Privacy Policy
Last updated 25 September 2026
The short version
We collect what an account needs to work: your name, email, optionally a phone number, and what you do on the platform. We don't run analytics, advertising or third-party trackers. We never see your exchange passwords, and we never hold your money. You can close your account yourself at any time.
Who we are
futfin.net is operated by FutFin Valve Technologies, a business name registered in Kenya under number BN-6MCK86M3, whose proprietor is Amos Kiprotich Tendwet. We are the data controller for the information described below.
General Accident House, Ralph Bunche Road, Nairobi. P.O. Box 52824–00100, G.P.O. Nairobi, Kenya. For anything in this policy, including requests about your data, contact us at info@futfin.net.
What we collect
You give us
- Your name and email address, which are required to create an account.
- A country and phone number, if you choose to add them. These are optional.
- A password, which we never store — only a bcrypt hash of it, from which the original cannot be recovered.
- Exchange API credentials, if you connect an exchange account. See “Exchange credentials” below.
We generate as you use FutFin
- Your trading activity on FutFin: the orders you place, the positions they open, and your watchlists.
- Payment records if you buy FutFin Pro: the amount, the crypto asset, the receiving address and the transaction hash.
- Live trading records if you use it: orders placed on your exchange account, and withdrawals you requested.
- An audit log of actions that involve real money, including the IP address and browser user-agent the request came from.
- The IP address you signed up from, and the one you most recently signed in from, with the time. We keep these so we can recognise duplicate or automated signups and investigate a compromised account. They are visible only to FutFin operators.
- Two-factor authentication secrets, if you turn 2FA on. These are encrypted, not stored in readable form.
We do not use analytics, advertising networks, social media pixels or any third-party tracker. There is no cookie banner because there is nothing to consent to beyond the two strictly necessary cookies described below.
Why we collect it
- To run your account. Your email identifies you, verifies you're reachable, and lets you reset a forgotten password.
- To keep the account secure. Password hashes, 2FA secrets and session records exist to stop someone else getting in.
- To do what you asked. Placing an order, connecting an exchange or requesting a withdrawal all require storing what you asked for and what happened.
- To answer “what happened to my money”. The audit log records every action involving real funds, with the IP it came from, so a disputed or unrecognised action can be investigated. This is also why some of it survives account deletion — see below.
- To take payment for FutFin Pro, if you buy it.
Exchange credentials
If you connect an exchange account, you give us an API key and secret issued by that exchange. This is the most sensitive thing we hold, so specifically:
- They are encrypted with AES-256-GCM before being written to disk, using a key held only in the server's environment and separate from the key that signs your session.
- They are decrypted only in memory, only to carry out something you asked for.
- They are never shown back to you, never included in an error message, never written to a log, and never visible to an administrator.
- We never receive your exchange password or your exchange's own 2FA. An API key is not a login.
- You can delete a connection at any time, which removes our copy immediately. You should also revoke the key at the exchange, because deleting our copy does not revoke it there.
We strongly recommend creating keys with the narrowest permissions you need, restricted to our server's IP address, and — if you enable withdrawals — bound to a withdrawal address allowlist you control at the exchange. With an allowlist, even a total compromise of our servers could only move your funds to an address you had already approved.
Where it is stored
FutFin runs on a server located in Lauterbourg, France, operated by Contabo GmbH. Your data is stored in the European Union. If you are outside the EU, this means your information is transferred to and stored there.
How we protect it
- Passwords are hashed with bcrypt at 12 rounds. We cannot read them, and neither can anyone who obtains the database.
- Exchange credentials and 2FA secrets are encrypted with AES-256-GCM using keys that live only in the server environment.
- Email links and 2FA recovery codes are stored as keyed hashes; the originals exist only in your inbox or on your paper copy.
- Sessions are signed, HTTP-only cookies. Changing your password invalidates every other session.
- Traffic is encrypted in transit with TLS.
- Withdrawals require a fresh authenticator code every time, and are capped per 24 hours.
No system is perfectly secure. If we ever discover a breach affecting your personal data, we will tell you and the relevant authority without undue delay.
How long we keep it
- Account data is kept while your account is open.
- Closing your account immediately removes your password, 2FA secrets, sign-in tokens, watchlists and price alerts, and destroys our copy of your exchange API keys. You can no longer sign in, and we can no longer reach your exchange account.
- Your payments, orders, withdrawals and the audit log are kept for seven years from the day the account closes, still linked to your name and email. We are required to be able to say who made a given transaction, so these records cannot be anonymised while that duty lasts. They are visible only to FutFin operators and to an authority entitled to demand them.
- After seven years the account and everything attached to it is deleted outright.
- Email verification and password reset tokens expire within 24 hours and 1 hour respectively.
Your rights
Depending on where you live, you may have rights under the Kenya Data Protection Act 2019, the EU/UK GDPR, or similar laws. In practice you can:
- See and correct your data — your profile is editable in Settings.
- Close your account — Settings → Close account. This is immediate and cannot be undone. It does not erase your transaction history, which we are required to keep for seven years; everything else goes at once.
- Get a copy — Pro accounts can export their order history as CSV; for anything else, email us.
- Object or complain — email us, or complain to your data protection authority (in Kenya, the Office of the Data Protection Commissioner).
Children
FutFin is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, email us and we will delete it.
Changes to this policy
If we change this policy in a way that materially affects you, we will email you before it takes effect. The date at the top always reflects the current version.
Contact
Questions, requests or complaints: info@futfin.net. See also our Terms of Service.