Privacy Policy

Last updated: October 1, 2026

This policy has two parts. Part A covers darklyenergized.com: the analytics platform, our consultancy work, and anything you send us through the site, by email, or on a call. Part B covers Proactive Agent, our iOS app, which keeps your data on your device and has no server of ours behind it.

PART A: darklyenergized.com

1. Introduction and why we are allowed to hold your information

Darkly Energized LLC ("Darkly Energized", "we", "us", or "our") explains here what we collect when you use darklyenergized.com ("the Service") or work with us on an engagement, why we hold it, and what you can ask us to do about it.

We do not rely on your consent for most of what we do, because consent is the wrong basis for it. Where the GDPR applies, the basis for each purpose is:

• Running your account and your subscription, and performing a project or engagement you have asked us to do, because it is necessary to perform our contract with you, or to take the steps you asked for before entering into one.
• Keeping executed agreements and the record of an engagement after a relationship ends, because we have a legal obligation to keep certain records, and a legitimate interest in being able to establish or defend a legal claim.
• Answering an enquiry or a support request, because we have a legitimate interest in replying to someone who wrote to us.
• Security, rate limiting and preventing abuse, because we have a legitimate interest in keeping the Service working and unabused.
• Understanding how the Service is used and which campaigns brought people to us, because we have a legitimate interest in knowing which of our own efforts work.
• Sending you a marketing email, if we ever do, because you asked us to. That one is consent, and you can withdraw it at any time without affecting anything else.

Where we rely on a legitimate interest, you can object; see section 7.

2. Information we collect

Account information

When you register, we collect your full name, email address, and password (hashed). If you register via Google OAuth, we receive your name, email, and profile image from Google.

Payment information

Payments are processed by Stripe. We do not store your credit card numbers or banking details. Stripe may collect payment information in accordance with their own privacy policy. We store your Stripe customer ID; the identifier Stripe assigns to a payment method you have verified with it, which is not the card or account number itself, and the time you verified it; and the identifiers of the invoices and any subscription Stripe holds for an engagement, so that we can show you where to pay and know when you have.

x402 cryptocurrency payments

When you access the API via x402 pay-per-call, we record your blockchain wallet address, transaction hash, IP address, and series accessed for audit and compliance purposes. Blockchain transactions are publicly visible on the Base network; we do not collect personal identity information beyond what is inherent in blockchain data.

Usage data

We collect information about how you use the Service, including saved chart configurations, indicator preferences, and API usage patterns.

Technical data

We collect your IP address, browser type, operating system, and referring URLs, for security, rate limiting and fraud prevention.

Pages you visit

When you open a page on the site, we record the address of the page, the time, the address of the site that sent you if it was another site, any campaign parameters in the link you followed, whether the visit looks like an automated crawler, and a visitor code. The visitor code is a one-way hash of your IP address and browser details that changes every day, so it cannot follow you from one day to the next; we do not store the IP address itself with a page view. If you are signed in, we also record your account with the visit. We use this to understand which pages are used and which of our campaigns brought people to us. Our own visits are not recorded.

Project briefs

When you describe a project, we store the answers you give and every earlier version of them, with a note of whether you or an agent acting for you wrote each one, and the time each was written. We also store what we write about the project: our notes, an estimate of the work, the checklist of what each side owes once an agreement is sent, and a snapshot of the proposal at each version.

Agreement and party details

When you sign an agreement with us, we store the legal name of the party you are signing for, the kind of entity it is, its registered address and country, and the name and title of the signer. We also store your email address, the IP address and time of signing, the drawn signature image if you provide one, and a SHA-256 seal over the executed document. If we confirm your identity by a call or another method, we store a note of how and when.

Engagement records

While an engagement runs, we keep the record of it: each delivery we make and the note describing it; your acceptance of a delivery, with the name and title you give, the time, the IP address it came from, and a seal over the record; an acceptance you withhold, with the reason you give; and the notes we write on the engagement, such as the reason for a hold, a suspension, a waived billing step, or an objection you sent us outside the Service and we recorded with the date it arrived.

Information we receive outside the Service

You do not have to use the Service to work with us. Where you deal with us by email, on a call, or in documents you sign elsewhere, we store what you tell us that the engagement needs: your name, title and business contact details, the details of the party you act for, the description of the project you give us, agreements you signed elsewhere that we attach to the record, and the name and email address of a finance or billing contact if you give us one. This information is held with the same records, for the same purposes, and for the same periods as information you give us through the Service.

Enquiries and support

When you write to us through a contact or support form, we store your name, email address, subject, the kind of enquiry, your message, and the IP address it came from, together with the referring URL, any campaign parameters in the link you followed, and the first page you arrived on in that visit.

3. How we use your information

• Providing, operating, and maintaining the Service.
• Processing payments and managing subscriptions via Stripe, and issuing and collecting invoices for an engagement.
• Sending email verification and account-related communications, and the notices an engagement requires, such as that a delivery has been made.
• Enforcing rate limits and preventing abuse.
• Reading and evaluating a project you describe to us, and preparing a proposal or an agreement from it.
• Entering into and performing an engagement, including issuing and keeping the agreements that govern it and the record of what was delivered, accepted, invoiced and paid.
• Answering a business enquiry, and answering a product support request. We keep these separate because they are different things and you may ask us about either.
• Detecting and preventing fraud and unauthorized access.
• Improving the Service based on usage patterns, and understanding which campaigns brought people to us.

4. Data storage and security

Your data is stored in PostgreSQL databases and Redis caches on servers operated by Darkly Energized. We do not use a managed hosting provider that administers them on our behalf. Access is limited to the owner of Darkly Energized and to the automated deployment and backup jobs described in section 5.

We implement security measures including:

• Password hashing using secure algorithms.
• API keys are hashed before storage. We cannot retrieve your raw key.
• HTTPS encryption for traffic between your browser and the Service.
• CSRF protection on all form submissions.
• Session-based authentication with secure, HTTP-only cookies.

We take regular backups of the database, stored encrypted at rest by our storage provider, and keep only recent copies. A backup is a snapshot of the database as it was, so information you have deleted can persist in a backup copy until that copy is replaced in the ordinary rotation, after which it is gone.

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

5. Third-party services

Hosting

The Service runs on a virtual private server provided by Vultr (The Constant Company, LLC), located in Atlanta, Georgia, United States.

Backups and deployment

Database backups are stored with Amazon Web Services (S3), in the United States. GitHub (Microsoft) runs the automated jobs that deploy the Service and copy the database backup to S3, and holds the credentials needed to do so; the backup passes through GitHub's infrastructure on its way to S3.

Email

We send account and transactional email through Microsoft 365, provisioned through GoDaddy.

Stripe

We use Stripe for payment processing, for invoicing an engagement, and for the page on which you verify a payment method. Stripe's use of your information is governed by their privacy policy. If you give us a billing contact, Stripe sends invoices and receipts to that address.

Google OAuth

If you sign in with Google, we receive basic profile information as permitted by your Google account settings. See Google's privacy policy for details.

x402 Protocol / Coinbase

x402 cryptocurrency payments are facilitated through infrastructure operated by Coinbase via the x402.org protocol. See Coinbase's privacy policy for details on their data practices.

Engineering and AI tooling

We carry out our work using computing services and AI tools. Project briefs, materials you send us, and work produced for you may be processed by them.

Some of that processing happens on models running on hardware we control, which sends your information to no one.

Where we use a hosted provider, it may be any of Anthropic, Google, OpenAI, xAI, or Microsoft (Azure AI Foundry). We use a service only where its use of your information to train models is prevented, whether by the service's terms or by account settings we control, and only where the service does not publicly index what we send it. Such services may retain, review and disclose inputs and outputs to the extent their standard terms and applicable law permit, including under legal process. We do not warrant that any of them operates on a zero-retention basis.

We use AI tools for our own work too: writing, research, and general engineering that involves nothing of yours. That use is not covered by this section, because your information is not in it.

Data sources

We fetch financial data from third-party APIs (FRED, central banks, CBOE, CoinGecko) on the server side. No user data is shared with these data providers.

6. How long we keep things

• Account information: for as long as your account is open. If you close it, your personal profile is removed at once.
• Executed agreements and engagement records: seven years from the end of the agreement. These are records we are required to keep, and they hold the party details, signature information and engagement records described in section 2, including information we received outside the Service. They are kept whether or not you have, or had, an account.
• Project briefs that did not become an agreement: deleted with your account.
• Enquiries and support messages: two years from your last message.
• x402 settlement records: seven years from the settlement, as payment records.
• Page views and technical data: thirteen months.
• Cached financial data: stored temporarily with defined time-to-live values and purged automatically when expired. Session data expires after a configured inactivity period.

Deleting information from the live system does not immediately remove it from backups; see section 4 for how long those persist.

7. Your rights under the GDPR

If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your personal data. We may have to keep an executed agreement or the record of an engagement to meet a legal obligation or to establish or defend a legal claim; if we do, we will tell you what we kept and why.
• Restriction: request that we restrict processing of your data.
• Portability: request a machine-readable copy of your data.
• Object: object to processing carried out on the basis of a legitimate interest.
• Withdraw consent: where processing is based on consent, withdraw it at any time. This does not affect anything we did before you withdrew it.

To exercise any of these rights, please contact us at support@darklyenergized.com. You can do so whether or not you have an account with us.

8. Your rights under the CCPA

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended:

• Right to know: request disclosure of the categories and specific pieces of personal information we collect, the purposes, and how long we keep them. Sections 2, 3 and 6 answer this.
• Right to delete: request deletion of your personal information.
• Right to correct: request correction of inaccurate personal information.
• Right to opt out: we do not sell or share your personal information.
• Non-discrimination: we will not discriminate against you for exercising your privacy rights.

These rights apply to business contacts as well as consumers. If you gave us your name and title as the signer of an agreement, or as the person who accepted a delivery, that is your personal information and these rights cover it.

9. Cookies

We use cookies, all of which are essential for Service operation. These include:

• Session cookies: required for authentication and maintaining your logged-in state. The session is held in the cookie itself, encrypted; we keep no copy of it on our servers.
• CSRF tokens: required for protecting against cross-site request forgery attacks.

We do not use third-party tracking cookies, analytics cookies, or advertising cookies.

10. Children's privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take steps to delete such information promptly.

11. Where your information is held, and who reaches it

Darkly Energized LLC is a Wyoming company. The servers that run darklyenergized.com are located in the United States, in Atlanta, Georgia, and your information is stored and processed there. If you use the Service from outside the United States, your information is transferred to and processed in the United States.

Darkly Energized is run by its owner, who works from Malaysia. Account records, project briefs, executed agreements and engagement records are therefore routinely read from Malaysia, over an encrypted connection to the United States servers, by Darkly Energized itself. This is access by us, not disclosure to anyone else: we do not send your account records, project briefs, executed agreements or engagement records to any other organization outside the United States. Our pages load their fonts, scripts and images from our own servers, with two exceptions. The page where you subscribe to the analytics platform loads Stripe's payment form from Stripe so that your card details go to Stripe rather than to us. And if you signed in with Google, your browser loads your profile picture from Google.

Where the GDPR applies to us, we do not rely on a Chapter V transfer mechanism for the access described above, because it is access by the controller rather than a transfer to another controller or processor.

If that ever changes, and we engage a contractor, a service provider or any other organization outside the United States to handle your information, we will say so here and put an appropriate safeguard in place before we do it.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or via email. The "Last updated" date at the top of this page indicates the most recent revision.

PART B: Proactive Agent (iOS)

Proactive Agent is a separate iOS application published by Darkly Energized LLC. It is designed so that your financial information stays on your device. Specifically:

• No account on our servers. The app does not create an account with Darkly Energized. We have no database of Proactive Agent users.
• No bank linking. The app does not integrate with bank-linking services. Statements you import (CSV, PDF) are parsed on-device.
• No analytics SDKs. The app contains no third-party analytics, advertising, or tracking SDKs.
• On-device AI. The in-app advisor uses Apple Intelligence on supported devices and runs locally. Prompts and responses are not sent to Darkly Energized.
• One outbound request. The app fetches daily currency exchange rates from the European Central Bank via the public Frankfurter API (api.frankfurter.dev). The request contains no personal data; as with any web request, your IP address may be logged by the rate provider.
• Purchases handled by Apple. The optional Pro Unlock and Tip Jar are processed by Apple via the App Store using your Apple ID. Apple's privacy policy governs these transactions.
• Deletion. Removing the app from your device removes the data. There is no server-side copy to delete.

Because the app holds your information on your device and sends none of it to us, there is nothing for us to transfer, retain or delete on our side.

If you contact us via the Proactive Agent support form, your name, email, and message reach Darkly Energized so we can reply. That message is handled as described in Part A: see "Enquiries and support" in section 2, section 6 for how long we keep it, and section 11 for where it is held.

13. Contact

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at support@darklyenergized.com.