This is unusual for a “privacy policy,” so it’s worth being direct about why: the core engine has no multi-tenant backend. ghostcopy/server.py binds 127.0.0.1 on your own machine — there is no vendor-operated production server that receives, stores, or processes your trading data, wallet addresses, or personal information for the core product. Most of a conventional SaaS privacy policy (data retention schedules, a data-controller relationship, a breach-notification process for a central database) doesn’t apply here because that central database doesn’t exist.

​
What stays on your machine

Everything the core engine reads or computes — signal state, your watchlist, your decisions logged via POST /act, your institutional risk snapshots — is written to state/ on your own disk. Nothing is transmitted to a vendor-operated server, because there isn’t one.

​
What leaves your machine, and to whom

Scienter calls third-party APIs on your behalf, using credentials you supply. Each of these has its own privacy policy that governs data you send it directly: If you never set a key for a given row, that integration is dormant and sends nothing — this is enforced by the same “dormant, with a reason” convention that governs every optional data source in the engine, not a policy promise layered on top.

​
If you operate the Enterprise Wallet API or MCP server for others

If you issue gcx_-prefixed keys or MCP API keys to other people, you become the party responsible for those users’ data under whatever regulatory framework applies to you (GDPR, CCPA, or otherwise) — Scienter’s code stores keys as salted SHA-256 hashes and usage counts only, but the compliance obligation of operating that access for third parties is yours, not something this software discharges automatically.

​
GDPR / CCPA, briefly

Because there is no central vendor-operated data controller for the core product, most GDPR/CCPA obligations (data subject access requests to a central store, a designated data protection contact for that store, etc.) have no counterparty to direct them to — you are the controller of your own local state/ directory. If you deploy Scienter as a service for other people (the Enterprise API, a hosted MCP server, a shared tunnel), you take on that controller role for their data, and should implement the access/deletion/portability mechanisms your jurisdiction requires independently of this software.
Scienter publishes impersonal market signals of general and regular circulation. Nothing here is investment, legal, or tax advice, or a recommendation to buy, sell, or hold any asset. Scienter is not a registered investment adviser or broker-dealer. Trading digital assets can result in the total loss of your funds — see Disclaimers for the full text.