This document is governed by the Traditional Chinese version; other language versions are for reference only.
Carousel Bot — Privacy Policy
This English version is a translation for reference only. In case of any discrepancy, the Traditional Chinese version prevails.
Effective date: April 10, 2026 Last updated: October 16, 2026 Version: v2.2
This policy explains how the Service Operator (“the Operator”) collects, uses, stores and protects your personal data. By completing payment or using the Carousel Bot service, you are deemed to have read, understood and agreed to this policy.
Key points
Please read these seven key points. The full policy follows below.
- 🔐 We only collect data needed for your subscription (email, subscription status, payment records)
- 🔐 Your API keys, private keys and trade records are stored only on your own computer and never uploaded to any cloud
- 🔐 We do not collect IP addresses, browsing history, location or activity in other apps
- 🔐 Your data is not used for advertising and is not sold or rented to third parties
- 🔐 You can access, correct or delete your personal data at any time (email indexoptionsjournal@gmail.com)
- 🌐 Cross-border transfer: Cloudflare edge nodes (GDPR / CCPA compliant)
- 🪙 Subscriptions are paid in stablecoins: blockchain transfer records are public by nature and anyone can look them up (see 2.5)
1. Scope
This Privacy Policy applies to:
- The Carousel Bot desktop software (Mac / Windows)
- Member services provided by the Operator
- The backend servers used by the Operator (Cloudflare Workers, D1 database, R2 storage)
This policy does not apply to:
- Exchanges such as Pionex, Hyperliquid and OKX, or the exchange or wallet you pay from (you use them directly; each has its own privacy policy)
- Blockchain networks themselves (public ledgers not controlled by any single party)
- Third-party services (YouTube, Telegram, Substack, etc.)
2. Personal data we collect
2.1 Data you provide
| Data | When collected | Purpose |
|---|---|---|
| Email address | When creating a payment order and logging in | Required (subscription verification, customer support) |
| Payment records (plan, period, amount, network, token, blockchain transaction ID, time) | When you pay | Required (activating your subscription, reconciliation, tax) |
The Operator does not collect credit card or bank account information and never asks members for any wallet’s private key or recovery phrase.
2.2 Data needed for the software to run
| Data | Where it is stored | Purpose |
|---|---|---|
| Exchange API keys (Pionex / Hyperliquid, etc.) | Only on your own computer (AES-256-GCM encrypted) | Connecting to exchanges to run the grid strategies you set |
| Hyperliquid Agent Wallet private key | Only on your own computer (encrypted per grid) | Signing Hyperliquid trades |
| Your grid strategy settings | Only on your own computer (SQLite database) | Running the software |
| Your trade records and performance data | Only on your own computer (SQLite database) | For you to review |
⚠️ Important: this data is stored only on your own computer and is never uploaded to the Operator’s servers or any cloud service. The Operator has no access at all to your API keys, private keys or trade records.
2.3 Data needed for subscription verification
| Data | Where it is stored | Purpose |
|---|---|---|
| Your subscription status (active / cancelled / expired) | Cloudflare D1 database (backend) | Confirming your subscription is valid when the software starts |
| Verification time records | Cloudflare D1 database | Determining expiry, auditing |
| Device identifier | Cloudflare D1 database | Each account is limited to 1 device |
2.4 Data we do not collect
- ❌ Your browsing history
- ❌ Your IP address (the software does not report it; only Cloudflare logs it automatically for DDoS protection and deletes it after 7 days)
- ❌ Your location
- ❌ Your contacts, files or photos
- ❌ Your activity in other apps
- ❌ The assets in your exchange accounts (we have no withdrawal permission and do not upload trade records)
2.5 Blockchain data is public
When you pay with stablecoins, the transfer (sending address, the Operator’s receiving address, amount, time and blockchain transaction ID) is permanently recorded on a public blockchain and anyone can look it up. This is how blockchains work and cannot be deleted or hidden by the Operator. The Operator’s database only links the blockchain transaction ID to your email and plan, and this link is not made public.
3. Purposes of collection
We collect the data above only for these necessary purposes:
- Subscription verification: confirming you are a valid paying member
- Customer support: answering your technical support requests
- Service notices: major updates, policy changes, security alerts
- Legal compliance: meeting legal requirements such as personal data protection and tax reporting
- Service improvement: aggregate statistics (for example, how many members use the Pro plan) that do not identify individual members
We do not use your data for:
- ❌ Advertising
- ❌ Marketing (unless you separately subscribe to our newsletter, which you can unsubscribe from at any time)
- ❌ Selling or renting to third parties
- ❌ Any purpose unrelated to the Service
4. Storage and security
4.1 Backend storage
- Location: Cloudflare Workers + D1 (distributed edge nodes)
- Encryption: TLS 1.3 in transit and AES-256 at rest, provided by Cloudflare
- Access control: only the Operator can access the admin backend, using an admin token
4.2 Local storage
- Encryption: API keys and Hyperliquid private keys are stored in your local SQLite with AES-256-GCM encryption
- Key management: the encryption key is protected by operating system permissions
- Leaves your computer: never
4.3 Data received by third-party services
| Third-party service | Data received | Purpose | Privacy policy |
|---|---|---|---|
| Blockchain lookup services (TronGrid, public Arbitrum nodes) | The Operator’s receiving address and blockchain transaction IDs (not your email or other personal data) | Confirming payments | Provided by each service |
| Cloudflare | Network traffic when you reach the Service’s backend | Edge computing and DDoS protection | cloudflare.com/privacypolicy |
| Exchanges such as Pionex / Hyperliquid | Your API activity | You connect directly; the Operator is not involved | Provided by each exchange |
5. Retention
| Data | Retention period |
|---|---|
| Subscription records (while active) | Subscription period + 5 years after it ends (tax and legal audit) |
| Subscription records (expired / cancelled) | 5 years after it ends |
| Payment records | 5 years after payment (tax and legal audit) |
| Customer support records | 2 years after the case is closed |
| Software data on your computer | Managed by you, outside our control |
| Transfer records on the blockchain | Permanently public (nature of blockchains; cannot be deleted by the Operator) |
When a period ends we permanently delete the data, although aggregate statistics that cannot identify you may be kept for analysis.
6. Your rights
Under applicable personal data protection laws and international practice, you have the following rights:
| Right | Description | How to exercise |
|---|---|---|
| Right of inquiry | Ask whether we hold your personal data | Email indexoptionsjournal@gmail.com |
| Right of access | See your personal data | Same as above |
| Right of correction | Ask us to correct wrong data | Same as above |
| Right of deletion | Ask us to delete your personal data (after your subscription ends) | Same as above |
| Right to stop processing | Ask us to stop specific processing (e.g. marketing messages) | Same as above |
| Right to data portability | Ask us to provide your data in a readable format | Same as above |
We respond within 30 days of receiving your request. If a legal retention duty (e.g. tax records) prevents immediate deletion, we will tell you clearly.
7. Cookies and tracking
7.1 Desktop software
The software uses no cookies or web tracking technologies.
7.2 Backend services
Our backend (Cloudflare Workers) uses:
- Subscription verification token: stored on your computer to identify your subscription (similar in concept to a cookie)
- No third-party tracking: no Google Analytics, Facebook Pixel or similar tools
7.3 Payment flow
Payment is done entirely inside the software, without a third-party checkout page, so there are no third-party cookies or tracking tools.
8. Cross-border data transfer
8.1 Where data is processed
Because the backend runs on Cloudflare Workers edge computing, your data may be processed at the Cloudflare edge node nearest to you. Common nodes include Taiwan, Hong Kong, Singapore, Japan, the United States, etc.
Cloudflare uses a GDPR- and CCPA-compliant architecture so that cross-border transfers meet the relevant regulations.
8.2 Blockchain networks
Blockchains are global, distributed public networks. Your payment transfer records are stored and relayed by blockchain nodes worldwide and do not belong to any single country or region.
8.3 Your consent
By completing payment or using the Service, you consent to the cross-border data transfers described above.
9. Minors
The Service is not provided to anyone under 20 years of age. If we find that a member is under 20, we will terminate the subscription immediately and delete their personal data.
If you are the guardian of a minor and find that your child subscribed without your consent, please contact us (email: indexoptionsjournal@gmail.com) and we will handle it immediately.
10. Data breach notification
If a major data breach occurs (for example, the Cloudflare account is hacked or the D1 database is accessed without authorization), we will:
- Email all potentially affected members within 72 hours of discovering it
- Explain the type of data involved, the possible impact and the steps we have taken
- Suggest protective steps you can take
11. Changes to this policy
We may update this Privacy Policy from time to time. Members are notified of major changes by email 30 days before they take effect.
Continuing to use the Service means accepting the updated policy. If you disagree with an update, you may choose not to renew and ask us to delete your personal data.
12. Contact us
For any questions about this policy or your personal data:
Operator: the Service Operator (the Software) Last updated: October 16, 2026 Version: v2.2