Privacy Policy

This explains what information Xfx collects when you use the Service, why, and who it's shared with. It's written to describe what the platform actually does, not generic boilerplate — if something here doesn't match your experience of the app, tell us at support@xfxtrade.pro.

Account information. When you sign up, we collect your email address and, if you use Google sign-in, your name and profile photo as provided by Google. If you use email/password sign-up instead, we store your email and a securely hashed password via Firebase Authentication — we never see or store your password in plain text.

Trading activity. Trade history, profit/loss records, and the markets, expiries and amounts you trade are stored so your dashboard, wallet and journal work, and so support can help you if something goes wrong.

Payment information. If you pay via M-Pesa, we store the phone number you enter, the payment amount, and the M-Pesa receipt number once PayHero confirms payment — we never see or store your M-Pesa PIN.

Technical data. Standard server logs (IP address, timestamps, error logs) are generated by our hosting providers as part of normal operation, mainly for debugging and abuse prevention.

• To operate your account and show your dashboard, wallet and trade history.
• To process deposits, withdrawals and subscription payments.
• To respond to support requests.
• To detect fraud, abuse, and violations of our Terms of Service.
• To meet legal obligations where they apply.

We do not sell your personal information to advertisers or data brokers.

Information is shared only where it's needed to run the Service:

• PayHero, which processes the transaction through Safaricom's M-Pesa network — processes M-Pesa payments.
• Google Firebase / Google Cloud — hosts our authentication and database infrastructure.
• Vercel — hosts the application.
• Market-data providers — receive only symbol requests for the live prices shown on the chart; no personal data.

We may also disclose information if required by law, or to protect the rights, safety, or property of Xfx, our users, or others.

We use a small number of essential cookies and browser storage entries — for example, Firebase Authentication's own session storage that keeps you signed in. These are functional, not advertising or tracking cookies, and the Service won't work properly without them.

We keep account and trading data for as long as your account is active, so your history and bots keep working. If you want your account and associated data deleted, email support@xfxtrade.pro and we'll process the request, subject to anything we're legally required to keep (for example, payment records for tax or fraud-prevention purposes).

You can, at any time:

• Cancel a subscription from your Profile.
• Request a copy of, correction to, or deletion of your personal data by emailing support.

The Service is not directed at anyone under 18. We don't knowingly collect information from children, and accounts require you to confirm you meet the age requirement in our Terms.

Our infrastructure providers (including Google Cloud, Vercel, and Railway) may process and store data in countries other than your own. We rely on those providers' own safeguards for cross-border data handling.

We use industry-standard practices — including encrypted connections and access-controlled storage — to protect your information. No system is perfectly secure, and we can't guarantee absolute security, but we treat account and payment data as sensitive by default.

We may update this policy as the Service changes. Material changes will be reflected by a new "Last updated" date above.

Questions about this policy or your data? Email support@xfxtrade.pro.