Privacy Notice

Information OSCR handles

OSCR processes account names, usernames, email addresses, password hashes, invitations, sessions, access audit records, bot drafts and connection metadata. Passwords are salted and hashed; the original password is not stored in readable form.

If you connect Alpaca, OSCR handles the Paper account information and Paper API credentials or OAuth tokens needed to verify that connection. Broker credentials and tokens are stored server-side in service-account-controlled files and are excluded from public account replies.

Why this information is used

Records support access approval, login, account recovery, connection verification, account isolation, user-owned configuration and pilot operations. The pilot operator and authorized administrative/service processes may access records for those purposes.

External services

Alpaca handles account authorization and market/broker data. The configured mail provider delivers invitation and recovery messages. ZeroTier provides private-network connectivity. Optional notifications use their configured delivery providers. The public OSCR site is served on oscr.donco.io, with Cloudflare providing public web connectivity. Its access-request form collects your name, email address and consent to receive request and setup emails. Broker credentials are entered only in the private OSCR workspace; this public site has no broker connection form, advertising analytics or custom tracking scripts.

Retention and requests

The private pilot does not currently have an automated deletion schedule. Account and audit records may remain until the operator processes a removal request. Contact [email protected] to request access, correction, removal, or an explanation of retained records. Any records retained for operational integrity or applicable obligations will be explained when the request is reviewed.

Disconnecting Alpaca

Disconnecting in OSCR removes the local connection record. Separately review Alpaca’s connected-app permissions to revoke provider-side authorization. These actions are distinct and do not automatically close an existing position.

Contact

Privacy and pilot questions: [email protected]. This notice describes the current private pilot; it does not claim a completed regulatory or security certification.