Draft document notice These documents were drafted in house and have NOT been reviewed by a lawyer. They are published so they can be read and corrected, not because they are final.
Privacy Policy
Effective September 18, 2026 ยท Version 2026-09-18
DRAFT PENDING LEGAL REVIEW. This document was written in-house and has not been reviewed by counsel. It is published because it is far more accurate than the version it replaces, not because it is finished.
This version replaces the Privacy Policy effective August 5, 2026 ("v4.2"), archived at /legal/v4.2/privacy, and the July 21, 2026 version before it, archived at /legal/v4/privacy. See /legal/v5/changelog for a plain-English summary of what changed and why.
1. Who we are, and what this covers
This Privacy Policy explains what data Coherent ("Coherent," "we," "us") collects, how we use it, who else sees it, and what rights you have. Coherent is operated by Malloy Labs LLC, Milwaukee, Wisconsin, USA. Malloy Labs LLC decides why and how your personal data is processed, which makes it the controller of that data, and for users in the European Union, the European Economic Area, and the United Kingdom, Malloy Labs LLC is the data controller for the purposes of the GDPR and the UK GDPR.
Privacy contact. Write to noah@coherent.fyi, with "Privacy" in the subject line, or to Malloy Labs LLC, 2466 N Oakland Avenue, Milwaukee, Wisconsin 53211, USA. There is no separately appointed data protection officer; that address reaches the people who actually run the service. Section 8 explains how to exercise a right, how to appeal if we refuse, and how to complain to a regulator. Section 16 explains the status of the EU and UK representative question.
Coherent is for adults. You must be at least 18 years old to hold an account, and we do not knowingly collect personal data from anyone under 18.
Coherent is a private product. There is no public feed, no public profile, and no place on Coherent where another user can see what you wrote or what you traded.
Our separate Consumer Health Data Privacy Policy, linked from the homepage footer at /health-privacy, describes the self-reported wellness check-in in the terms Washington's My Health My Data Act and similar state laws require. It covers the same data that Sections 2.6 and 14 of this document describe, and the two documents describe the same handling. Heart-rate and other health data from a connected Apple Watch or similar wearable is not collected today, and both documents will be updated, with their own consent, before it is.
How we keep this policy accurate. Internally, every single column of data we store is classified into exactly one category: user-authored, brokerage-derived, account-identity, device-technical, operational, health, or aggregate-deidentified. Each classification records what the column is for, which section of this policy discloses it, and which deletion actions remove it. A test runs against our live database schema and fails the build if any column is missing or misclassified, so a new table or field cannot ship without being described here first. Section 2 groups those internal categories into the plain-English buckets you will actually read. This section exists so this policy cannot quietly drift away from what our systems really do.
2. What we collect, by where it comes from
2.1 What you give us (account-identity and user-authored data)
Account. Your email address, a hashed password (we never store your password in readable form), and, if you set one, a display name. Whether your email address has been confirmed, and when.
Your rules and plans. The rules you write, in your own units: how many losing trades end your day, what size you allow after a loss, the hour after which you stop, which venues you use, and the sentence you wrote about the rule you break most often. A rule is a statement about your own intended behaviour. It contains counts, hours, and words, and no amount of money unless you type one.
Your journal and notes. Journal entries, pre-session plans, annotations, labels, corrections you make to an automatically detected event, and any short note you attach to one. Free-text fields store exactly what you type, so if you choose to write your own dollar figures in your own journal, we store what you wrote. That is your own authored content. The restrictions in Section 2.2 are about data we derive from a venue, and they cannot and do not apply to your own words.
Your settings. The warning voice you choose, the personal line you wrote to be shown back to you at the moment a rule breaks, notification preferences, and the label you give a connection or a device.
Your email address before you have an account. The free plan builder and the early-access list on the public site accept an email address with no account and no password. We use it to send you the plan you just built, or to contact you once about early access, and to link the plan to an account if you later create one.
2.2 What we derive from a connected exchange or wallet (brokerage-derived data)
This is the part of the policy people care about most, so it is stated bluntly.
Normalize and drop, stated precisely. Raw execution values, including price, quantity, position size, account balance and dollar amount, may be processed transiently in memory solely to derive the limited trade characteristics used by the Service. Coherent does not persist those raw values. After processing, Coherent retains only the information described in this Policy, such as ticker symbol, trade direction, timestamps, win/loss classification, return band and coarse size band.
We never store a raw price, quantity, notional value, or balance. Not for a moment longer than a computation, not in a log, not in an export, not in a backup, and not in any column of any table. This is a structural rule in our schema, not a preference: no column exists that could hold one.
What we do keep from your trading activity, for each execution:
- the ticker symbol traded, for example BTC-USD;
- the side, buy or sell;
- timestamps: when the venue says it happened, when we processed it, and when our rule check ran;
- whether the trade was a win or a loss, as a true or false flag, never a dollar amount and never a percentage;
- a return bucket, which places the result in one of five bands rather than recording the number;
- a size band, which says whether the trade was typical, moderately larger, much larger, or smaller than your own recent pattern, computed in memory from a quantity we then discard;
- how long the position was held, and how long it had been since your previous exit;
- whether the trade followed a loss inside a short window;
- which symbols currently have an open position, never the size of one;
- an opaque venue account identifier and a deduplication key, so the same fill is not counted twice.
How the raw numbers are handled. When we poll a venue, the raw fills exist only in the memory of the worker doing the computation, for as long as it takes to derive the values in the list above. Then they are gone. They are never written to the database, never included in application logs or error reports, and never shown to Coherent staff.
Your exchange API credentials, treated as their own category. If you connect an exchange with an API key, that key is the one credential Coherent stores, and it is handled differently from everything else in this Policy. What follows is a description of the code that handles it, not an aspiration:
- Read-only only. Coherent accepts only credentials that provide read-only access.
- Checked before it is stored, not after. The permission check runs first. A credential is written to the database only after that check has passed and an account listing has confirmed the key belongs to an account you can see.
- A credential with trading or withdrawal authority is rejected and not retained. It is refused and never stored: refused at the moment you submit it, never encrypted for later, never retried, and no part of it is written anywhere. All that is recorded is that a key was rejected for not being read-only.
- Verified by the venue, not by you. The permission check asks the venue's own API what the key is permitted to do. We record that the venue confirmed the key was read-only, and when. We do not accept your say-so in place of that check.
- Encrypted at rest. The stored credential is encrypted with Fernet symmetric encryption, using a key held outside the database.
- Never displayed, never exported, never logged. It is on the denylist for data export, it is on the scrub list for logs, and no endpoint in the product returns it.
- Access is limited. Only the specific server-side process that polls your venue decrypts it, and only in order to make that read call.
- Deleted when you disconnect, and when you delete your account. Disconnecting an exchange deletes the connection row and the credential with it. Deleting your account deletes them too.
We also keep a short non-secret fingerprint of the key identifier, so the same key is not added twice, and the connection's status.
Your wallet addresses. For on-chain venues you give us a public wallet address. A public address is not a secret and not a credential: it authorises nothing, it can already be read by anyone, and giving it to us adds no capability that the public chain did not already provide. We read that address's public activity to derive exactly the same list of values described above. We never ask for and cannot accept a seed phrase, a private key, or a signing key.
A wallet address is still personal data once we hold it. Public does not mean outside privacy law. Once an address is linked to your Coherent account, the address, the link between it and you, and everything we derive from its activity are all information relating to an identified person. We treat them as personal data under the GDPR, the UK GDPR, and US state privacy law, with the same lawful basis, the same retention, the same deletion actions, and the same rights as everything else described here. We do not publish the link between you and an address, we do not sell it, and we do not use it to build a profile of you for anyone but you.
Connection health. When we last polled, whether it succeeded, how many events came back, and if something failed, the class name of the error and nothing else. Never a venue's response body, never a provider error message, never a payload. We also record structured gaps: periods when we could not reliably see your activity during an active session, as a reason code and a duration, so the product can tell you honestly that it was not watching.
2.3 Device and technical data (device-technical data)
Log data, IP address, device and browser type, and your activity inside the service, used to run it, secure it, and fix it. Privacy-focused analytics from Vercel run only after you consent to non-essential cookies, and not before. Cookies are covered in Section 13.
If you turn on web push notifications, we store the push subscription endpoint your browser issues, the two browser-issued keys that go with it, an optional label you give the device, when a delivery last succeeded, and how many deliveries have failed in a row. The endpoint and keys are excluded from your data export and are never logged. Turning push off, or five consecutive failures, revokes the subscription.
2.4 Aggregate and de-identified data (aggregate-deidentified data)
Some counters have no user identifier attached at all, for example how many people clicked a particular button on the public site. Those are anonymous by construction rather than anonymised afterwards. We may also compute aggregate statistics across many accounts together, as described in the Terms. Neither kind can be traced back to you.
2.5 Records about your use of the service (operational data)
Separately from what you write and what we derive from a venue, we keep records that exist to run and secure the product: notification records, an internal audit log of sensitive actions, session and token records for login, password reset, and email confirmation, all stored as hashes or opaque identifiers and never as readable credentials, your legal acceptance and consent records (which document and which version you agreed to, when, and how), billing references from Stripe, and first-party funnel events that record only an allowlisted event name and a time, never a billing email, a card detail, a Stripe payload, a trade, or any free text.
Features from an earlier version of Coherent, and what is left of them. Some tables in our database belong to features that have been switched off. They fall into two groups, and we will not blur them together, because the difference matters to you.
Most of those tables are empty. The feature never collected anything about you, there is no row about you in them, and an empty table is not personal data. Saying "we hold nothing there" is simply true.
A few of those tables once held rows created while the feature was live, for example records from the retired public-profile and identity-verification features. Those tables were dropped on September 16, 2026. The records no longer exist in our production database, and they are not waiting for an account deletion to remove them; any copy in a backup snapshot ages out as Section 7 describes. No switched-off feature collects anything new, and none of them is being quietly restarted.
2.6 Self-reported wellness check-ins (health data)
If you turn on the optional pre-session check-in, which is off by default and has its own separate, explicit, withdrawable consent, you self-report a small set of categories: sleep quality, stress level, energy level, whether you drank alcohol in the last 24 hours, hydration, caffeine, whether you are dealing with illness or pain, and how long it has been since you last ate.
Every one of these is a category you pick, such as poor, fair, or good, never a number, a measurement, or a diagnosis. Under the GDPR this is health data, and we process it only on the basis of your explicit consent, which you can withdraw at any time in Settings, independently of your acceptance of the Terms or your acknowledgment of this Policy. Under several US state laws it is consumer health data, and Section 14 sets out how we handle it, including the exact consent you are asked to give.
Withdrawing consent erases your stored check-ins and the readiness inference derived from them, and stops future collection. The only things that outlive a withdrawal are records a legal obligation requires us to keep, such as the record that you gave the consent and when you withdrew it. A separate "Delete my readiness data" action, in the same Settings panel, erases the same data without withdrawing the consent.
Our systems also record, as its own event, that you engaged with this feature at a given time. Because that record on its own establishes that an identified person used a health feature, we treat it as health data too. It is deleted with your account, and otherwise expires no later than 90 days after the event. We allowlist exactly which event names it can contain so that no wellness value, trade, rule, or free text can ever ride along inside one.
Today every field in this section is self-reported by you. Our schema reserves a field that would distinguish manual entry from a future wearable source, but no wearable, heart-rate, or HRV collection is live. If that changes it will be its own policy amendment with its own consent, not something folded in quietly.
The never-stored list. Whatever the source, Coherent never stores: a raw price; a quantity or contract size; a notional value; an account balance; a profit or loss figure in money; a raw venue API response; a card number; a seed phrase or private key; or an exchange API key that is not read-only. The one caveat is your own free text, which is stored exactly as you typed it, including any figures you choose to write there yourself.
2.7 The Coherent browser extension
The browser extension is optional. It does nothing until you install it and sign in, and what it is able to reach at all is fixed by its published manifest, which anyone can read in the extension's own files.
What it is allowed to do:
- It requests two browser permissions and no others: "storage," so it can keep your settings and the warnings it has already been given on your own device, and "alarms," so it can schedule its own periodic check.
- It is allowed to contact exactly one host, Coherent's own API. It sends data to no other server.
- It runs its display script only on the pages of the venues it supports: Hyperliquid, pump.fun, Coinbase Advanced Trade, and Kraken. It runs nowhere else on the web.
What it does not do. It does not read the venue page's contents. It does not collect or transmit prices, order forms, balances, positions, account numbers, or anything else shown on the venue's own page. It has no permission to read your browsing history, your tabs, your bookmarks, or your cookies, and no permission for any site other than the ones listed above, because the manifest grants none. It does not click, fill, submit, or disable anything on the page. The only thing it inspects about the page at all is whether its own warning chip is about to sit on top of one of the venue's own controls, so that it can move itself out of the way; that check looks at position, it reads no content, and nothing from it is sent to us.
What it draws on the page comes from your own Coherent account, not from the venue. What it stores on your device is your own settings, including which corner the chip sits in, and the warnings it has already received. On our side, the extension talks to the same API your browser does, and collects nothing beyond the account activity already described in this Policy.
3. How we use your data, and our lawful bases
We use personal data to: run and secure the service; connect the exchanges and wallets you ask us to connect; watch your own activity and warn you when one of your own rules is about to break; deliver those warnings in the app, by email, and by web push; keep your journal, plans, rules, and self-analytics; take payment and manage your subscription; send you transactional messages; prevent fraud and abuse; measure in aggregate whether the product actually helps; meet legal obligations; and improve the service. We do not use your data to give investment advice, we do not sell it, and we do not use it for advertising of any kind.
For users in the EU, EEA, and UK, the table below maps each purpose to its legal basis under GDPR Article 6, and for Section 2.6 under Article 9. We do not ask for consent where contract or legitimate interest already supports the processing; consent is reserved for the processing that genuinely needs it. Where the table says "explicit consent", it means the separate Article 9 consent for wellness data; the other consents are ordinary Article 6 consents. Counsel is confirming whether connecting an exchange or wallet, and the automatic detection that follows from it, rests on contract or on consent; until then we collect consent.
Purpose | Legal basis
-----------------------------------------------------------|---------------------------------------------------
Running your account and the core service | Performance of a contract
Storing your rules, plans, journal, and self-analytics | Performance of a contract
Connecting an exchange with a read-only key, or a wallet | Consent (separate, withdrawable; contract basis being confirmed)
Automatic detection of rule breaks from your activity | Consent (separate, withdrawable; contract basis being confirmed)
Delivering warnings by email and in the app | Performance of a contract
Delivering warnings by web push | Consent (browser permission, revocable)
Self-reported wellness check-ins (Sections 2.6 and 14) | Explicit consent (GDPR Article 9)
Billing, trial, and subscription management (Stripe) | Performance of a contract
Account security, fraud and abuse prevention | Legitimate interests
Aggregate measurement of whether the product helps | Legitimate interests
Service improvement and debugging | Legitimate interests
Non-essential analytics | Consent (cookie choice, Section 13)
Legal compliance, recordkeeping, defending a claim | Legal obligation and legitimate interests
Where we rely on consent you may withdraw it at any time, without affecting the lawfulness of processing that already happened.
Service messages and marketing are different things, and we keep them apart. A warning that one of your own rules is about to break, a confirmation or password-reset email, a receipt, a notice that a connection stopped working, a security alert, and a notice about a change to these documents are service messages. They are part of what you signed up for, we send them on the basis of our contract with you rather than on consent, and the ones the service cannot run or comply with the law without cannot be switched off, although you always control how warnings reach you: in the app, by email, by web push, or some combination. Marketing messages are anything that promotes the product to you rather than operating it for you. We send one only where you asked for it or where the law otherwise allows it, every one carries a one-click unsubscribe, unsubscribing from marketing never stops your service messages, and we never treat your presence on a warning list as permission to market to you.
4. Who else sees your data
We do not sell your personal data and we do not use it for third-party advertising. We share it only with providers that process it for us, under contracts limiting them to that purpose. Not every third party in the product is a processor: some receive nothing personal, and the venues you connect are your own counterparties rather than ours.
Recipient | What they receive | Role
-------------------------------------|------------------------------------------------------------------------|---------------------------
Stripe | Customer and subscription references, billing email, payment details you enter with them | Processor
Railway | The application database, as host | Processor
Vercel | Front-end delivery, and aggregate analytics only after you consent | Processor
Resend | The content and recipient address of transactional and warning emails | Processor
Apple, Google, Mozilla | The push endpoint and encrypted payload needed to deliver a push | Processor
SnapTrade | Where you connect a broker through it: your connection and read-only account data | Processor
Coinbase, Kraken, and similar venues | The read-only API key you created there, used to read your own activity | Your own venue, not our processor
Public chain data providers | A public wallet address, already public on-chain | Not a processor
Amazon Web Services | Inactive: file storage kept for a retired feature, receiving nothing today | Processor (inactive)
Uptime-monitoring service | A bare up or down status, with no user data of any kind | Not a processor
Roles in this table reflect our vendor contracts as we understand them and are being confirmed vendor by vendor.
We may also disclose data to comply with the law, legal process, or an enforceable government request, to enforce our Terms, or to protect the rights, safety, and property of Coherent, our users, or the public. If Coherent is part of a merger, acquisition, or sale of assets, personal data may transfer as part of that transaction, subject to this Policy.
5. Our data-handling commitments
Raw venue data is processed only in memory, only for as long as the derived values take to compute, and is then discarded. It is excluded from application logs and error reports. Your exchange API key is encrypted at rest, excluded from export, and never logged or displayed. A key that is not read-only is refused before storage. We never hold a seed phrase or a private key, and there is nowhere in the product to submit one. Aside from the encrypted read-only credential you chose to give us, we have no ongoing access to any account of yours.
6. International data transfers
We are based in the United States and run on US-based infrastructure. If you use Coherent from the EU, EEA, UK, or anywhere else, your personal data is transferred to and processed in the United States. Where the GDPR or the UK GDPR applies, we transfer personal data only under a mechanism that Chapter V of those laws permits. For each processor in Section 4 that is one of the following: the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where UK data is involved, supported by a transfer risk assessment; or, where the processor is certified under the EU-US Data Privacy Framework, its UK Extension, or the Swiss-US Data Privacy Framework and we have verified that certification directly with the provider, that certification. We do not claim a specific provider's certification here without having verified it with that provider. You may ask us at noah@coherent.fyi which mechanism covers a given processor and for a copy of the relevant clauses, with commercial terms removed.
7. How long we keep things, and how to remove them
How long we retain personal data varies by category and purpose, as described below. Most of it is kept until you remove it. Several separate actions exist, and each does exactly what its name says and nothing more:
Delete your account. Removes everything tied to it: your rules, plans, journal entries, notes and corrections, settings, derived trading records, connection records and the stored credential, wellness check-ins, health-feature engagement events, notification records, and consent records. Two things can survive by design and are described where they arise: our internal audit log keeps an entry with the reference to you removed, and one founding-member marker survives if you choose to keep it (Section 9). The aggregate figures in Section 2.4 were never tied to you in the first place, so there is nothing of yours left in them to remove.
Disconnect an exchange. Removes that one connection and its stored credential. History already derived from it survives, with its link to the now-deleted connection cleared.
Delete synced data. Removes only what a connection derived from your venue, and disconnects it. It never touches what you wrote yourself.
Delete imported monitoring history. Removes the derived execution records, position markers, and monitoring-gap records produced by automatic detection, leaving your own writing alone.
Delete my readiness data. Removes your wellness check-ins, the readiness inference derived from them, and the health-classified engagement events that go with them, and nothing else.
Withdraw the wellness consent. Erases the same data as "Delete my readiness data" and also stops future check-ins. Only records a legal obligation requires us to keep, such as the record of the consent itself, outlive it.
Pause. The lightest action. It stops future collection and deletes nothing at all, so turning the feature back on does not require reconnecting. Use one of the delete actions above if you want data actually removed.
Retention, object by object, taken from our internal classification registry:
What it is | How long we keep it
------------------------------------------------------------------|---------------------------------------------
Account record: email, password hash, display name, settings | Until you delete your account
Journal entries, notes, annotations, labels | Until you delete the entry, or delete your account
Rules you wrote, and the record of changes to them | Until you delete your account
Plans built in the free plan builder, once attached to an account | Until you delete your account
Derived trade records, position markers, monitoring-gap records | Until account deletion, or "Delete imported monitoring history," or "Delete synced data"
Wallet addresses you linked, and activity derived from them | Until you remove the wallet, or delete your account
Exchange API credential, encrypted | Until you disconnect that exchange, or delete your account; deleted together with the connection row
Self-reported wellness check-ins, and the readiness inference | Until account deletion, "Delete my readiness data", or withdrawal of the wellness consent
The wellness consent record: that you consented, to what, and when | Until account deletion; kept while the consent is live and afterwards as the record of what you agreed to and when you withdrew
Engagement events about a health feature | Deleted with your account, and otherwise no later than 90 days from the event
Billing metadata: Stripe customer and subscription references, subscription status, never card data | Until account deletion, subject to the legal exception below
Legal acceptance records: which document, which version, when, how | Until you delete your account; counsel is settling a limited post-deletion retention period for evidence of acceptance, and this row will say so before any such period applies
Support correspondence you send us by email | Until you ask us to delete it, or until account deletion, subject to the legal exception below
Application, security, and audit logs | Kept with the reference to you removed after deletion
Backups | Encrypted; kept no longer than 14 days on our side, as described immediately below
Founding-member marker, a one-way hash of your email address | Your choice at account deletion: keep it, or erase it (Section 9)
Limited records may be kept longer where the law requires it, for example payment and tax records under financial recordkeeping rules, or for security and audit purposes.
Deletion, and what honestly happens in backups. When you use one of the actions above, the records it covers are deleted from our production database straight away, and the product stops showing them to you immediately. We also take encrypted backups of that database on a schedule, and keep them for no longer than 14 days on our side so the service can be restored after a failure. A record you deleted can therefore still exist inside a backup snapshot that was taken before you deleted it, until that snapshot ages out of the rotation, which is within 14 days. Those backups are not used to serve the product and are not searched for ordinary purposes. If one is ever restored, we re-apply outstanding deletion requests to the restored data. For consumer health data covered by Washington's My Health My Data Act, deletion is completed in backups no later than six months after we authenticate your request, and in practice within the 14-day schedule above. We say this plainly rather than promising that deletion is instant everywhere, because that would not be true of any service that keeps backups, including this one.
8. Your rights
Everyone can see and update their account details in the product, export a machine-readable copy of their data from Settings, and write to noah@coherent.fyi to ask for access, correction, or deletion, including deletion of the whole account. We confirm who you are before acting on a request, acknowledge it promptly, and answer within the period applicable law requires; for GDPR and UK GDPR requests ordinarily one month, extendable by two further months where the law allows and we tell you why; several US state laws use 45 days.
How to make a request. The export and deletion controls in Settings act immediately and need no request at all. For anything else, write to noah@coherent.fyi from the email address on the account, or to Malloy Labs LLC, 2466 N Oakland Avenue, Milwaukee, Wisconsin 53211, USA, and tell us what you want. You may use an authorised agent where the law allows one, and we will ask that agent for proof of authority and may ask you to confirm it directly. We do not charge for a request, unless the law allows a fee for one that is repetitive or manifestly unfounded, and we will tell you before charging anything.
If we refuse, you can appeal. Where a US state privacy law gives you the right to appeal a refusal, which several do, including Virginia, Colorado, Connecticut, Montana, Oregon, and Texas, you may appeal by replying to our decision or by writing to noah@coherent.fyi with "Privacy appeal" in the subject line. We will review the appeal, and within 60 days we will tell you in writing what we decided and the reasons for it. If we still refuse, we will give you a way to contact your state attorney general to raise a complaint.
Complaints to a regulator. EU, EEA, and UK users may complain to their local supervisory authority, and UK users may complain to the Information Commissioner's Office. Raising it with us first is welcome, but it is never a condition of complaining.
EU, EEA, and UK users (GDPR) have the right to access your personal data; to have inaccurate data corrected; to erasure; to restrict or object to processing; to data portability; to withdraw consent at any time where processing rests on consent, which the table in Section 3 identifies; and to complain to your local supervisory authority. Coherent does not make a solely automated decision that produces a legal effect or a similarly significant effect on you, and Section 17 describes the automated processing we do carry out.
US state residents, including in California, have rights to know, access, delete, correct, and port personal data, and to opt out of sale, targeted advertising, and certain profiling. We do not sell personal data, we do not process it for targeted advertising, and we do not profile anyone in furtherance of a decision that produces legal or similarly significant effects, so there is nothing to opt out of; the rights remain yours regardless. Because some of your data is sensitive, including financial and health data, we process it only with your opt-in consent where the law requires that. We honour recognised universal opt-out signals, including Global Privacy Control. California residents: we treat financial and health data as sensitive personal information, we do not sell or share it for cross-context behavioural advertising, and you may direct us to limit its use to providing the service you asked for. We do not discriminate against anyone for exercising a right.
9. Account deletion and the founding-member marker
When you delete your account we remove everything listed in Section 7, leaving a closed account.
One marker is your choice. If this account held founding-member status, the deletion screen asks what you want done with one limited marker recording that fact. Keep it, and your founding-member status can be restored if you sign up again with the same email address. Erase it too, and the status cannot be restored later. Either way, nothing else is kept for this purpose.
The marker is a one-way cryptographic hash of your email address, computed the same way each time so a future signup with the same address can be matched against it. We do not keep the address itself for this purpose, only the derived value. A hash of an email address is still personal data: it is derived from an identifier and can be matched back to the same address, so we treat the marker as personal data under this Policy, not as anonymous information, and it is used for nothing else. We say so plainly so that you are not misled: deletion removes your personal content and data as described, with this single exception, and only if you choose it.
10. Data you give us before you have an account
The plan builder and the early-access list on the public site take an email address with no account. We use it to send you what you asked for, to contact you once about early access, and to attach the plan you built to an account if you create one. Ask us at noah@coherent.fyi and we will delete it. If you never create an account, we delete the email address and the draft plan automatically 12 months after you gave them to us. The plan itself records counts, hours, venue names, and the sentence you wrote. It records no amount of money and is connected to no exchange.
11. Security, and what happens if something goes wrong
We maintain administrative, technical, and physical safeguards: encryption in transit and at rest, encryption of the one stored credential with a key held outside the database, hashed passwords, access controls, restricted internal access, audit logging, structured scrubbing of secrets and provider payloads out of logs, and an incident-response process. No system is perfectly secure and we do not claim otherwise.
If a breach affecting your personal data happens, we will notify you and the relevant authorities as the law requires. For EU, EEA, and UK users, that means notifying the competent supervisory authority within 72 hours of becoming aware where feasible, and notifying affected users without undue delay where the breach is likely to be a high risk to their rights.
12. Children
Coherent is for adults. You must be at least 18 to hold an account. We do not knowingly collect personal data from anyone under 18 and will delete it if we learn that we have.
13. Cookies and analytics
We use strictly necessary technologies to run the service, such as authentication tokens, and, only after you consent, privacy-focused analytics to understand aggregate usage. The choice to accept or reject non-essential cookies is presented with equally accessible accept and reject controls, rejecting is never harder than accepting, and analytics does not load before you choose. That choice is separate from, and never bundled with, accepting the Terms or acknowledging this Policy.
14. Consumer health data (US state laws)
Several US state laws treat information about a person's health, including inferences drawn about it, as a protected category of its own, with obligations that can apply whether or not a company meets the size or volume thresholds in that state's general privacy law. Washington's My Health My Data Act, Nevada's SB 370, and Connecticut's consumer health data provisions are the clearest examples. For purposes of our privacy controls we treat the wellness data and the readiness inference as consumer health data wherever an applicable state consumer-health-data law protects it. This Section describes how Coherent handles that data. It sits alongside Section 2.6, which describes the same data in the GDPR's terms, and alongside our separate Consumer Health Data Privacy Policy, linked from the homepage footer at /health-privacy, which describes the categories collected, their sources, the purposes, who receives the data, how long it is kept, and your rights, in the form Washington's law contemplates.
What the wellness data is. If, and only if, you turn on the optional pre-session check-in, Coherent collects the categories you select for sleep quality, stress level, energy level, whether you drank alcohol in the last 24 hours, hydration, caffeine, whether you are dealing with illness or pain, and how long it has been since you last ate. Each one is a category you pick, such as poor, fair, or good, never a number, a measurement, a diagnosis, or a clinical record. Coherent also derives a readiness qualification from those answers, which is an inference about your own state, and we treat that inference as consumer health data as well. Separately, the fact that you engaged with the feature at a given time is recorded as its own event, and because that fact on its own links an identified person to a health feature, it is classified and retained as health data too.
It is optional, and it is off by default. Nothing in Coherent requires it. The product works without it, the price is the same without it, and no other feature is degraded or withheld if you never turn it on.
The consent is separate, and it is not bundled. We collect wellness data only with your distinct, affirmative, opt-in consent. That consent is requested on its own screen, at the point you turn the feature on. That screen shows the categories of data collected, the purpose, who receives the data (no one outside Coherent's processors listed in Section 4), and how to withdraw. It is not bundled into accepting the Terms of Service or acknowledging this Privacy Policy, it is not a condition of holding an account or of using anything else in Coherent, and declining it has no other effect. The consent you are asked to give reads:
"I explicitly consent to Coherent processing the wellness information I choose to provide, including information that may reveal information about my physical or mental health, for the purpose of providing Coherent's wellness/readiness features. I understand this is optional and I may withdraw my consent at any time."
We record that you gave it, which version of this Policy was in force at the time, and when. That record is kept as described in Section 7.
What we use it for. One purpose: showing you your own readiness inference, and timing the warnings you asked for around it. We do not use wellness data to set your price, to decide whether you may use Coherent, to target advertising, to train a model for anybody else, or for any purpose other than the one you consented to. If we ever wanted to use it for a new purpose, we would have to ask you again, before that use started.
We do not sell it, and we do not share it without your consent. We have never sold consumer health data, we have never received anything of value in exchange for it, and we do not offer it to anyone. We do not share it with a third party except a service provider that stores or transmits it for us in order to run the feature, under a contract limiting it to that. Washington's law requires a separate, signed authorisation before consumer health data may be sold; we hold no such authorisation because we do not sell it, and if that ever changed we would have to come and ask you first.
Withdrawing your consent, and deleting the data. You can withdraw your consent at any time in Settings, in the same panel where you gave it. Withdrawal takes effect immediately: it stops future collection, and it erases your stored check-ins and the readiness inference derived from them. The only records that outlive a withdrawal are those a legal obligation requires us to keep, such as the record that you gave the consent and when you withdrew it. A separate "Delete my readiness data" action sits beside the consent control and erases the same data without withdrawing the consent. Deleting your account removes them as well. Health-feature engagement events are deleted with your account, and otherwise expire no later than 90 days after the event. Deletions are completed in our encrypted backups within 14 days under our normal schedule, and in every case no later than six months after we authenticate your request. You may also write to noah@coherent.fyi and ask us to delete this data, and where a state law gives you the right to have it deleted we will honour that, including passing your deletion request on to any service provider holding a copy.
Who can reach it. Access to wellness data inside Coherent is limited to the accounts and server-side processes that need it to run the feature. It is excluded from application logs, and it is carried by the same encrypted-in-transit and encrypted-at-rest infrastructure as the rest of your data.
Your rights under these laws, and no geofencing. You may ask to see this data, ask us to delete it, withdraw your consent, and appeal a refusal by replying to our decision, and we will not treat you differently for doing any of that. We do not use geofencing around any facility that provides health services, and we never have.
15. Biometric information
Coherent does not collect, receive, possess, or store biometric identifiers or biometric information. There is no facial, fingerprint, or voice processing anywhere in the product, and no third party performs any on our behalf. We will never sell, lease, trade, or otherwise profit from biometric data. The self-reported wellness check-in in Section 2.6 is categories you type, not a biometric measurement.
If a future feature reads heart rate or similar data from a wearable, it will have its own consent, and this Policy and our separate Consumer Health Data Privacy Policy will both be updated before that ships.
16. EU, EEA, and UK representatives
Malloy Labs LLC is established in the United States and has no establishment in the EU, the EEA, or the UK. We intentionally offer the service to users in those territories. We also monitor the trading activity that a user there chooses to connect. We do not think it would be honest to describe that as occasional processing, so we are not resting on the Article 27(2) exemption.
Appointing a representative under Article 27 of the EU GDPR, and under the equivalent UK GDPR requirement, is a step we are taking with counsel. No representative has been appointed yet. We will not imply otherwise:
EU and EEA representative: not appointed as of this version.
UK representative: not appointed as of this version.
When the representatives are appointed, we will publish their names, postal addresses, and contact details here, and note the change in this Policy's version history. Until then, EU, EEA, and UK users may direct every privacy matter, including a request to exercise a right, to noah@coherent.fyi, and may complain to their own supervisory authority at any time.
17. Automated processing and profiling
Coherent uses automated processing to compare trading activity against rules supplied by the user and to generate alerts. These alerts do not themselves produce legal effects or similarly significant effects on the user. Coherent does not automatically execute, prevent, modify or delay transactions, suspend trading accounts, change pricing, or determine access to financial products as a result of these alerts.
What that automated processing actually consists of:
- Rule checks match your recent activity against conditions you wrote yourself and show you your own words back when one matches. Coherent may format or restate choices you supply into a draft rule or plan, but it does not select a trading limit, risk parameter, asset, strategy or course of action for you.
- Plan drift comparisons detect when your activity has diverged from the plan you wrote for that session and show you the comparison. What to do about it is entirely your decision.
- Scorecards, replays, and summaries are deterministic reconstructions and descriptions of your own past sessions, not predictions, scores about you as a person, or recommendations.
- Wellness-derived qualification, where you have opted into that, deterministically records whether a past session met criteria you chose, and has no effect outside that feature.
None of this is used for credit, insurance, employment, tenancy, advertising, or anything comparable, and none of it changes your price, your access, or the status of your account.
Profiling is still profiling, and the GDPR still applies. Article 22 of the GDPR places a particular restriction on a narrow category of solely automated decisions. Where that particular restriction does not apply, every other obligation in the Regulation continues to apply in full. The processing described above is profiling within the meaning of Article 4(4), and it remains subject to our lawful-basis obligations in Section 3, to transparency, to purpose limitation and data minimisation, to security, and to your rights of access, objection, restriction, and erasure in Section 8. Nothing in this Section is a claim that the GDPR, the UK GDPR, or any state privacy law stops applying to this processing. If the nature of this processing ever changes, this Section will be updated before the change ships, not after it.
Crucially, and by design, none of this processing can act on you. As Section 3 of the Terms puts it, no code path in Coherent prevents a user action at an exchange or wallet. The output of every process described above is an informational alert, comparison or summary delivered through the channels you choose; it does not itself take any action on you or your account.
18. Changes to this Policy
We do not change this Policy silently, and we do not apply a change backwards to data we have already collected. Any change is published here with a new effective date and version, and the version it replaces stays available at a stable archive URL: /legal/v4.2/privacy, /legal/v4/privacy, and /legal/v3/privacy. The plain-English summary of this version is at /legal/v5/changelog.
A material change, for example a new category of data, a new purpose, a new recipient, a longer retention period, or any change to the wellness consent in Section 14, applies only going forward. We will give you reasonable advance notice by email or an in-app notice before it takes effect. Where the law requires it, or where the change affects processing that rests on your consent, we will ask for renewed consent or a renewed acknowledgment rather than assuming the consent you already gave covers something new. We will not use personal data we already hold for a materially different purpose without the notice, consent, or other lawful basis the law requires for that new purpose. Archived versions of this Policy stay available at the addresses above, so you can always see what applied at the time.
19. Contact
Write to noah@coherent.fyi, or to Malloy Labs LLC, 2466 N Oakland Avenue, Milwaukee, Wisconsin 53211, USA.