, your choice applies only to the current page.
| Storage | Purpose | Duration |
|---|---|---|
| algorecon-consent (local storage) | Remember your analytics choice | 180 days |
| _ga, _ga_* cookies (only after acceptance) | Distinguish browsers and sessions in Google Analytics | Up to 180 days |
Our payment processor’s separately hosted checkout uses its own cookies. Your website analytics choice does not prevent you from purchasing.
8. Children
The Service is not directed at children under 18. We do not knowingly collect personal data from children.
9. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified via the email address associated with your account. The "last updated" date at the top of this page indicates when the policy was most recently revised.
10. Contact
Photon Services Limited
Email: [email protected]