Privacy Policy

Last Updated: 28 July 2026

This Privacy Policy explains what information Kopyon collects, why we collect it, who we share it with, and what control you have over it. We have written it to describe what our systems actually do, rather than to list every possibility the law permits.

Kopyon is a copy trading platform. To work, it needs access to your exchange account through an API key and it records the trades it places on your behalf. That is sensitive information, and most of this policy is about how we handle it.

Who is responsible for your data. Kopyon is operated by an individual, not by an incorporated company. That person is the data controller for everything described here, and is resident in Costa Rica. Our servers are in Germany. We state this plainly because it affects you: there is no corporate data protection department behind this policy, and no company to outlive the person running it. See section 9 for what that means in practice: where your data lives, and who can reach it.

This policy covers the Kopyon website (kopyon.com) and the Kopyon application (app.kopyon.com). It does not cover any separate product we may operate under a different brand, or the exchanges and third-party services you connect to, each of which has its own privacy policy. It sits alongside our Terms and Conditions and Refund Policy.

If you have questions about anything here, contact us at [email protected].

1. Information We Collect

Account and identity information. Your email address, password, username, and optional profile picture. If you sign up with Google, we receive the basic profile information Google shares during sign-in. Your password and email are held by our authentication provider, Clerk, and are never stored in Kopyon's own database. Our database stores only your Clerk account identifier, username, membership tier, and account status and timestamps. Clerk also records your active sessions, including device, browser, IP address, and approximate location; you can view and revoke these sessions in your account settings.

Exchange connection information. When you connect an exchange, we collect the API key, API secret, and, on venues that use them, the passphrase and the wallet address of that exchange account. We also store the account balances the exchange reports to us (total and available), the connection status, and any error the exchange returns when verification fails.

Trading activity. Every order and position Kopyon opens or closes for you, including the symbol, direction, quantity, price, leverage, fill price, fees, slippage, execution latency, realised profit and loss, and any error the exchange returned.

Your configuration. Your copy trading settings, such as position sizing, leverage mode, stop loss and drawdown limits, symbol allowlists and blocklists, which traders you follow, and any private note you write about a trader.

Billing information. Kopyon accepts cryptocurrency only. We do not collect or store card numbers, bank details, or billing addresses. We store the payment and invoice identifiers issued by our payment processor, the plan and billing cycle, the amount and currency, the payment status, the on-chain transaction hash, and the pay-in address our payment processor generated for the payment. We do not receive or store the wallet address you paid from.

Notification settings. If you connect Telegram, we store your Telegram chat ID and username. If you configure a webhook, we store its URL and a secret used to sign our requests to it.

Support conversations. Messages you send us through the in-app support widget or by email, and the account details attached to them.

Technical and usage information. Server access logs recording the IP address, request path, response status, and timestamp of requests to our API. A randomly generated request identifier attached to each request so we can trace errors. Aggregate analytics about how pages are used, described in section 6.

We do not collect your real name, date of birth, phone number, postal address, government identification, country of residence, or precise location. We do not have a "know your customer" process, and we do not ask you for identity documents.

2. How We Collect It

Directly from you when you create an account, connect an exchange, configure copy trading, subscribe to a plan, or contact support.

Automatically through server logs, error reports, and privacy-preserving analytics when you use the site or app.

From the exchange you connect, which reports your account balances, order fills, and position state back to us so we can execute and reconcile your copy trades.

From our authentication provider, which supplies your email address and profile details, and from Google if you choose to sign in with a Google account.

From our payment processor, which notifies us when a payment is created, confirmed, or fails, and supplies the transaction hash and pay-in address.

3. How We Use Your Information

To run the service. To create and maintain your account, connect to your exchange, mirror the trades of the traders you follow according to your settings, close and reconcile positions, and show you your performance.

To bill you. To create payment invoices, apply your subscription, send renewal reminders before your plan expires, issue receipts, and apply plan changes you schedule.

To notify you. To send trade and account alerts through the channels you have enabled, and to send transactional emails about your subscription.

To support you. To answer your questions and investigate problems you report, including tracing a specific failed order using its request identifier.

To keep the service working and secure. To diagnose errors, monitor for abuse, enforce rate limits, detect duplicate or fraudulent accounts, and protect your account and ours.

To understand and improve the product. To see which pages and features are used, in aggregate, so we know what to build and fix.

To meet legal and accounting obligations, including retaining records of payments received.

We do not use your trading data, exchange balances, or positions to trade for our own account, and we do not sell or license it to anyone.

4. Legal Bases for Processing

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR and UK GDPR.

Performance of a contract. Creating and maintaining your account, connecting to your exchange, executing copy trades, and processing your subscription. Without this information we cannot provide the service.

Legitimate interests. Securing the platform, preventing fraud and abuse, diagnosing errors, measuring aggregate usage, and publishing performance data about public leaderboard traders (see section 7). We balance these against your rights and use the least identifying data that achieves the purpose.

Consent. Connecting a Telegram or webhook notification channel, and any optional marketing communication. You can withdraw consent at any time, which does not affect processing already carried out.

Legal obligation. Retaining payment and revenue records for accounting, tax, and dispute purposes.

5. Exchange API Keys and Trading Data

This section describes the most sensitive information Kopyon holds.

How keys are stored. Your API key, API secret, and passphrase are encrypted with AES-256-GCM before they are written to our database, using an encryption key held separately from the data. They are decrypted only in memory, at the moment an order needs to be placed or your connection verified, and the plaintext is never written to disk or to logs.

How keys are displayed. Once saved, a key is never shown to you or to anyone else in full. The interface displays only the last four characters. We also store a one-way hash of the key so we can detect if the same key is added twice; that hash cannot be reversed back into the key.

What we do with your key. We use it to read your balances and positions and to place, modify, and cancel futures orders that mirror the traders you follow, according to the settings you configure. Kopyon never requests, initiates, or performs withdrawals or transfers of your funds. No part of our system calls any withdrawal endpoint.

What you should do. We strongly recommend you create an API key with futures trading permission only and withdrawals disabled at the exchange. We cannot verify or enforce the permissions you attach to a key, so this protection is yours to set. You can also restrict your key to Kopyon's outbound IP address, which we show you in the app.

Removing a key. When you remove an exchange connection, we deactivate it immediately and stop placing orders with it. The record is retained in deactivated form so that reconnecting the same key restores your history rather than creating a duplicate. When you delete your account, the credentials are erased as described in section 10.

Your trading history. Records of the orders and positions Kopyon placed for you are kept while your account is open so that your statistics, charts, and profit and loss figures remain accurate. They are deleted when your account is deleted.

6. Cookies, Local Storage, and Analytics

Kopyon sets no advertising or tracking cookies, and there is no cookie consent banner because there is nothing to consent to.

Strictly necessary cookies. Our authentication provider sets a session cookie so you stay signed in. Without it you cannot use an account. Our administrative interface, which is available only to Kopyon staff, uses standard session and anti-forgery cookies.

Local storage. The application saves some interface preferences in your browser's local storage: which table columns you have chosen to show, your last used view and sorting, which of your exchange connections you last used for a given trader, and the assumptions you set in the trader simulator such as fee, slippage, position sizing, and date range. That information stays on your device, is never sent to us as tracking data, and is cleared when you clear your browser data.

Two things you might expect to be device-only are not. Your favourite traders are saved to your account so they follow you between devices, and your browser keeps a local copy only to render the list quickly. Your copy trading configuration is held on our servers, because the execution engine needs it to place orders while your browser is closed. Both are covered by section 1 and are deleted with your account under section 10.

Analytics. We use Rybbit, an open-source analytics tool that we host on our own infrastructure at rybbit.kopyon.com. Your analytics data is never sent to an external analytics company. Rybbit is cookieless: it sets no cookies and creates no persistent identifier for you. It records page views, the referring site, approximate country or region, and browser and device type. Your IP address is used momentarily to derive that approximate location and a visitor hash that is re-salted every day, so visits cannot be linked across days or used to build a long-term profile of you.

We do not use Google Analytics, advertising pixels, session replay, heatmaps, or any cross-site tracking technology.

7. Information About Traders on Our Leaderboard

Kopyon's leaderboard is built from data that Binance and Hyperliquid publish about traders who have opted into their public leaderboards. This includes the trader's public identifier, public display name, and their published positions, profit and loss, return, and leverage.

These traders are generally not Kopyon users, and this data is collected from public sources rather than from them directly. We process it on the basis of our legitimate interest in operating a copy trading service, which cannot function without it. Visitors who are not signed in see trader identities in masked form; signed-in users see the public identity as the exchange publishes it.

If you are a trader featured on our leaderboard and you want to object to this processing or have your data removed, contact [email protected] and we will review the request. Removing yourself from the underlying exchange leaderboard will also remove you from ours.

8. Who We Share Information With

We do not sell, rent, or trade your personal information. We share it only as described below.

The exchange you connect. Binance is currently the only exchange available for copy trading, though other venues appear in the interface and may be enabled later. We send the orders you have configured us to place, authenticated with your API key. Your relationship with your exchange is governed by their terms and privacy policy, not by this one.

Clerk, our authentication provider, which holds your email, password, profile details, and session records.

NOWPayments, our cryptocurrency payment processor, which creates and settles your payment invoices. You are sent to their hosted checkout to pay; your payment is made to them, not to us.

Resend, which delivers our transactional emails, such as renewal reminders and payment confirmations.

Telegram, if and only if you choose to connect a Telegram notification channel.

Your own webhook endpoint, if you configure one. You control where that data goes.

Self-hosted tools running on Kopyon's own infrastructure, which are not third-party disclosures because the data does not leave our systems: our analytics (Rybbit), our support widget (Libredesk), our error tracking, and our database.

Legal authorities, where we are required by law or valid legal process to disclose information, or where disclosure is necessary to protect our rights, your safety, or the safety of others.

A successor, if Kopyon is sold or transferred to another operator. We will notify you before your information becomes subject to a different privacy policy.

Two additional disclosures happen in your browser rather than on our servers. First, the application loads public contract specifications directly from Binance. Binance therefore sees your IP address and browser when you use the app, though no Kopyon account information is sent with that request. Second, when you click a transaction link in your billing history, you are taken to a public blockchain explorer, which will see your IP address and that you came from Kopyon.

9. Where Your Data Is Stored and Transferred

Our servers are in Germany. The database holding your account, exchange connections, trading history, and notification settings is hosted there, inside the European Economic Area. So are the tools we run ourselves: our analytics, our support widget, and our error tracking.

The operator is in Costa Rica. The individual running Kopyon administers the servers from Costa Rica, meaning your information is accessed from outside the EEA. This isn't a data transfer to a third party. It's the same person accessing their own database, so standard transfer safeguards don't apply. We're disclosing this because you have a right to know where your data can be reached from.

Some of our service providers are elsewhere. Clerk, NOWPayments, Resend, and Telegram process data in the United States and other countries, along with whichever exchange you connect. Where they hold your data, their own agreements and privacy policies govern it.

When we send your data to these providers and a safeguard is required, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an applicable adequacy decision. We use these alongside the technical measures outlined in section 12. Your exchange credentials are encrypted before being written to disk and never display in readable form. Administering the system from abroad does not expose them.

10. Data Retention

Your account and trading data are kept for as long as your account exists. If you delete your account, see below.

Account deletion works in two stages. When you request deletion in your settings, we immediately erase your stored exchange API keys, secrets, and passphrases, deactivate all your exchange connections, and stop all copy trading. Your account then enters a 14 day grace period during which you can cancel the deletion and keep your account. Cancelling restores your account but does not restore the erased credentials, so you will need to reconnect your exchange.

After 14 days, we permanently delete your user record, exchange connections, copy trading configurations, orders, positions, performance statistics, trader preferences and notes, notification channels and routes, and notification history. We then delete your account with our authentication provider, which removes your email address, password, and profile.

Payment records are the exception. Records of payments you made are kept after deletion for accounting, tax, and dispute purposes, with your user account detached from them so they are no longer linked to you. These records still contain the blockchain transaction hash and the pay-in address of the payment, which are in any case permanently public on the blockchain and outside anyone's ability to erase.

Operational logs (server access logs, error reports, and rate limiting records) are kept only as long as needed to investigate problems and abuse, and no longer than 90 days. Rate limiting records expire within minutes.

Analytics data contains no persistent identifier and cannot be linked back to you or to a deletion request.

11. Your Privacy Rights

Depending on where you live, you have some or all of the following rights. You can exercise several of them directly in the application, and we will respond to written requests within 30 days.

Access. You can request a copy of the personal information we hold about you. Much of it is already visible in your account settings, billing history, and trading history.

Correction. You can change your email address, username, password, and profile picture in your account settings at any time.

Deletion. You can delete your account in your settings, which follows the process in section 10. You can also ask us to delete specific information by email.

Portability. You can request your personal information in a structured, machine-readable format. We do not yet offer a self-service export, so please email us and we will prepare it.

Restriction and objection. You can ask us to limit how we use your information, or object to processing we carry out on the basis of legitimate interests. Where we rely on legitimate interests, we will stop unless we have compelling grounds to continue.

Withdrawing consent. You can disconnect Telegram or webhook notifications at any time in your settings.

Complaint. If you are in the EEA or UK, you have the right to lodge a complaint with your local data protection authority. We would appreciate the chance to address your concern first.

To make a request, email [email protected] from the address associated with your account. We may need to verify your identity before acting, particularly for access and deletion requests, since the information involved includes exchange and financial data.

12. Security

We protect your information with the following measures.

Encryption in transit. All traffic to our website, application, and API is served over HTTPS, and insecure requests are redirected.

Encryption at rest for credentials. Exchange API keys, secrets, passphrases, and webhook signing secrets are encrypted with AES-256-GCM, an authenticated encryption scheme that prevents reading and also detects tampering.

We never see your password. Authentication is handled by Clerk, which stores your password in hashed form. Kopyon has no ability to read it.

Minimal collection. We do not store your email address in our own database, we do not store your real name or location, and we do not log IP addresses in our application data. Our error tracking is configured to strip IP addresses, cookies, and authorisation headers before an error report is recorded.

Access control. Kopyon is run by one person, and production data is reachable only by that operator. There is no support team, contractor, or outside party with standing access to your account, your credentials, or your trading history.

Rate limiting and abuse protection. We rate limit our API and protect it against abuse, and we trace requests so we can investigate incidents.

No system is completely secure. We cannot guarantee absolute security, and you play a part too: use a strong and unique password, keep your exchange API key restricted to trading permissions with withdrawals disabled, and review your active sessions in your account settings. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

13. Children's Privacy

Kopyon is not intended for anyone under 18, and you must be at least 18 to open an account under our Terms and Conditions. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact [email protected] and we will delete it.

14. Third-Party Sites and Services

Our website and application link to sites we do not control, including exchanges, public trader profiles on Binance and Hyperliquid, blockchain explorers, and our payment processor's checkout. This policy does not apply to them. We encourage you to read the privacy policy of any site you visit.

Connecting your exchange account to Kopyon does not change your relationship with that exchange, and the exchange's own privacy policy continues to govern the data it holds about you.

15. Changes to This Policy

We may update this Privacy Policy as the service changes or as the law requires. When we do, we will revise the "Last Updated" date at the top of this page.

If a change materially affects how we use your personal information, we will give you at least 30 days' notice by email or through the application before it takes effect, so that you can review it and, if you disagree, close your account before the change applies to you.

16. Contact Us

For any privacy question, or to exercise any of the rights described in this policy, contact us at [email protected].

For general support, use the support widget in the application or the contact details in our Terms and Conditions.