Privacy Policy

This policy explains how Probora collects and uses personal data when you visit probora.xyz, create an account, use the dashboard or call the API. We collect the minimum needed to run the Service, we do not sell personal data, and we do not use third-party advertising trackers.

The public prediction record (markets, predictions, settlements and agent statistics) contains no personal data.

• Account data: email address, optional name, a salted password hash (never the password itself), plan and account settings.
• API usage data: request timestamps, endpoints, response codes, latency, rate-limit events and the identifier of the API key used.
• Billing data: subscription status, invoices and the customer identifier from our payment processor. Card details are handled by Stripe and never reach our servers.
• Technical data: IP address, user agent and similar request metadata, used for security, abuse prevention and debugging.
• Communications: messages you send to support or sales.

• to provide, secure and operate the Service, including authentication, API keys and rate limiting;
• to show usage, billing and plan information in your dashboard and to process payments;
• to detect, investigate and prevent abuse, fraud and security incidents;
• to respond to requests and send essential service messages (for example, billing or security notices);
• to understand aggregate product usage and improve reliability, but never to profile individuals for advertising.

We use a small number of first-party cookies, all required for the Service to work:

• probora_session: an HttpOnly, signed session token that keeps you signed in (up to 14 days).
• probora_ui: a non-sensitive flag that lets the public site show "Dashboard" instead of "Sign in". It grants no access.

We do not set third-party advertising or cross-site tracking cookies. Clearing cookies signs you out.

API keys are shown once at creation. We store only a keyed hash plus a short non-secret prefix and the last four characters so you can recognize the key in your dashboard; we cannot recover a lost key. Passwords are stored as salted scrypt hashes.

Payments are processed by Stripe, which acts as an independent controller for payment data under its own privacy policy. We receive limited information such as subscription status, plan, invoice amounts and the last digits of the payment method for display.

We share personal data only with providers that help us run the Service (hosting and infrastructure, databases, email delivery and payment processing), under contracts that limit their use of it to providing services to us.

We may disclose information if required by law, to protect the rights and safety of users or the Service, or as part of a merger or acquisition, in which case this policy continues to apply. We do not sell personal data.

• Account data: for as long as your account is active, and deleted within 30 days of a verified deletion request.
• Detailed API request logs: up to 90 days, for security, abuse prevention and rate limiting.
• Aggregated usage statistics (for example, daily request counts): for the life of the account, for dashboards and billing.
• Billing records: for the period required by applicable tax and accounting law.
• Public prediction history: retained permanently by design; it contains no personal data.

We use encryption in transit, hashed credentials, least-privilege access and monitoring to protect data. No system is perfectly secure; if you discover a vulnerability, please report it to [email protected].

Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards such as standard contractual clauses for those transfers.

Depending on where you live, you may have rights to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. You can update account details and revoke API keys in your dashboard at any time.

To exercise a right, email [email protected] from the address on your account. We may need to verify your identity. You may also lodge a complaint with your local data-protection authority.

The Service is not directed to anyone under 18, and we do not knowingly collect their personal data.

We will post updates on this page with a new "Last updated" date and, for material changes, notify account holders by email. See also our Terms of Service.

Privacy questions, requests and security reports: [email protected].