Privacy Policy

01The short version

In shortWe collect what we need to run your account and connect your brokers, we do not sell it, and you can ask us to see or delete it.

• Who we are. Omega Research and Technologies runs Omega Terminal. Reach us at legal@otrml.com.
• The website collects nothing. otrml.com and the Docs set no cookies and run no analytics or ads. They keep two small notes in your browser, which never reach us.
• The app collects what it needs. That means your account, the providers you connect, the orders you send through us, what you create, and the logs that keep it secure.
• We do not sell your data, share it for advertising or use it to train AI models.
• AI features send your messages and what is on screen to our AI provider, Anthropic, to produce an answer.
• You are in control. You can ask to access, correct, export or delete your data by emailing legal@otrml.com.

02Who we are

In shortOmega Research and Technologies is responsible for your data.

Omega Research and Technologies ("Omega", "we", "us") provides Omega Terminal and decides how and why your personal information is processed. Under European law, that makes us the "controller". We have not appointed a data protection officer. For any privacy question or request, email legal@otrml.com.

03What this policy covers

In shortEverything Omega runs, including features that are coming. It does not cover the brokers and other services you connect.

This policy covers personal information we handle through the Website, the Docs, the desktop app, the members' web app, and upcoming features, such as billing, Omega Academy, Omega data feeds, crypto features and the MCP server, once they launch. Where a feature is not live yet, we say so.

It does not cover services you connect to Omega, such as your broker, SnapTrade, a prediction market venue, a wallet or an AI application you connect through our MCP server. Their own privacy policies apply to what they collect. Our Terms of Use govern your use of the Services.

04Information we collect

In shortThe website collects nothing. The app collects your account, connections, orders, content and security logs.

The Website and the Docs

• No cookies, analytics or ads. We collect no personal information through otrml.com or docs.otrml.com.
• Browser storage. The pages keep two notes in your browser's session storage: that you have seen the visit notice, and which Docs menu sections you opened. They stay in your browser, are never sent to us, and are cleared when you close it.
• Technical requests. Like every website, each page request carries technical details, such as your IP address, browser type, the page requested and the time. Our hosting provider (Vercel) and network provider (Cloudflare) process these details to deliver and protect the site. We do not use them to identify you or build a profile of you.
• Sign-up. There is no sign-up form on the website yet.
• Docs assistant (coming). When we turn on the Docs assistant, the questions you type will be sent to our servers and to Anthropic to generate an answer.

The app

Where connection credentials are kept. Depending on the provider and how you connect, credentials are kept either only on your device, in your operating system's secure storage, or on our servers, encrypted at rest. Today, Schwab credentials, and Interactive Brokers and TopstepX credentials entered in the web app, are kept on our servers. When you link through SnapTrade, you sign in to your broker on SnapTrade's own page, and we keep only the SnapTrade connection secret, on our servers. Webull, Kalshi and Polymarket US keys, and the desktop app's own platform key, stay on your device.

Voice and screen sharing. In a shared desk, audio and screen streams go directly between participants' devices. We do not record or store them. The messages that set up a call pass through our relay without being stored, and Google's public STUN servers see each participant's IP address so the devices can find each other.

What you must give us. We need your email to create an account, a working sign-in method to keep it secure, and credentials for any provider you want to connect. Without them we cannot provide those parts of the Services. Everything else is optional.

Upcoming features

These are not live yet. When they launch, they will collect the following.

• Billing. Your plan, billing email, payment history and billing country or postal code. Your card details go to our payment processor (for example, Stripe). We receive only limited details, such as card brand, last four digits and expiry date.
• Omega Academy. Your purchases, course progress and, if you take part in a recorded live session, your name, voice and messages.
• Omega data feeds. The information exchanges and data vendors require of subscribers, such as your name, address, professional or non-professional status and usage.
• Crypto features. The public wallet addresses you connect and their balances and activity, read from public blockchains; connection details from WalletConnect (Reown); and the swaps you request, with tokens, amounts, fees and transaction IDs. We may screen wallet addresses against sanctions and illicit-activity lists. We never collect your private keys or seed phrase.
• MCP server. Which MCP clients you connect, the access you grant them and a log of their requests.

05How we use information

In shortTo run the Services, connect your accounts, keep things secure and meet our legal duties. Not for ads.

We use personal information to:

• run the Services: create and manage your account, sync your settings and content across devices, show your data and run your strategies;
• connect your providers and carry your instructions: keep connections working, retrieve your account data, send the orders you or your strategies place, ask for your approval by text or in the app, and keep a record of automated orders so the same order cannot be placed twice;
• provide AI features: produce answers and stage orders when you ask;
• power sharing features: deliver messages, shared desks, shared chart images, the social feed and published strategies to the people you choose;
• keep the Services and you secure: verify sign-ins, require your authenticator, bind API keys to devices, detect unusual sign-ins or key use, enforce rate limits and trading limits, and investigate abuse;
• support and talk to you: answer requests, send security alerts, service notices and changes to our terms, and, if you have agreed or the law allows, product news you can unsubscribe from at any time;
• bill you once paid plans launch;
• fix and improve the Services: find errors, measure load and plan capacity, mostly from usage summaries;
• meet legal and licensing duties: comply with law, respond to lawful requests, and report usage to exchanges and data vendors where their licenses require it;
• enforce our Terms and protect our rights and the rights of others.

We do not sell personal information, use it for targeted advertising, use it to train AI models, or make decisions about you by purely automated means that have legal or similarly significant effects.

Sensitive information. Some laws treat the credentials you give us to connect a broker or venue, and your financial account information, as sensitive. We use them only to connect the accounts you choose, carry out your instructions and keep the Services secure. Connecting an account is your consent to that use, and you can withdraw it at any time by disconnecting the account. We do not collect precise location, health, biometric or government ID information.

06Legal bases

In shortIf you are in Europe or the UK, this is the legal reason for each use.

If European or UK law applies to you, we rely on these legal bases:

Where we rely on legitimate interests, you can object, as Section 15 explains.

07How we share information

In shortWith the companies that run our infrastructure, the providers you connect, and the people you choose to share with. Never sold.

We do not sell your personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We share it only as follows.

Service providers

These companies process data for us under contracts that limit their use of it to providing services to us.

Providers you connect

When you connect a broker, venue or account aggregator, such as Charles Schwab, Webull, Interactive Brokers, TopstepX (ProjectX), Kalshi, Polymarket US or SnapTrade, we send it your credentials and the instructions you give and receive your account data from it. SnapTrade also receives an identifier we create for you. Once crypto features and Omega data feeds launch, the same applies to WalletConnect (Reown), swap aggregators such as Jupiter and 0x, blockchains (where every transaction is public and permanent), and the exchanges and data vendors whose licenses require subscriber reporting.

People you choose

Shared desks show your drawings, cursors and messages to participants. Messages and attachments go to the people you send them to. A shared chart image gets a link that anyone who has it can open. If you turn on the social feed, other members see the symbol, side, price and time of your fills. If you publish a strategy or screener, other members see it with your username, which is the part of your email address before the "@" unless you choose another. MCP clients you connect receive what you allow them to access.

Other reasons

We may disclose information if we believe in good faith that the law, a court order or a government request requires it, or to protect the rights, safety and property of our users, the public or Omega, including to prevent fraud and market abuse. If Omega is involved in a merger, acquisition, financing or sale of assets, information may transfer as part of that transaction, and this policy will continue to apply to it unless you are told otherwise. We may also share information with your consent.

08AI processing

In shortAI answers come from Anthropic. We send it what it needs to answer you, and we do not train models on your data.

• What we send. When you use an AI feature, we send your messages and the app context the feature needs, which can include screenshots of the app window and whatever is on it, to Anthropic. Features that analyze your account also send the positions, balances and orders you bring in.
• What we keep. We do not keep your AI conversations on our servers after the answer is delivered. We keep usage counts, such as the amount of AI processing used and its cost.
• What Anthropic keeps. Anthropic processes the content as our service provider under its commercial terms, which do not allow it to train models on that content. Under its published retention policy, it deletes API inputs and outputs within 30 days, unless it must keep them longer by law or to enforce its usage policies; content flagged for a policy violation can be kept for up to two years.
• No training. We do not use your content to train AI models.
• It is an AI. AI features are labeled, so you know you are interacting with an AI, and their output can be wrong (see the Terms).
• Orders. The assistant can stage an order, but it is never sent until you confirm it.
• No automated decisions about you. We do not use AI to make decisions about you that have legal or similarly significant effects.

09Cookies and browser storage

In shortThe website uses no cookies at all. The app uses only the cookies it needs to keep you signed in and remember your preferences.

The Website and the Docs

Today the Website and the Docs use only strictly necessary browser storage. They set no cookies and use no analytics, advertising or tracking technology.

The members' web app and the desktop app

All of these are first-party. We use no third-party, analytics or advertising cookies. You can block or delete cookies in your browser, but the members' web app will not keep you signed in without its essential cookie.

If this changes

If we add any non-essential cookies or analytics, we will update this policy first and ask for your consent where the law requires it.

Global Privacy Control and Do Not Track

We do not sell or share personal information or track you across other websites, so a Global Privacy Control or Do Not Track signal does not change how we handle your data. If we ever begin selling or sharing personal information, we will treat a Global Privacy Control signal as a valid request to opt out.

10How long we keep information

In shortAs long as your account is open, then we delete it, apart from a few records we must keep.

When you close your account or ask us to delete your data, we delete or de-identify it within 45 days, except for information we must keep for the reasons in the table, which we keep only for those reasons. Deleted information can remain in our providers' backups for a limited period, until those backups expire.

11Security

In shortWe protect your data with reasonable safeguards, but no system is perfect.

We use reasonable administrative, technical and physical safeguards designed to protect personal information. They include encryption in transit, a required authenticator code at sign-in, encryption at rest of the connection credentials and phone numbers we store, storage of desktop keys in your operating system's secure storage, and limited internal access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Protect your password, authenticator and keys, and tell us at legal@otrml.com if you think your account is at risk. If a breach affects your personal information, we will notify you and regulators without unreasonable delay and within the time the law requires. In Florida, that is generally within 30 days after we determine that a breach occurred.

12Your rights and choices

In shortYou can see, fix, export or delete your data, and you will not be treated worse for asking.

Wherever you live in the United States, you can ask us to:

• know and access the personal information we hold about you and how we use it, covering the 12 months before your request or a longer period if you ask and the law gives you that right;
• correct information that is wrong;
• delete your information;
• export a copy in a portable format;
• opt out of the sale or sharing of personal information, targeted advertising and profiling. We do none of these, so there is nothing to switch off.

Choices in the app. You can disconnect providers, revoke API keys, turn the social feed off, turn approval texts off, delete content and remove your profile picture at any time.

How to make a request. Email legal@otrml.com from the email address on your account. We will confirm receipt within 10 business days and respond within 45 days. If we need more time, we will tell you why, and we may take up to 45 more days. We verify requests by matching them to your account and may ask for more information to confirm your identity. An authorized agent can make a request for you if they show your signed permission, and we may still ask you to confirm your identity with us. Requests are free.

No discrimination. We will not deny you service, charge you a different price or give you a lower quality of service because you exercised a privacy right.

Appeals. If we decline your request, you can appeal by replying to our decision with "Appeal" in the subject line. We will respond in writing within the time your state's law requires. If you are not satisfied, you can contact your state attorney general.

13California

In shortThe details California law asks for. We do not sell or share your data.

Where the California Consumer Privacy Act, as amended, applies to us, California residents have the rights described in Section 12 under it, and we give everyone the same rights either way. In the past 12 months we have collected the following categories of personal information, from the sources in Section 4, for the purposes in Section 5, and disclosed them for business purposes to the recipients in Section 7.

We do not sell or share personal information, including that of anyone under 16, and we have not done so in the past 12 months. We use sensitive personal information only to provide the Services you request and to keep them secure, so we do not offer a separate right to limit its use. We do not disclose personal information to third parties for their own direct marketing.

14Other US states, including Florida

In shortWhichever state you live in, you get the same rights.

About 20 states now have comprehensive privacy laws, including Virginia, Colorado, Connecticut, Texas, Oregon, Indiana, Kentucky and Rhode Island, with more taking effect in 2027 and 2028. Depending on the state, they give residents rights that can include confirming whether we process their personal information, accessing, correcting and deleting it, getting a portable copy, opting out of sale, targeted advertising and profiling, and appealing a decision. Some of these laws require consent before a business processes sensitive data; Section 5 explains how we handle it.

Florida's Digital Bill of Rights applies in full only to very large companies, with more than $1 billion in annual revenue and meeting other tests, and Omega is not one of them. Its ban on selling sensitive data without consent applies to every business; we do not sell any personal data. Nevada residents may ask us not to sell their personal information, although we do not sell it. We honor these rights for every user in the United States, whether or not their state's law applies to us. Use the process in Section 12.

15EEA, UK and Switzerland

In shortOmega is built for the US. If you use it from Europe or the UK, you have these extra rights.

Omega is designed for users in the United States and is not offered in the EEA, the UK or Switzerland, so we have not appointed a representative there. If the GDPR, the UK GDPR or Swiss data protection law applies to you, you have the right to:

• access your personal information and receive a copy;
• correct it;
• erase it;
• restrict how we use it;
• receive it in a portable format;
• withdraw consent at any time, without affecting earlier processing.

Your right to object. You can object at any time to processing we base on legitimate interests, and we will stop unless we have compelling grounds that override your interests. You can always object to the use of your information for direct marketing, and we will stop.

To use these rights, email legal@otrml.com. We respond within one month, which we may extend by two months for complex requests, and we will tell you if we do. You may also complain to your local data protection authority, to the Information Commissioner's Office in the UK, or to the Federal Data Protection and Information Commissioner in Switzerland.

16International transfers

In shortYour data is processed in the United States.

We are based in the United States, and we and our service providers process personal information in the United States and in other countries where those providers operate. When we transfer personal information from the EEA, the UK or Switzerland, we rely on the European Commission's standard contractual clauses and their UK and Swiss equivalents (such as the UK's international data transfer addendum) offered by our providers, or on the EU-US Data Privacy Framework where a provider is certified under it. You can ask for a copy of the relevant safeguards at legal@otrml.com.

17Children

In shortOmega is for adults only.

The Services are for people 18 and older. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that someone under 18 has an account or has given us personal information, we will delete the information and close the account. If you believe that has happened, email legal@otrml.com.

18Changes to this policy

In shortWhen we change this policy, we update the date, and for big changes we tell you first.

We review this policy at least once a year. When we update it, we change the date at the top. For material changes, we will tell you by email or in the Software before they take effect. We will not use personal information we already hold in a materially different way than this policy describes without first telling you and, where the law requires, getting your consent. Earlier versions are available on request.

19Contact

In shortOne address for every privacy question and request.

Questions, requests and complaints about privacy: legal@otrml.com.