Privacy policy

Last updated 2026-11-05. We keep as little as we need to read your MT5 account for you. This page says what that is.

Who we are

Candor FX is run by William Tallis Falch, Borggata 4, 0650 Oslo, Norway. Write to us at support@the.tf.

What we keep, and why

• Your email. You sign in with a code we send to it. Our sign-in service holds your email and your session. Our own records name you by an internal user id.
• Your MT5 broker, server and account number. We show them back to you on your account page, and use them to open your account. When your assistant lists your accounts it sees the full number.
• Your MT5 password. We encrypt it with a separate key service before it is saved. We open it only to sign in to your MT5 account when you ask your assistant a question. We never show it back, and it is never written to our records.
• Which kind of password it was (investor or master), once a sign-in has shown it, so we can tell you about it.
• A record of each request your assistant makes. Each row holds your user id, the tool name, the values you sent (account id, symbol, timeframe, count, days, date range, side, volume and prices), the outcome, how long it took, which assistant app made it, and the time. When your assistant asks for a link to add an account, the row holds only which fields it gave, never their values. It never holds your password or what your account answered.
• Short-lived working data. Rate counters last about a minute. Counts of refused MT5 sign-ins last an hour. Timing events about terminals last 7 days.
• Usage counts. Each page we serve sends the page address, the page you came from and whether you are signed in to analytics.the.tf, our usage collector, which processes it for us. It sends no cookie and no visitor id. Your account page also sends your sign-in id (never your email), which the collector keeps only as a scrambled code, so you count as one person on your phone and your laptop. Our servers send counts too: which tool was called, how it ended, how long it took, and that an account was saved or removed or a first call was made. These counts hold no user id, email, MT5 details or password.

What we do not do

• We do not place, change or cancel trades. We only read.
• We do not store your balance, positions, prices or history. We pass them to your assistant when you ask.
• We do not sell your data.

Who sees what

The assistant you connect (for example Claude or ChatGPT) receives the answers to your questions, under its own privacy policy. Our hosting and key-service providers process the data above for us and only for this service. They are Cloudflare, which runs the service, the MT5 terminals and the connection to our database, and the Postgres database that holds the audit record. All of them store and process your data in the European Union.

How long we keep it

• Your MT5 accounts: until you remove them. Removing an account deletes its encrypted password at once and ends any session we opened with it.
• Request records: kept as a tamper-evident log. When you press Delete my data, we erase your name and every value in them. The internal user id stays as a bare id, because the seals on the log depend on it.
• Working data: as listed above.

Your choices

You can remove any MT5 account on your account page. To have everything about you erased, sign in and press Delete my data on your account page. We remove every MT5 account you saved, erase the parts of our request records that identify you, and sign you out. It takes a few seconds. If something goes wrong halfway, press it again and we finish the job. To see what we hold about you, or with any question, write to support@the.tf. Depending on where you live, you may have more rights under local law; we honour them. You can also complain to your data protection authority.