Viktury is a journal, not a trading bot. It only ever needs to read your trade history, so the way it is built reflects that.
Read-only keys, always
When you connect an exchange, Viktury only ever asks for read permission. It never requests permission to place trades and never requests permission to withdraw. When you create the API key on your exchange, you enable view or read access and leave trading and withdrawals switched off. Even if a key were somehow exposed, a read-only key cannot move your funds. This is the single most important habit when connecting any account, so every connect guide repeats it.
How your keys and data are stored
Your API keys and your trade data are stored encrypted, both at rest and in transit. Exchange keys get an extra layer of encryption on top of that, and they are never kept in plaintext. You can disconnect an account at any time, which removes its stored key.
Deleting your account
You can delete your account from your settings. Deletion is not instant: the account is scheduled for deletion and keeps working for 30 days, so you can cancel if you change your mind or the request was not yours. Nothing is removed during that window. After 30 days the account is deleted, and a copy with the details that identify you stripped out is kept in a separate archive, as the privacy policy explains.
Who processes your data
Viktury runs on cloud infrastructure (Amazon Web Services) for hosting, storage, and email. Payments are handled by Stripe, so card details go to Stripe rather than to us. Error monitoring (Sentry) helps us catch and fix problems. The privacy page in your Viktury dashboard lists these processors in full and is the authoritative version. If you have a specific data question, the contact form reaches us directly.