What exchanges are supported on Tetrac?

Tetrac supports 1000+ markets across multiple exchanges including Binance, Bybit, Blofin, Kucoin, Phemex, AsterDEX, and Orderly Network for DEX trading.

Is registration required to use Tetrac?

No, Tetrac is a non-custodial platform that doesn't require registration. You can start trading with just an email address or Web3 wallet.

What is gasless DEX trading?

Gasless DEX trading allows you to trade perpetual futures on decentralized exchanges like Orderly Network without paying gas fees. We use account abstraction to cover gas costs.

Can I use MetaTrader 5 with Tetrac?

Yes, Tetrac provides a custom MT5 plugin that enables unlimited crypto charts, API trading to multiple exchanges, custom indicators, and algorithmic trading robots.

What are the fees for trading on Tetrac?

Tetrac charges zero added commission. You only pay the exchange's standard trading fees. For Orderly Network DEX trading, we offer gasless transactions.

Tetrac

Start Trading

Tetrac

tetrac.xyz / privacy

Privacy
Policy

TTC is built with a privacy-first architecture. Private keys are encrypted client-side before reaching our servers — we cryptographically cannot access your funds.

Last updated: 2026-03-30·GDPR compliant·privacy@tetrac.xyz

Private keys

Client-side encrypted

Passkey storage

SHA-256 hash only

IP addresses

Never persisted

Data We Collect

The table below is generated directly from TTC's database schema. Only the fields listed here are stored on our servers.

FieldPurposeLegal basisRetention

Email address

Account identification, loginContractUntil account deleted

Solana public key

Account identifier, wallet verificationContractUntil account deleted

Passkey hash (SHA-256) encrypted

One-way hash — original passkey is never stored

Encrypted private key blobs encryptedclient-side only

Encrypted by your passkey before reaching our servers. We cannot decrypt them.

Wallet key custody (client-side encryption)ContractUntil account deleted

EVM wallet addresses

Exchange trading (Vest, Orderly)ContractUntil account deleted

Last login timestamp

Session management, securityLegitimate interestUntil account deleted

User preferences

Personalised UI settingsConsentUntil account deleted or preference cleared

Auth token (session)

Authenticated API accessContract24 hours (auto-expiry)

IP address

Used only to enforce rate limits. Never written to a database.

Rate-limit abuse prevention onlyLegitimate interestNot persisted — in-memory per request

Telegram user ID & name

Only collected if you choose to log in via Telegram.

Telegram login (optional)ConsentUntil account deleted

How We Protect Your Data

Client-side encryption

All private keys (Solana, EVM, Orderly) are encrypted with your passkey or wallet signature before leaving your device. Our server stores only ciphertext blobs — we have no decryption key.

Zero plaintext keys

Your passkey is hashed with SHA-256 on the client before transmission. The server stores only the hash. We cannot reverse it to recover your passkey.

Short-lived sessions

Auth tokens expire 24 hours after login; there is no silent refresh — re-login issues a new token. Challenges expire after 5 minutes.

No IP logging

IP addresses are read per-request for rate-limit enforcement only. They are never written to a database, log file, or analytics system.

Encrypted at rest (client)

In your browser, private keys are stored encrypted-at-rest via the Web Crypto API. The encryption key lives in sessionStorage — not localStorage — and is cleared on logout.

Biometric gate

If you enable biometric login, your passkey is wrapped in a non-extractable AES-GCM key stored in IndexedDB. Decryption requires a WebAuthn assertion (Touch ID / Face ID).

Third-Party Processors

We use a minimal set of sub-processors. We do not sell, rent, or share your personal data with advertisers.

Vercel

Hosting, KV database (Redis), and Analytics

SCCs

USA / global edge

Exchange APIs

Trade execution — Binance, Bybit, OKX, Bitget, and others

Your credentials are passed through in-session only, never stored server-side

Varies by exchange

Optional login via Telegram bot

Optional — only used if you choose Telegram login

Global

Your Rights (GDPR)

If you are in the EU, EEA, or UK, you have the following rights under GDPR / UK GDPR. To exercise any right, email privacy@tetrac.xyz or use the self-service endpoint below.

Right to access

Request a copy of all personal data we hold about your account.

Right to erasure

Request deletion of your account and all associated personal data.

Right to portability

Export your account data in a machine-readable JSON format.

Right to rectification

Correct inaccurate personal data held in your account.

Right to object

Object to processing based on legitimate interests.

Right to restrict

Request that we limit how we process your data while a dispute is resolved.

Self-service GDPR endpoint

POST /api/gdpr

Submit an access, export, or deletion request programmatically. Requires a valid session token. Responses within 30 days.

API docs

Cookies & Local Storage

localStorage (auth)essential

Stores session token, public key, email, and public wallet addresses

sessionStorage (encryption key)essential

Holds your in-memory encryption key — cleared on tab close and logout

IndexedDB (biometric)optional

Encrypted passkey blob for biometric login. Only present if you enable Touch/Face ID login

Vercel Analyticsoptional

Anonymous page-view analytics. No cross-site tracking. No cookies set for analytics — uses privacy-preserving measurement

Contact

Privacy inquiries & GDPR requests

privacy@tetrac.xyz

Security vulnerabilities

security@tetrac.xyz

We will respond to all GDPR requests within 30 days. Where requests are complex or numerous, we may extend this to 90 days — we will notify you within the initial 30-day period if an extension is required. There is no charge for submitting a request.

PrivacyPolicy