Privacy notice
What MONUNI stores, why, where it physically lives, and how to get rid of it. Written from the database itself, so it describes what actually happens rather than what is customary.
Effective from 2 September 2026. Earlier versions are available on request.
The operating entity behind MONUNI has not been published here yet. Until it is, treat this page as a description of how the service behaves rather than as a contract you can enforce against a named party. If you are evaluating MONUNI and need this resolved, write to support@monuni.chat.
1.The short version
- No analytics, no trackers, no advertising. This site loads no analytics script, no tag manager, no advertising pixel and no session recorder. The four cookies it sets are all functional and all first-party.
- Nothing is sold or shared for marketing. Ever, to anyone.
- Your exchange secret is encrypted before storage and cannot be read back — not by you after you enter it, and not by our staff.
- Everything runs in the EU, on servers in Helsinki, Finland.
2.What we store, and why
Four categories, and nothing outside them.
Account
Your email address, the display name you choose, and a hash of your password — Argon2id, which is a one-way function: we cannot recover your password, only check one. Plus the dates your address was verified and your password last changed. Needed to give you an account at all.
Security and access
For each sign-in: the IP address and browser user-agent, the session’s creation and expiry, and whether it was revoked. Plus a count of failed sign-in attempts and any lock-out. This is how you can see and end your own sessions, and how an account takeover is detected — keeping it is a security measure, and dropping it would make you less safe, not more private.
Exchange connections
Which exchange, which environment, the trading mode, and the API key and secret you supplied. The secret is sealed with a per-connection data key which is itself wrapped by a separate master key, and bound cryptographically to that one connection so it cannot be replayed against another. It is never returned by any interface and never written to a log.
Trading records
Every decision MONUNI made on your behalf — including the ones where it declined to trade — with the market conditions at the time, the reasons, the orders placed, the positions held and the resulting profit and loss. Plus an audit log of actions taken on your account, with who did them and from which IP. This is the record that lets you check what the software did, and it is not optional to the product.
3.Cookies
Four, all first-party, all necessary for the service to function. None is used for analytics or advertising, so there is no consent banner — there is nothing to consent to. Full detail on the cookie page.
4.Where it runs
On servers operated by Hetzner Online GmbH in Helsinki, Finland — inside the European Union. The database is not reachable from the public internet at all; it accepts connections only from the application on the same private network.
Your data is not transferred outside the EU by us. If you connect an exchange, MONUNI sends orders to that exchange’s API on your instruction, and the exchange may be located anywhere — that is a consequence of the account you chose, and their privacy policy governs what they do with it.
5.Who else can see it
A deliberately short list.
- Hetzner Online GmbH — hosting. They hold the physical machine; they have no application access.
- An email delivery provider — for verification, password-reset and security messages. It receives your email address and the message, and nothing else. This notice will name the provider once one is in service.
- Your exchange — receives the orders MONUNI places, on your instruction, under your own API key.
That is the entire list. There is no analytics provider, no advertising network, no customer-data platform, no AI provider and no data broker, because none is used.
6.How long it is kept
- Your account — until you delete it.
- Sessions — expired and revoked sessions are cleared routinely.
- Decisions — decisions that produced an order, a proposal or a position are kept for as long as your account exists, because they are the record of what happened to your money. Decisions where MONUNI declined to trade are summarised into daily statistics after a retention window and the individual rows deleted; the summary is kept, so the shape of what it refused stays visible.
- Audit records — kept for the life of the account, and where we are legally required to, beyond it.
- Exchange secrets — destroyed when you disconnect the exchange or close your account.
7.Your rights
Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or export it in a portable form. Write to privacy@monuni.chat and we will respond within one month.
Two honest limits. Deleting your account does not delete records we are legally obliged to keep, and it does not reach anything already sent to your exchange — the orders MONUNI placed are theirs now, and you have to ask them. Neither is a policy choice on our side.
If you are unhappy with how we have handled your data you may complain to the data protection authority in your country, and you do not have to come to us first.
8.Security
Passwords are hashed with Argon2id. Exchange secrets are envelope-encrypted and bound to their connection. Session cookies cannot be read by JavaScript, and the browser is prevented by the page’s own security policy from reaching an exchange domain, so a compromised script cannot exfiltrate a credential. Each customer’s data is isolated at the database level rather than by application code alone.
Report a vulnerability to security@monuni.chat. If a breach affects your personal data we will tell you and the relevant authority, within 72 hours of becoming aware where the law requires it.
9.Changes
If this notice changes materially we will email you before it takes effect. The effective date at the top always reflects the current version.