1. Introduction
Shroud (“Shroud”, “we”, “us” or “our”) respects your privacy. This policy describes what personal information we collect when you use the Shroud website at https://shroud.trade, the Shroud terminal, and its messaging integrations (together, the “Functionality”), how we use it, who we share it with, and the rights you have over it.
This policy forms part of our Terms of Use. Please read both.
2. Who is responsible
The data controller is Valortec LLC, a limited liability company formed under the laws of the British Virgin Islands.
Privacy enquiries: privacy@shroud.trade
3. Who may use the Functionality
The Functionality is not available to Restricted Persons or to anyone in a Restricted Jurisdiction, which includes the United States and the European Union, as defined in our Terms of Use. We do not knowingly collect or process data from such users.
4. Why we may process your information
Depending on the information and the purpose, we rely on one or more of: your consent; the need to perform our agreement with you; compliance with a legal obligation; and our legitimate interests in operating, securing and improving the Functionality, where those are not overridden by your rights.
5. What we collect
Information you give us
- Account identifiers. The email address you sign in with, where your sign-in method provides one, which reaches us through our wallet provider Turnkey; your Turnkey organisation identifier; and the username you choose. If you used our former Telegram bot or linked Telegram, your Telegram user and chat identifier. We do not store your Google account identifier, or your Telegram name or photo.
- Password verifier. If you set a password, it never leaves your browser. Your browser turns it into a key pair, and we store only the public half to check future sign-ins.
- Wallet addresses you create through us, import, or use with the Functionality.
- Configuration. Trade presets and fee settings, watchlists, tracked wallets and social accounts, alert rules, Reflex tasks, orders, launch plans, deploy rules, saved withdrawal addresses and their labels, notification destinations (Discord webhook addresses), and interface preferences such as your theme.
- Connected X account. If you connect X, your X user identifier, handle, display name and profile picture address, and the access tokens X issues to us, stored encrypted. We request permission to read your profile and posts, publish posts and upload media, and to stay connected until you disconnect.
- Content you submit. Coin names, tickers, descriptions, images and links for coins you create, posts you compose for X, images and prompts you send to AI image editing, and text you ask us to translate.
- Security settings. Your two-factor authentication secret (encrypted) and backup codes (stored only as one-way hashes), and a record of security events such as enabling two-factor or revoking a session.
- Referrals. The referral link you signed up through, your referral code, and the rewards you earn.
- Communications. Anything you send us by email or through a support channel.
Information generated by your use
- Transaction records. For each trade, transfer, launch, lock, burn and claim you make through us: the wallet, the token, amounts, the venue, fees, the transaction signature, timestamps and success or failure. These correspond to activity that is also public on a blockchain.
- Sessions. For each signed-in device: the sign-in method, the browser’s user agent, a shortened network prefix of your IP address (the first three parts of an IPv4 address, or the first 48 bits of an IPv6 address), and when it was last active, so you can review and revoke your sessions.
- IP address. Our website passes your IP address to our servers with each request so we can rate-limit abuse. Our servers use it in memory and do not write the full address to our database or request logs. Our hosting providers may record it in their own logs.
- Region. Your browser guesses a coarse region from its own time zone setting, and measures its response time to transaction-sending services, so trades go through nearby infrastructure. We do not look up your location from your IP address.
- Account activity. When you signed up, when you last signed in and how often, when you completed onboarding and confirmed your recovery phrase backup, and whether your account has been granted access.
- Signing records. Each time our servers use a wallet key we hold, we record when, for which wallet and for what purpose.
- Diagnostics. Error reports with a technical description of what failed, which may include your account identifier and email address. We remove credentials, signing keys and the bodies of sensitive requests before they leave our systems.
- Product events. A small number of events recorded on our servers (an account being created, a deposit arriving and a trade settling, with the network, status and feature used), keyed by an internal account identifier.
Information we hold on your instruction
- Encrypted signing keys. Where you set up work that Shroud runs on a wallet, and for every wallet we generate for you (launch wallets, and wallets created in our former Telegram bot), we store that wallet’s private key encrypted at rest and use it solely to execute the instructions you configure. This is described in full in “Wallets, keys and signing” in our Terms of Use. You can revoke a key you handed over at any time. Keys of wallets we generate cannot be exported.
Information from third parties and public sources
We enrich what we show you with market data, token metadata, wallet labels and social content obtained from third-party providers and public blockchains. Where that data concerns a public blockchain address or a public social account, it may relate to you.
We do not collect identity documents or perform identity verification. The Functionality is a conduit to third-party blockchain networks and infrastructure. We are not a broker, custodian or financial service provider.
6. How we use it
- to operate the Functionality and show you your own account, wallets, positions and history;
- to execute the automation, launch plans and other instructions you configure;
- to send you the alerts and notifications you have enabled, including through a Discord webhook you provide;
- to publish posts you compose to the X account you connect;
- to calculate fees, cashback, rewards and referrals;
- to secure your account, including two-factor authentication, session management and signing records;
- to provide support;
- to detect, investigate and prevent fraud, abuse, market manipulation and security incidents;
- to measure how the Functionality is used, so we can improve it; and
- to comply with legal obligations.
7. AI processing
Some features use third-party AI models, which we reach through OpenRouter. We send them:
- the text of public social posts, their authors’ handles and the posts they quote or reply to, and the address of a post’s image, to suggest coin names and tickers;
- public coin websites and X profiles, to describe and classify coins; and
- an image you upload together with your instructions, when you use AI image editing.
We do not send your email address, wallet keys or account settings to AI models. Content you submit for image editing is processed by the model provider under its own terms.
9. Analytics
We measure how the Functionality is used through the product events described above, sent from our servers to PostHog (EU hosting). Two things about our analytics are deliberate and worth stating plainly:
- We identify analytics events by an internal account identifier, never by a wallet address, email address or username. A wallet address is a permanent public identifier, and attaching one to an analytics profile would link your entire on-chain history to your account in a third party’s systems, permanently and irreversibly. We do not do this.
- We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
11. Third-party technologies
Parts of the Functionality integrate third-party technology, including wallet infrastructure, embedded social posts, charts, decentralised exchanges and other blockchain infrastructure. Those providers may use their own cookies or similar technologies and may receive your IP address when your browser contacts them. We do not control them and are not responsible for their practices. Your interaction with them is governed by their own terms and privacy policies.
12. What is public, and permanently so
Blockchain transactions are public by design. Any trade, transfer, launch, lock, burn or claim you make through the Functionality is recorded on a public ledger, together with your wallet address, and is visible to anyone. So are coins you create and their metadata, and posts you publish to X. We cannot delete, amend or restrict that data. Deleting your Shroud account does not and cannot remove it.
13. How long we keep it
- Account, configuration, session and transaction records: for as long as your account exists, and afterwards for as long as we need them for accounting, legal, security and dispute purposes.
- Encrypted signing keys: until you revoke Shroud’s signing access to that wallet or delete the wallet, at which point the encrypted copy is deleted. Keys for launch wallets are deleted when those wallets are cleaned up after being emptied. Records of key use are kept as security records.
- X access tokens: until you disconnect your X account.
- Diagnostic and analytics data: for the periods set by our error-monitoring and analytics providers.
You can ask us to delete your account by emailing privacy@shroud.trade. Before you do, move your assets out of every wallet whose only key we hold, because deleting it destroys that key.
14. International transfers
We and our service providers operate in several countries, so your information may be transferred outside the country where you live. Where it is, we take steps intended to keep it protected to a standard consistent with this policy.
15. Security
We use technical and organisational measures to protect your information, including authenticated encryption at rest for signing keys, two-factor secrets and X tokens; a record of every use of a stored signing key, with alerts on unusual use and the ability to suspend all signing by our systems; transport encryption; access controls; and redaction of credentials from diagnostic data.
No system is impenetrable. We urge you to use strong, unique credentials, to turn on two-factor authentication, to keep your device and browser free of untrusted extensions, and to export and safely store the key of any wallet you rely on. We make no guarantee as to the security of your assets or credentials, and we disclaim liability for any breach affecting stored credentials, as set out in the Terms of Use.
16. Your rights
Depending on where you live, you may have the right to access your personal data, to have it corrected or deleted, to object to or restrict certain processing, to withdraw consent, and to receive a copy in a portable format. You can already disconnect X, revoke sessions, revoke Shroud’s signing access and delete wallets from within the app.
To exercise any of these rights, email privacy@shroud.trade. We will respond as required by applicable law. Note the limits described in “What is public, and permanently so”: we cannot remove anything from a public blockchain.
17. Children
The Functionality is not intended for anyone under 18, and we do not knowingly collect personal data from minors. If you believe a minor has given us personal data, contact privacy@shroud.trade and we will delete it.
18. Changes to this policy
We may update this policy. Material changes will be announced in the Functionality or by email. Please check this page periodically.