Privacy Policy

Last updated 15 November 2026

01In short

We collect only what is needed for your account and for the apps you use.
Your data stays on our own servers in France. We don’t sell it, and we don’t use advertising or tracking cookies.
You can download your data and delete your account whenever you want.

02Who is responsible

The data controller is the kobalt project, run by an individual developer in France. Contact for anything about your data: no-reply@kobaltdev.ltd.

03What we collect and why

Data	Why	Legal basis
Account: email, name, optional bio and profile picture, password (stored only as a salted scrypt hash, never in plain text), creation and last sign-in dates	Create and run your kobalt account; sign you in; show your name and picture in apps	Contract (the service you asked for)
Sessions: a random session token (stored hashed), browser and device type, sign-in and last-seen times	Keep you signed in for up to 30 days; let you see and end your sessions	Contract; security
Discord (only if you use “Continue with Discord” or link it): Discord user ID, username, email, profile picture and avatar decoration	Sign you in with Discord, create your account from it, and optionally use your Discord picture and decoration	Your consent (you start the link and can unlink)
TradeLyra content: the trading accounts, trades, notes, tags, settings and screenshots you enter or import	Show them to you and calculate your statistics	Contract
Emails we send: confirmation and password-reset messages	Confirm your address and let you recover your account	Contract; security
Technical logs: IP address, time, requested page and errors on our servers	Run the service, prevent abuse (rate limits), fix problems	Legitimate interest (security and reliability)

We do not ask for your real-world identity, payment details, broker credentials or trading account passwords, and the apps don’t connect to your broker.

04Cookies and local storage

We only use what the service needs, so no consent banner is required:

kb_session: keeps you signed in across kobalt sites (httpOnly, secure, up to 30 days).
kb_oauth: a short-lived cookie (10 minutes) used only while signing in with Discord.
Local storage in your browser: your light/dark choice and app display preferences. They never leave your device.

No advertising, analytics or tracking cookies are used.

05Where data is stored and who sees it

Everything is stored on servers we run ourselves in France. Each TradeLyra user’s data is kept in a separate database file, and the apps only ever open the database of the signed-in user.

We don’t sell or share your data for marketing. It is shared only with the services below, to the extent shown:

Discord: only when you choose to sign in or link. Discord receives your sign-in request and tells us your profile (see above). See Discord’s privacy policy. Pictures from Discord’s image network may be loaded in your browser on the account page.
Email provider: our domain registrar, domaines.fr, hosts the mailbox that sends our emails, so it handles your address and the message content in transit.
Google Fonts: the kobaltdev.ltd website (not the account or the apps, which host their fonts themselves) loads fonts from Google, so Google receives your IP address when you open it.
Exchange rates: our servers fetch public rates from Frankfurter (European Central Bank data) and Coinbase. Your data is not sent to them.

We may disclose data if a competent authority legally requires it.

06How long we keep it

Account and app data: until you delete your account. We may delete accounts abandoned for a long time, after emailing you when we can.
Sessions: up to 30 days, or until you sign out.
Sign-in and reset links: valid for 10 minutes to 24 hours, then useless and removed.
Logs: kept for a limited time for security and troubleshooting.
Backups: nightly copies are kept for 14 days. When you delete your account, your data disappears from the live service right away and from backups once they expire.

07Security

Passwords are stored as salted scrypt hashes, session and reset tokens are stored hashed, connections use HTTPS, requests are rate-limited, and each user’s app data is isolated. No online service is perfectly secure. If a breach affects your data we will tell you and the authorities where the law requires.

08Your rights

Under the GDPR you can:

Access your data: most of it is visible in your account and TradeLyra. For a copy, use TradeLyra’s full backup and CSV export, or email us.
Correct it: edit your profile on the account page.
Delete it: use “Delete account” on the account page (this also deletes your data in every kobalt app), or “Delete TradeLyra data” in TradeLyra to remove only that app’s data.
Port it: export your trades as CSV or JSON.
Object or restrict processing, and withdraw consent (for example, unlink Discord on the account page).

Write to no-reply@kobaltdev.ltd to use a right. We answer within one month. You can also complain to the French data protection authority, the CNIL, or to the authority in your own country.

09Children

The services are for people aged 15 and over. If you think a child under 15 has created an account, tell us and we will delete it.

10Changes

We may update this policy. When the change matters we’ll tell you in the app or by email. The date at the top shows the latest version.

11Contact

Privacy questions or requests: no-reply@kobaltdev.ltd.