Uurly — Privacy Policy
Effective date: 6 October 2026
1. Controller
The controller of your personal data is Uurly, a business registered in Belgium. Our full company details are published on uurly.io. For privacy questions, contact us via the contact details on uurly.io.
Uurly is software that runs on your own computer. It is not a broker, exchange, asset manager, custodian or investment adviser. This shapes how little data we need.
2. What stays on your computer
Uurly is designed so that your sensitive data stays on your own device:
- Your wallet private keys, seed phrases and API keys are stored encrypted on your computer and are never sent to us.
- Your trade history, open positions, logs and settings are stored only on your device.
- Exported settings files never contain keys.
We have no access to this local data, unless you choose to share it with us, for example when asking for support.
3. What we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address, licence key, subscription status, country of residence | Creating and managing your licence and subscription; applying country-specific feature availability; sending service and billing messages and the sign-in and registration codes you request | Performance of contract (art. 6(1)(b)); legal obligation (art. 6(1)(c)) |
| Payment and invoicing data (name, billing country, transaction ID, amount, VAT data). Card, bank or PayPal account details are handled by Stripe or PayPal and never reach us | Billing, VAT and accounting | Performance of contract; legal obligation |
| Licence and device check: licence key, a device identifier generated by the app, app version, IP address, timestamps | Verifying your licence and the one-device limit, delivering the token feed, preventing abuse | Performance of contract; legitimate interest in security and fraud prevention (art. 6(1)(f)) |
| Sign-in: your email address, one-time sign-in codes (stored only in hashed form, valid for 10 minutes), a session cookie, and the IP address and browser of each sign-in | Signing you in to your account and dashboard; preventing misuse | Performance of contract; legitimate interest in security (art. 6(1)(f)) |
| Free trial: your email address, country of residence, the time you accepted the Terms, and the device identifier of the computer that uses the trial | Issuing the free trial and limiting it to one per person and one per device | Performance of contract; legitimate interest in preventing abuse |
| Bot check on our sign-in and registration forms: IP address and browser and device characteristics | Protecting these forms against automated abuse | Legitimate interest in security |
| Live dashboard data (see section 4) | Showing your activity on your personal dashboard and relaying commands you give there | Performance of contract |
| Website and server logs: IP address, browser type, requested pages, errors | Security, troubleshooting, keeping the Service running | Legitimate interest |
| Discord link (optional): your Discord user ID and username, and the role we give you on the Uurly Discord server | Adding you to the Uurly Discord server when you connect it on your account page, and keeping your role (Pro or Trial) in line with your licence | Performance of contract, at your request; you can disconnect at any time on your account page |
| Messages you send us (email, Discord) | Answering your questions | Performance of contract or legitimate interest |
We do not sell your data, do not use it for advertising or profiling, and do not make automated decisions about you with legal or similarly significant effects.
4. Your personal dashboard
While the Uurly app is running on your computer, it sends your trades, positions, wallet balances, public wallet addresses, bot status and the name of your computer (so you can tell your devices apart) to our server, only to display them on your personal dashboard on uurly.io and to relay commands you give there (such as start, pause or switching to dry-run).
This data is held only temporarily to relay it and is not stored permanently. When your app is offline, your dashboard shows no trading data.
Blockchain addresses and transactions are public by nature. When linked to your account, we treat them as personal data.
5. Service providers
We use the following service providers, which process data on our behalf or as independent controllers:
- Hosting: Servers Guru, with servers located in the Netherlands — servers for uurly.io, the dashboard and the licence service;
- Email delivery: Brevo (Sendinblue SAS, France), which sends the sign-in and registration codes and receives your email address and the content of those emails. Brevo records whether an email was delivered and opened, for delivery statistics;
- Bot protection: Cloudflare, Inc. (Cloudflare Turnstile), which checks that our sign-in and registration forms are used by a person and receives your IP address and browser characteristics when you use them. Cloudflare may process this data outside the European Economic Area (see section 6);
- Payments: Stripe and PayPal, which process your payment details as independent controllers under their own privacy policies;
- Discord: if you join our server or connect your Discord account, Discord's own privacy policy applies. When you connect, Discord tells us your user ID and username; the access Discord gives us for that is used once to add you to the server and is then revoked, never stored.
The Uurly app also connects directly from your computer to third-party blockchain and market services, such as blockchain RPC providers, DEX aggregators and market data providers. These services receive your IP address and the requests your app makes. Their own privacy policies apply; we do not receive this data.
6. International transfers
Where a provider processes data outside the European Economic Area, we rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.
7. Retention
- Account and subscription data: as long as your account is active, and up to 12 months afterwards.
- Live dashboard data: not stored; only held temporarily while being relayed.
- Sign-in codes: deleted within a day after they expire.
- Sign-in sessions: 14 days, or until you sign out.
- Discord link: until you disconnect it or your account is deleted.
- Email log (time and type of each email we send, without its content): 7 days.
- Invoices and accounting records: for the period required by Belgian accounting and tax law (currently up to 10 years).
- Server and security logs: up to 90 days.
8. Cookies
uurly.io only uses cookies that are strictly necessary to log you in to your dashboard and to keep the site secure. These cookies do not require consent. We do not use analytics, advertising or tracking cookies. Our sign-in and registration forms are protected by Cloudflare Turnstile, which is used only to tell people from automated traffic, not for analytics or advertising.
9. Your rights
Under the GDPR, you have the right to access, rectify and erase your personal data, to restrict or object to its processing, and to data portability. To exercise your rights, contact us via the contact details on uurly.io. We respond within one month.
You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be, or with the data protection authority in your own country.
10. Security
Your keys never leave your device. Communication between the app and our servers is encrypted (HTTPS/TLS). Access to our servers is restricted. No system is fully secure, so please protect your computer and your licence key.
11. Age
The Service is not intended for anyone under 18. We do not knowingly process data of minors.
12. Changes
We may update this policy. We will announce material changes by email or in the app before they take effect.