Private paper portal: risk & privacy
Virtual evaluation, not a financial promise
This release is an administrator-approved experimental paper-trading tool. Its balances, orders and positions are virtual. It does not collect exchange API keys, accept deposits, enable withdrawals or execute live exchange orders. Do not enter real exchange credentials into account labels or other portal fields.
No mode guarantees no loss, capital protection, a 30% return or any other result. Conservative means lower configured paper risk, not risk-free trading. Historical backtests and paper samples are not forecasts. Modelled fees, funding and fills may differ materially from real execution.
Account information
The portal stores your username, display name, password hash, approval/permission status, session records, virtual account settings, paper ledgers and relevant audit events on the administrator's server. Passwords require at least 10 characters and are hashed, not recoverable plaintext. First administrator setup requires a private, expiring, single-use ownership link before a new password and authenticator are activated. Essential HTTP-only session cookies are used for sign-in; there is no advertising or analytics integration in this portal.
Approval and visibility
Access requires administrator approval. Ordinary members can access only their own approved account activity. The administrator manages approvals, permissions, service capacity and audit records. Suspended access blocks sessions and new entry permissions; it does not delete historical ledgers. Paper-worker stops can pause virtual-position updates, so stopped balances must not be interpreted as current market values.
Optional AI processing
If enabled by the administrator, a review is sent to DeepSeek only when you explicitly request it and consent. The review contains redacted virtual-trade evidence, not your password, exchange credentials, account billing data or the existing private trading system's information. AI output is untrusted advisory text; it cannot place orders or modify settings. Provider processing is separate from the administrator's server and may occur in another jurisdiction.
Retention and support
Contact the administrator who invited you for access, correction, export or deletion requests and details of hosting/retention. There is no automatic deletion promise: audit and evaluation records may need to be retained. Do not use this private pilot for sensitive identity documents or real-money account data. Connecting other people's live accounts would require a separate release, permissions, exchange checks and legal review.
Third-party component
Authenticator QR codes are generated locally with the existing MIT-licensed QR Code Generator component. Its copyright and license notice remain in the distributed source. No QR secret is sent to an external QR service.