Privacy Policy
Version 2 · effective 15 November 2026 · replaces the version of 30 October 2026
In short. We collect only what the service needs, we never sell personal data, and the website uses no advertising, no third-party analytics and no tracking cookies. You accept this policy once, together with the Terms of Service, when you create an account.
1. Who is responsible
The operator of L2WS (“we”) decides how your personal data is used. Contact us about privacy through a support ticket from your account.
2. What we collect and why
| Data | Purpose | Kept |
|---|---|---|
| E-mail address | Sign-in links, receipts, service and security notices, the one release e-mail you may ask for | While the account exists |
| Google account identifier, verified e-mail, time of terms acceptance (only if you use Google sign-in) | Linking Google sign-in to your account; we request only identity and e-mail — never Gmail, contacts or Drive | While the account exists |
| API key hashes (SHA-256); the key itself is shown once | Authentication | Until you revoke the key |
| Usage records: endpoint, size, time, plan | Quotas, billing, abuse prevention, capacity planning | Rolling; aggregated daily |
| Strategies, runs, reports, support tickets | Providing the features you use and support history | While the account exists |
| Payment records: plan, amount, network or processor reference, status | Accounting, fraud prevention, disputes | As long as accounting law requires |
| Product interest flags (“notify me”, early-access list) | Sending the one message you asked for | Until you withdraw or the product launches |
| IP address | Security and abuse prevention only (rate limits on sign-in and checkout) | Transient — rate-limit records expire within one hour |
3. Website statistics and cookies
We count page views with our own code: only the page address and the day, added to an aggregate counter — no cookies, no local storage, no IP address, no fingerprinting, no third-party analytics. The only cookies are functional: dp_s keeps you signed in on l2ws.com and its subdomains for up to 30 days, and Google sign-in uses two short-lived security cookies (10 minutes). All are HttpOnly, Secure and SameSite=Lax.
4. Who processes data for us
- Network and hosting: our own servers; Cloudflare delivers and protects the websites.
- E-mail: our own mail gateway hands messages to e-mail delivery providers, who see the address and the message.
- Payments: our own USDT gateway; for card payments, a third-party processor that collects card details directly — we never see or store card numbers.
- Sign-in: Google, only if you choose Google sign-in; we do not store Google access or refresh tokens.
These providers may process data in other countries. By using the services you agree to such transfers, made with protections appropriate to the provider.
5. What we never do
We do not sell or rent personal data, show advertising, use your strategies to train models or to trade, or share your data with third parties for their marketing.
6. When we may disclose data
We may disclose information when required by law or lawful request, to enforce our Terms, to investigate or prevent fraud, abuse, security incidents or payment disputes, or to protect the rights, property and safety of L2WS, our users or others; and to a successor in a reorganisation or sale, under this policy.
7. Security
Keys are stored only as hashes, sign-in links work once and expire in 15 minutes, client code runs in an isolated process without network access, and incidents that touch user data are published on the status page. No system is perfectly secure; keep your sign-in and keys confidential.
8. Your choices and rights
You can ask for a copy or deletion of your data through a ticket. Deletion removes the account, its keys, strategies, runs, tickets and interest flags; payment records are kept where law requires, and we may keep the minimum needed to enforce our Terms or resolve disputes. Depending on where you live you may have further rights, which we honour as required by law.
9. Children
The services are for adults (18+). We do not knowingly collect data from children; if we learn of it, we delete it.
10. Changes
We may update this policy; the current version and its date are always on this page. Material changes are announced on the website and, for active paid accounts, by e-mail before they apply.