Privacy Policy
This policy explains what personal information Capital Rush collects, why we collect it, where it is stored, who processes it on our behalf, and the choices you have. We have written it to match how the platform actually works.
1. Information we collect.
Account and profile. When you create an account we collect your name and email address, and any profile details you add (display name, avatar, trading experience, markets traded, and goals). If you link Discord for community access, we store your Discord user ID.
Password. If you use email-and-password login, we never store your password in plain text — only a salted, one-way scrypt hash in an access-restricted credentials store. Password-reset links are stored only as single-use, expiring hashes.
Phone number and alerts. If you enable phone-call or message trade alerts, or opt into our SMS program, we collect and store your phone number and your alert preferences so we can deliver those notifications.
Broker and account-connection data. When you connect a broker or prop-firm account, the credentials required to place your trades are encrypted at rest on our servers — either in a managed secrets vault or with AES-256-GCM encryption using a key held only in our server environment. They are decrypted only server-side, only to place or manage your trades, and are never returned to your browser or shown to other users. You can disconnect a broker at any time.
Trading and usage data. We store the trades placed through the platform, their outcomes and profit/loss, and account-performance metrics you sync (such as balance, drawdown, and payout progress).
Payment information. Subscriptions are processed by our payment providers. We store your subscription status, plan, billing dates, payment amount and currency, and a customer/subscription identifier from the provider. We do not store your card number, CVV, or full cardholder data — that stays with the payment processor and never reaches our servers.
Technical and usage data. For security and abuse prevention we record login events, including IP address, browser user-agent, and the time and outcome of the sign-in. We record the same technical fields when you submit the contact form, and we keep application and delivery logs generated by our hosting providers.
Support messages. When you contact us — through the contact form or the in-app support assistant — we store your message, the email you provide, and any details you include so we can respond and improve support.
2. How we use your information.
We use your information to operate and secure the platform; authenticate you and maintain your session; place and manage the trades you authorize; deliver the alerts and communications you enable; process your subscription; respond to support requests; detect and prevent fraud and abuse; and produce aggregate analytics to improve the service. We do not sell your personal information.
3. How we protect your data.
Sensitive credentials are encrypted at rest as described above; passwords are stored only as salted scrypt hashes; broker secrets are readable only by server-side execution code and are never exposed through customer-facing APIs. Access to production data is restricted to service-role systems and authorized personnel. Your session is carried in an HttpOnly, Secure (in production), SameSite=Lax cookie (gold_rush_session) signed with HMAC-SHA256 and expiring after 30 days; the token contains only your account identifier, email, and role. No method of transmission or storage can be guaranteed completely secure, but we protect your information using industry-standard security measures.
4. Cookies and local storage.
Session cookie. We use a single essential session cookie (gold_rush_session) to keep you logged in. It is strictly necessary for the platform to function and is not used for advertising.
Lead banner cookie. On our public marketing pages we set a small first-visit cookie (cr_lead_banner) so that the introductory lead prompt is shown at an appropriate time and not repeated once you have seen or dismissed it.
Local storage. We use browser localStorage to remember lightweight interface preferences and one-time flags (for example, whether you have dismissed a banner or completed a first-run step). These stay in your browser and are not advertising identifiers.
Advertising measurement. On our public marketing pages only, we use the Meta pixel to measure advertising effectiveness. It does not run on the authenticated product, and we also send a hashed (irreversible) email server-side to measure completed purchases. No trading activity is ever shared.
5. SMS program terms.
If you opt into our SMS program — by checking the consent box during signup or by texting us — you consent to receive text messages from Capital Rush. Message types include setup and onboarding information, your trade log, and discount codes. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help.
Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Phone numbers collected for the SMS program are used only to deliver the program and are not sold.
6. Third parties who process your data.
We share personal information only with the service providers below, only as needed to run the platform. Each has its own privacy practices. Broker and relay platforms receive data only for accounts you explicitly connect.
Supabase — primary database and hosting (United States); stores account, trading, subscription, and support records, plus encrypted broker credentials.
Vercel — application hosting and delivery; request/runtime logs and IP addresses.
Commas — payment processing and subscriptions; name, email, payment amount, and subscription status (card details stay with Commas).
Whop — legacy identity and payments, being retired; account identifier, email, and subscription source.
Twilio — phone-call and SMS trade alerts and account notifications; phone number and alert content.
Resend — transactional email (such as password-reset links); email address and message content.
Discord — community access and role grants; Discord user ID and linked account identity.
Zapier — subscription webhook ingestion from Commas; buyer email and subscription event data.
Anthropic— AI features (market outlooks and the in-app support assistant); the prompt text you submit, with no credentials or other users' data.
Broker and relay platforms — trade execution you explicitly connect (TopstepX/ProjectX, Tradovate, NinjaTrader, Rithmic; the legacy trade relay is being retired); order instructions and the encrypted credentials required to place your trades.
Meta (Facebook) — advertising measurement on our public marketing pages only (never on the logged-in product); marketing-page views and checkout-intent events, plus a hashed, irreversible email for purchase measurement. No trading activity is shared.
7. Data retention.
We retain your account, trading, subscription, support, and security-log records for as long as your account exists and as needed for our legitimate business, legal, and prop-firm-compliance obligations. To be transparent, we do not currently run an automated deletion or expiry schedule, and trade, payout, and audit history is generally kept as a durable record. If you close a broker connection, the connection is disabled but historical trade records that reference it are preserved. You can clear your stored phone number yourself from the platform.
8. Your rights and choices.
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can update much of your profile directly in the platform, disconnect brokers, adjust alert preferences, and export your trade and decision history as CSV from your dashboard. To request deletion of your account and associated personal data, or to exercise any other right, email capitalrushco@gmail.com and we will action it. We will not discriminate against you for exercising these rights.
9. Children.
The platform is intended for adults (18+) and is not directed to children. We do not knowingly collect personal information from anyone under 18.
10. International users.
Our infrastructure and primary database are hosted in the United States. If you access the platform from outside the United States, your information will be transferred to and processed in the United States.
11. Changes to this policy.
We may update this policy as the platform evolves. When we make material changes we will revise the effective date and, where appropriate, notify you.
12. Contact.
For privacy questions or requests, email capitalrushco@gmail.com. See also our Terms of Service and Risk Disclaimer.