NOFX Privacy Policy

Last Updated: 2025.11.07

I. Introduction and Scope


A. Introduction

This Privacy Policy (hereinafter referred to as the "Policy") is designed to inform you, as a user of our website, how we handle your personal information. This Policy applies to information collected through nofxai.com and any of its subdomains (hereinafter referred to as the "Website") by NOFX (hereinafter referred to as "we" or "us") acting as the data controller.

B. Core Policy Distinction: Website Data vs. Software Data

The core of this Policy is the distinction between the "Website" and the "Software."
Website Data: This Policy governs the personal information we collect and process from visitors to our "Website."
Software Data: This Policy does NOT apply to any data you process in your self-hosted instance of the NOFX AI Trading Operating System (hereinafter referred to as the "Software") that you download, install, and run on your own.
For the "Software," you are the sole data controller of all data (including but not limited to API keys, private keys, trading data, etc.) that you input or process. We cannot access, view, collect, or process any information you enter into your local instance of the "Software."

II. Information We Collect (on the Website) and How We Use It


A. Information We Collect (Website)

Based on your user queries, we have limited our data collection practices to the bare minimum. We do not require you to create an account, fill out forms, or provide any personally identifiable information (PII) when visiting the "Website."
The only category of data we collect is "automatically collected data," which is implemented through Google Analytics (GA4).

B. Google Analytics (GA4) Disclosure

Our "Website" uses the Google Analytics 4 (GA4) service. This is the only way we collect information. According to Google's Terms of Service, we must disclose this use to you.
Types of Data Collected: GA4 automatically collects certain information about your visit, which is generally non-personally identifiable. This may include:
Number of users
Session statistics
Approximate geographic location (non-precise)
Browser and device information
Data Usage: We use this aggregated data solely to better understand how users access and use our services, thereby improving the performance and user experience of our "Website."
Your Choices and Opt-Out: We respect your privacy choices. If you do not want GA4 to collect your visit data, you can opt out by installing the Google Analytics Opt-out Browser Add-on. You can obtain this add-on by visiting this link: [Google Analytics Opt-out Add-on (by Google)](https://chromewebstore.google.com/detail/google-analytics-opt-out/fllaojicojecljbmefodhfapmkghcbnh?hl=en).

C. Cookies and Tracking Mechanisms

GA4's operation relies on first-party cookies. Specifically, it may use cookies such as _ga and _ga_<container-id> to distinguish unique users and sessions. We explicitly state that we do not use these cookies for advertising or user profiling purposes.

III. Information We Do NOT Collect (Software)

This section aims to clearly articulate our data isolation stance regarding the "Software."

A. Non-Custodial Statement

We (NOFX) are a non-custodial software provider. This means we never hold, control, or access your funds, assets, or sensitive credentials.

B. Explicit Non-Collection List

When you download, install, and use the self-hosted "Software," we absolutely do not collect, access, store, process, or transmit any of the following data in any way:
Any API keys for third-party exchanges (such as Binance)
Any API keys for third-party AI services (such as DeepSeek, Qwen)
Your API secret keys corresponding to your API keys
Your cryptocurrency private keys (e.g., Ethereum private keys for Hyperliquid or Aster DEX)
Your wallet "secret phrases" (mnemonic phrases)
Your trading history, positions, account balances, or any other financial information
Any personal data you configure in your local instance of the "Software"

C. Note on Local Encryption

We are aware that the "Software" provides functionality to encrypt user-entered API keys and private keys. We clarify here that this encryption process is performed and managed entirely on your own device (locally). This data is never transmitted to us or any third party after encryption. This encryption feature is designed to protect your data from unauthorized access to your local device, not to share it with us.

D. Experience Improvement Program (Optional)

To help us improve the product experience, the "Software" sends **anonymous usage statistics** by default. This feature is completely optional and you can disable it at any time.

**Data Types Collected:**
- Exchange type (e.g., Binance, Bybit, etc., excluding your account information)
- Trade type (open/close position)
- Trade amount (USD value)
- Trading pair (e.g., BTCUSDT)
- AI model usage statistics:
  - AI provider name (e.g., OpenAI, DeepSeek, Anthropic)
  - AI model name (e.g., gpt-4o, deepseek-chat)
  - Token consumption (input/output tokens per request)
- Anonymous identifiers (used for counting active numbers, not linked to personal identity):
  - Installation ID: Identifies each independently deployed software instance
  - User ID: Identifies user accounts within the software (only for counting active users)
  - Trader ID: Identifies trading strategies created by users (only for counting active strategies)

**We explicitly do NOT collect:**
- Your API keys, private keys, or any credentials
- Your account addresses, usernames, or identity information
- Specific trade prices, times, or order details
- AI conversation content (prompts, responses, or trading decisions)
- Any information that could reverse-identify personal identity through the above anonymous IDs

**How to Disable:**
Set `EXPERIENCE_IMPROVEMENT=false` in your environment variables to completely disable this feature.

**Purpose of Data:**
These anonymous statistics are only used to understand overall product usage and help us optimize features and improve user experience.

IV. Data Sharing, Retention, and Security (Website Data)


A. Third-Party Sharing

Except as disclosed in this Policy (i.e., sharing GA4-collected analytics data with our service provider Google), we do not share, sell, rent, or trade any of your personal information with any third parties.

B. Data Retention

We retain the aggregated analytics data collected by GA4 only for the period reasonably necessary to achieve the purposes described in this Policy (i.e., website analytics and improvement).

C. Data Security

We employ commercially reasonable security measures (e.g., using HTTPS) to protect the transmission of the "Website" and to safeguard the limited information we collect (through GA4).

V. Your Data Protection Rights (GDPR & CCPA)


A. Scope of Rights

Under applicable data protection laws (such as GDPR or CCPA), you may have certain rights. We clarify here that these rights apply only to the limited GA4 analytics data we hold as the data controller, collected through the "Website." We cannot fulfill any requests regarding "Software" data, as we do not hold such data.

B. List of Rights

Under the law, you have the right to:
Right of Access: You have the right to request a copy of the personal data we hold about you.
Right to Rectification: You have the right to request that we correct information you believe is inaccurate or incomplete.
Right to Erasure (Right to be Forgotten): Under certain conditions, you have the right to request that we delete your personal data.
Right to Restrict Processing: Under certain conditions, you have the right to request that we restrict the processing of your personal data.
Right to Object to Processing: Under certain conditions, you have the right to object to our processing of your personal data.

C. How to Exercise Your Rights

If you wish to exercise any of the above rights, please contact us using the contact information provided at the end of this Policy.

VI. Children's Privacy

Our "Website" and "Software" are not intended for or directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18.

VII. Changes to the Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Any changes will be notified by posting an updated version on the "Website" and updating the "Last Updated" date.

VIII. Contact Information

If you have any questions about this Privacy Policy or our data processing practices, please contact us:
[@nofx_official](https://x.com/nofx_official)
