How SpotBitBot handles account and service data.

Data we collect

• Account data: username, password hash, account status, plan status, authentication-session records and security timestamps. We do not store your password in readable form.
• PAPER workspace data: bot configurations and states, virtual wallet balances, reservations, settings, simulated positions, lots, orders, trades, fees, saved decisions, analysis and risk snapshots.
• Alert data: alert rules, notifications, read status and delivery records.
• Optional notification data: browser push subscription details or an Android Firebase Cloud Messaging registration token when you enable notifications.
• Operational and security data: timestamps, failed authentication attempts, lock status, worker/service events and technical logs needed to operate and protect the service.
• Support communications: your email address, message and any information you voluntarily send when contacting us. Email is not required to create an account.

How we use data

We use this data to create and secure accounts, provide PAPER bot monitoring and portfolio records, deliver requested notifications, diagnose problems, prevent abuse, respond to support and privacy requests, and improve reliability.

Third-party services

SpotBitBot receives public market data from external market-data services, including Binance public interfaces. The Android notification feature uses Firebase Cloud Messaging. Hosting, certificate and infrastructure providers may process limited technical data necessary to deliver the service. SpotBitBot does not send exchange credentials because it does not collect them.

What we do not collect for the current product

SpotBitBot does not request exchange API keys, wallet private keys, seed phrases, recovery phrases or payment-card details. The current release does not place real orders or transfer funds.

Data sharing and sale

We do not sell personal data. We may share limited data with service providers that help operate the platform, when required by law, or to protect users, S&S Tech Studio and the service from security or legal harm.

Security

Passwords are hashed with Argon2. Authentication tokens are stored as cryptographic digests. Transport uses HTTPS, Android cleartext traffic is disabled and application access is scoped by account. No system is completely secure, so users should choose a unique password and protect their device.

Retention

We retain account and PAPER workspace data while the account is active and as reasonably needed to operate, secure and document the service. After account deletion, we delete data associated with the account unless limited retention is required for security, fraud prevention, legal compliance, dispute resolution or backup integrity.

Your choices

You can disable browser or Android notifications, remove registered notification devices through available controls, request access or correction by contacting us, and permanently delete an account in the Android app under Account & security, or use the published fallback instructions.

Children

SpotBitBot is not directed to children. Do not create an account if you are not legally permitted to use the service in your location.

Contact

S&S Tech Studio, Karachi, Pakistan
c.sstechstudio@gmail.com
+92 302 3625044