Security & Privacy

Privacy Policy

Your data belongs to you. Learn how DATAVEIN secures your keys and respects your privacy.

1. Local-First (Self-Hosted) & Hosted Cloud Options

DATAVEIN is available in two hosting configurations to suit your preferences:

  • Self-Hosted (Local-First): You host the open-source code yourself. All configurations, exchange API keys, and trade history records are stored directly on your own infrastructure (SQLite file or private database). We have zero access to your data.
  • Hosted Cloud SaaS: We manage the hosting, server database, and sync engine for you under a tiny subscription plan. For this version, your configurations are securely stored and processed in our encrypted cloud environment.

2. What Data is Collected & Processed?

To provide the trade syncing service, the application processes the following information:

  • Exchange API Credentials: DATAVEIN strictly requires Read-Only API permissions. Trading and withdrawal access MUST be turned off on your exchange key. Keys are only used to query read-only execution history.
  • Notion Integration Token & Database ID: Required to establish the connection and write trade records into your table.
  • Trade Logs: Execution history (prices, size, side, duration, symbols, fees, and Net P&L) pulled from the exchange to aggregate and sync.

3. Symmetric Encryption

To prevent unauthorized exposure, sensitive database columns (like exchange secrets and Notion integration tokens) are encrypted before write-operations using **Fernet symmetric encryption** (AES-128 in CBC mode with HMAC-SHA256 authentication).

Self-Hosted: The encryption key is managed by you via your private environment variables (`ENCRYPTION_KEY`), meaning credentials remain unreadable even if your database file is accessed.

Hosted Cloud SaaS: Your credentials are encrypted and stored in our database using secure, rotated encryption keys managed inside our cloud key management system, isolated from public access.

4. Outbound Network Requests

DATAVEIN only makes outbound API calls to verified third-party endpoints. These connections include:

  • Exchange APIs: Direct REST requests to Binance and BingX to pull trade executions.
  • Notion API: Secure HTTPS endpoints (`api.notion.com`) to manage database structures and insert trade pages.
  • Groq API (Optional): Direct requests to Groq (`api.groq.com`) to generate AI summaries, only active if a `GROQ_API_KEY` is provided.
  • Dodo Payments (Optional): Direct requests to generate checkout links for subscriptions, and webhook signals sent from Dodo Payments.

No telemetry, usage data, or tracking logs are ever collected or sent to external servers by DATAVEIN.

5. Data Deletion & Control

You have complete control over your credentials. Disconnecting your exchange or Notion config from the app's dashboard panel executes a strict SQL `DELETE` query, wiping the records and their encrypted payloads completely from the SQLite database.

Since the database is hosted in your environment, deleting or resetting your hosting container completely clears all history files.

6. Contact & Questions

If you have any questions regarding security architecture, code audits, or local deployments, feel free to inspect the open-source code or open an issue on our GitHub repository.