Skip to content
Aureus — Trade. Analyze. Improve.
Log in

Privacy Policy

Last updated: 1 November 2026

This policy explains what personal data Aureus collects, why, and what rights you have. It covers website visitors, people who request access, and account holders.

1. Who is responsible

The controller of your personal data is Dario Savić, an individual based in Serbia, who operates Aureus. For any privacy question or request, contact aureuspro.office@gmail.com.

2. What we collect

  • Early Access form: your name, email address, and optionally your trading experience and what you would use Aureus for; the time you gave consent.
  • Technical data: a one-way hash of your IP address (we never store the address itself), your browser's user-agent string, and server logs needed to run and secure the service.
  • Account data: email, password hash, two-factor authentication settings and a log of sign-ins.
  • Content you enter: journal entries, notes, trade screenshots, settings, risk profiles, strategies and backtest results. If you connect a third-party account (for example TradingView), the access token, stored encrypted.
  • Analytics, only if you accept: on the public pages, Google Analytics records which pages you view, which buttons you click, a random browser identifier, the referring site, and your approximate location, device and browser. See section 4a.

We do not use advertising trackers, we do not sell personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.

3. Why we use it and on what legal basis

  • To contact you about access: your consent, which you can withdraw at any time.
  • To measure how the public pages are used (Google Analytics): your consent, given in the cookie banner and withdrawable at any time.
  • To protect the service against abuse (rate limiting, bot checks, security logs): our legitimate interest in keeping Aureus secure.
  • To provide your account and its features, and to send service emails such as sign-in or password-reset messages: performance of our contract with you.

4. Who processes data for us

  • Vercel Inc. (hosting and serverless functions; functions run in Frankfurt, Germany).
  • Supabase Inc. (database, authentication, file storage and service emails; data stored in Frankfurt, Germany).
  • Cloudflare Inc. (Turnstile bot check on the Early Access form).
  • Google Ireland Limited (Google Analytics on the public pages, only with your consent; see section 4a).
  • Anthropic, Claude API (generation of the daily market report). No personal data is sent: only market figures.

Some of these providers are based in the United States and may access data from there. Transfers rely on the safeguards these providers offer, such as the EU Standard Contractual Clauses.

4a. Analytics

With your consent we use Google Analytics 4 on the public pages (home page, free tools and legal pages), never in the Aureus app or on the sign-in pages. It tells us which pages and buttons are used and how visitors find the site, so we can improve it. Before you choose, and if you decline, no Google Analytics code is loaded.

  • Data: pages viewed, clicks on the main buttons, that the Early Access form was sent (never what you typed in it), a random identifier stored in the _ga cookies, referring site, approximate location derived from your IP address, device and browser type. Google Analytics 4 does not log or store IP addresses.
  • Legal basis: your consent. You can withdraw it at any time with the "Cookie settings" link.
  • Processor: Google Ireland Limited. Data may be transferred to Google LLC in the United States under the EU–US Data Privacy Framework.
  • Advertising features, Google signals and ad personalisation are switched off.

5. How long we keep it

  • Early Access requests: until access is granted or declined, then 12 more months, or until you ask us to delete them.
  • Account data and content: while the account is open. When you close it, we delete it within 30 days, except what the law requires us to keep; backups roll over within a further 30 days.
  • Rate-limiting records: up to 24 hours.
  • Analytics data: 14 months in Google Analytics, then deleted automatically; the cookies last 13 months.
  • Security logs: as long as needed to protect the account, and no longer than 12 months.

6. Your rights

You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, or object to processing based on legitimate interest. Withdrawing consent does not affect processing that happened before. Send requests to aureuspro.office@gmail.com.

Aureus is not intended for anyone under 18.

You can also complain to the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia, or to the data protection authority in your EU country of residence.

7. Security

Data is encrypted in transit, access to each account's data is restricted in the database itself, sign-in is protected by two-factor authentication, and secrets never reach the browser. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

8. Cookies

Aureus uses strictly necessary cookies and, only if you accept, Google Analytics cookies. See the Cookie Notice.

9. Changes

We will update this page if our processing changes. The date at the top shows the latest version; account holders are told by email about material changes.