Privacy Policy

This Privacy Policy explains how Star Algorithm(operated by Dupree Ops LLC, "we", "us") collects, uses, stores, and shares your personal and financial information when you use staralgorithm.app and related services.

Star Algorithm is a software platform that lets you subscribe to risk-scored trading algorithms and have them trade inside a brokerage account held in your name at Alpaca Securities LLC (FINRA/SIPC). We do not custody your funds and we do not store raw bank account or routing numbers.

2.1 Account information you provide

• Email address, name, and authentication credentials (handled by Supabase)
• Brokerage onboarding details collected for Alpaca (name, DOB, address, SSN, employment, disclosures)
• Strategy subscription preferences and Capsule risk settings (capital, loss caps, leverage flag)

2.2 Plaid data (bank linking)

When you connect a bank account through Plaid Link, Plaid returns a one-time public_token which we exchange server-side for an access_token. From that we generate a single-use Alpaca processor token that Alpaca redeems with Plaid directly. We may also retrieve, depending on consent and use case:

• Auth — bank-account verification
• Balance — real-time available funds, checked at funding time
• Identity — account-owner information to confirm the bank account belongs to you

We do not receive or store your bank login credentials. We do not store raw account or routing numbers — Alpaca holds those. See Plaid's End User Privacy Policyfor details on Plaid's handling.

2.3 Alpaca brokerage data

Alpaca holds your brokerage account, account number, cash balance, positions, orders, fills, statements, and tax documents. We retrieve a minimum set of these via the Alpaca Broker API to display them to you and to operate your Capsule's strategy decisions.

2.4 Operational data

• IP address, browser type, device identifiers, timestamps
• App-event logs (sign-in, Plaid Link launch, Capsule activation, order submit, halts)
• Audit records of every order routed through the platform (immutable JSONL by date)

• To create and operate your account on Star Algorithm and Alpaca
• To verify bank-account ownership before funding
• To route trades from your subscribed strategies to your Alpaca account
• To enforce per-Capsule risk limits (loss caps, position caps, leverage flag) and the platform kill switch
• To prevent fraud, secure the service, and meet regulatory obligations
• To send transactional notifications (order halts, risk-cap hits, account events)

We do not sell your data. We do not use Plaid-derived data for advertising. We do not share data with third parties except as described below.

• Alpaca Securities LLC / Alpaca Crypto LLC — brokerage account, custody, KYC, order routing, statements
• Plaid Inc. — bank-account linking, balance, identity
• Supabase — authentication, application database (AES-256 encryption at rest)
• Vercel — application hosting (TLS 1.2+ in transit, AES-256 at rest)

Each provider has their own privacy policy. They process only the minimum data necessary to deliver their service to you.

If you connect your existing Alpaca account through Alpaca Connect (the OAuth2 flow surfaced at /connect), the following applies in addition to the rest of this policy:

What we receive

• An access token issued by Alpaca, scoped to account:write trading data.
• Your Alpaca account ID and account number, captured by querying Alpaca's /v2/accountendpoint with the new token.
• The environment (live or paper) you authorized.

What we never receive

• Your Alpaca password.
• Your bank-account credentials, raw routing numbers, or account numbers — Alpaca handles ACH funding entirely.
• Tokens issued to other apps you've connected at Alpaca.
• Multi-factor authentication codes or device fingerprints from your Alpaca login.

How we use the access token

• Authenticate Trading API calls (Authorization: Bearer) when you place or cancel orders, view positions, or check account state.
• Route Capsule orders to your account within the per-Capsule risk limits you set.
• The token is never exposed in browser code, logs we publish, or marketing analytics.

Storage and retention

OAuth access tokens are stored server-side only, in an audit-logged JSONL store (data/alpaca_oauth/tokens.jsonl) for development and a managed-secret store for production. Tokens are retained while your account is active. On disconnect or account deletion we remove the token from our store; we also recommend you revoke the app from Alpaca's Connected Appspage to invalidate it at the source.

How to revoke

• From Star Algorithm: /connect → Disconnect. Removes the token from our store.
• From Alpaca: app.alpaca.markets → Connected Apps → revoke Star Algorithm. Invalidates the token at the source.

Disconnecting stops all future order routing through your account. Trades that have already been submitted to Alpaca remain in place per Alpaca's rules; we have no ability to unwind already-routed orders without a new authorization.

• HTTPS / TLS 1.2 or better for all client-server and server-third-party communication
• AES-256 encryption at rest for the application database and managed secrets
• Server-side-only storage of API credentials (Plaid, Alpaca, Supabase service role)
• Multi-factor authentication required for administrative access to GitHub, Vercel, Supabase, Plaid, Alpaca, and email
• Row-Level Security on user-scoped tables
• No client-side exposure of secrets; no raw bank account or routing numbers stored anywhere on our infrastructure

• Access — view your data in the dashboard or request a copy
• Disconnect a bank — unlink Plaid relationships from your account settings
• Delete account — request deletion; we revoke Plaid tokens, deactivate Alpaca subscriptions, and remove data not required for legal, security, or regulatory retention
• Correct — update KYC or account information through Alpaca's flows
• Opt out of marketing — unsubscribe in any marketing email; transactional emails cannot be opted out

To exercise these rights, email isaiahdupree33@gmail.com.

We retain data only as long as needed to provide the service, comply with legal obligations, resolve disputes, and enforce our agreements:

• Plaid access tokens — only while a bank-account connection is active
• Plaid balance / identity check results — used at the time of the action and minimally stored
• Bank metadata (institution name, account mask, type) — kept while connection is active
• Audit logs of orders and account events — retained for at least 7 years to meet financial-records requirements (Alpaca holds the canonical records)
• Account profile and Capsule history — retained while the account is active and for a reasonable period after deletion to meet legal obligations

Full schedule: see our internal Data Retention & Deletion Policy (available on request).

We use first-party cookies for authentication (Supabase) and theme preference. We do not currently use third-party advertising trackers. If we add analytics, we will disclose them here before turning them on.

Star Algorithm is not for users under 18. We do not knowingly collect information from anyone under 18.

Star Algorithm currently supports US-based users only. Our infrastructure may process data in the United States and other locations where our providers operate. By using the service, you consent to such transfer.

We may update this policy from time to time. If we make material changes, we will notify you by email or through the dashboard. The "Last updated" date at the top reflects the most recent revision.

Dupree Ops LLC
Email: isaiahdupree33@gmail.com