Privacy Policy

Version 2026-11-11 · Last updated 11 November 2026

In short: we collect only what we need to run your account and follow the desk on your paper account. Your Alpaca keys are encrypted. We don't sell your data, we don't run advertising or tracking, and you can have everything deleted by emailing us.

Who we are

MonsterDesk ("we", "us") runs monsterdesk.ai. For anything about your data, email admin@monsterdesk.ai.

What we collect

Account details: your email address and your password, which is stored only as a salted one-way hash. We cannot see it.
Your acceptance of our terms: which version of the Terms and Privacy Policy you accepted, and when.
Alpaca paper account link: your paper API key and secret, encrypted at rest, and the last four digits of your paper account number.
Course final project (course members who start one): the paper API key and secret of the project's paper account, encrypted at rest and deleted the moment the project finishes or you stop it; the account's daily value and trade count over the project; and what you type for the certificate (your agent's name, its idea, your exam result and, only if you choose, a name to show). A finished project's certificate is a public page. It never shows your email.
Paper account information: your paper account's equity, cash and positions, which we read to show your account page and size the mirror, and a log of the simulated orders the mirror places for you.
Weekly summary (only if you sign up): your email address and when you confirmed. We use double opt-in - nothing is sent until you click the link in our confirmation email - and every summary has a one-click unsubscribe that deletes your address from the list.
Waitlists (only if you join one): your email address, which product's waitlist you joined, an optional note you add, and when. If you are signed in, it is linked to your account. Joining sends no email; we use the address only to tell you when that product opens.
Self-hosted software (only if you have a plan): your email address, your plan and agents, and a one-way hash of each install's credential (we cannot see the credential itself). When you connect an install with a sign-in code, we keep the short-lived code record (the code, the install id, which plan approved it and when) until a day after it expires. For each install that checks in: a random install id, the software version, when it first and last checked in, and a one-way hash of its IP address. Your Alpaca keys stay on your own machine and are never sent to us, and we receive nothing about your trades from your install.
Your settings: whether you are following the desk.
Account activity: a simple log of events such as sign-up, linking, unlinking, password resets and emails sent, with timestamps.
Technical data: your IP address is used briefly to limit repeated sign-in attempts and may appear in short-lived server logs. A single session cookie keeps you signed in. We do not use advertising or analytics cookies.
Visitor counts: we count how many times each public page is shown, per day, and which kind of link brought the visit (for example a search engine or one of our social posts). These are totals only. To count a visitor once a day, your IP address and browser type are mixed with a random key that exists only in the server's memory and is thrown away; nothing about you is written to disk, no cookie is used for this, and the totals cannot be traced back to anyone.
Emails you send us: when you write to admin@monsterdesk.ai, your message is read by our support staff, which are AI assistants, so that a reply can be drafted. A person approves every reply before it is sent. Our working copy of your message is deleted within 45 days of it being dealt with.
Payments (only if you buy): Lemon Squeezy, our merchant of record, collects your payment and billing details. We receive your order and subscription status, which product and price you bought, and Lemon Squeezy's order and subscription ids, never your card details.
Founding-price reservations (only if you reserve one): handled as a waitlist entry, as above.

Why we use it

To create and secure your account and sign you in.
To link your Alpaca paper account and, if you choose, mirror the desk's simulated trades onto it.
To send service emails: welcome, password resets, and important notices about the Service or these policies. We will only send marketing emails, such as a weekly summary, if you opt in, and every such email will let you unsubscribe.
To tell you when a product you joined the waitlist for opens, and to run the software beta: checking that a licence is valid and sending the agents it covers.
To keep the Service secure, prevent abuse, and fix problems.
To meet legal obligations.

Who we share it with

We do not sell or rent your data. We share it only with the service providers that run the Service for us, and only as far as they need it:

Alpaca: we send your paper keys to Alpaca's paper endpoint to read your paper account and place simulated orders.
Hetzner Online: our server, located in Helsinki, Finland (EU).
Apple iCloud: holds backup copies of the Service's data, including account details, in a private storage account that only we control.
Namecheap Private Email: sends our emails to you.
Lemon Squeezy: payments, as our merchant of record.
Anthropic: provides the AI (Claude) that our support staff run on. The text of an email you send us is processed by it to draft the reply.

We may also disclose information if the law requires it, or to protect the Service and its users.

How we protect it

The site runs only over HTTPS. Passwords are hashed, Alpaca keys and password-reset links are protected (keys encrypted, reset links stored only as hashes and expiring after an hour), and access to the server is restricted. Your data is held on a secure server, and backup copies are kept in private storage that only we control. The Service only ever connects to Alpaca's paper endpoint. No system is perfectly secure, so please use a unique password.

How long we keep it

Your account data is kept while your account is open.
Backup copies are replaced on a rolling basis, so a deleted account can remain in them for up to eight weeks before it is gone from every copy.
Unlinking your Alpaca account deletes your stored keys immediately.
When you ask us to close your account, we delete your account data within 30 days, except anything we must keep for legal reasons.
Waitlist entries are kept until we have told you the product is open, or until you ask us to remove them; deleting your account also deletes any waitlist entries linked to it.
Licence and install records are kept while the licence is active and for up to 12 months after it ends, so we can answer questions about it.
Technical logs are kept for a short period, then deleted.

Your choices and rights

You can ask us to give you a copy of your data, correct it, delete it, or stop using it for a particular purpose. Email admin@monsterdesk.ai from your account's email address and we will respond within 30 days. You can stop following or unlink your Alpaca account yourself at any time from your account page.

International transfers

Our server is in the EU. Backup copies and some providers (such as Apple, Alpaca, Lemon Squeezy and Anthropic) may store or process data in other countries, including the United States, under their own safeguards.

Children

The Service is for adults only. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, email us and we will delete it.

Changes

If we change this policy materially, we will update the version and date above and ask you to accept the new version, as described in our Terms of Use.