Privacy Policy

1. Who we are and what this Policy covers

RAR7 LLC manages and operates the Lotra project and is responsible for the Lotra Cloud information described in this Policy. "Lotra," "we," "us," and "our" refer to RAR7 LLC when it determines how that information is processed.

This Policy applies to:

• the Lotra/RSA Software Windows desktop application;
• the Lotra Discord application, OAuth login, server-role checks, slash commands, and messages;
• the Cloudflare Worker and D1 database that provide login, device binding, signal delivery, and receipt state;
• the Lotra legal website; and
• support, security, and privacy requests submitted to RAR7 LLC.

Independent brokers, Discord, Cloudflare, Microsoft, Google, Auth0, market-data sources, download hosts, and other third parties control their own services and privacy practices. This Policy describes Lotra's interaction with them but does not replace their notices.

2. Privacy summary

• Broker credentials, session state, account identifiers, detailed holdings, balances, and order records are designed to remain on your computer or travel directly to the broker.
• Lotra Cloud receives Discord identity and role data, a device public key, acceptance records, limited signal/preview data, and delivery/completion status.
• The device binding uses a random installation key, not hardware serial numbers or a general hardware fingerprint.
• We do not sell personal information, rent it, or use it for targeted advertising.
• The legal website has no advertising or analytics scripts and sets no first-party cookies.
• Starting the cloud listener can cause eligible orders to be submitted automatically; that processing is described below.

3. Sources of information

We receive or process information from:

• you, when you accept policies, configure the app, connect a broker, use Discord, seek support, or make a request;
• your installation, including its device public key, signed requests, settings, previews, and execution status;
• Discord, including your user ID, username, server membership, roles, and authorized interactions;
• administrators, when they issue buy/sell signals or owner-only device-unbind commands;
• connected brokers and data sources, when the local application requests accounts, positions, quotes, previews, and order status; and
• Cloudflare and network infrastructure, which process request, routing, security, and diagnostic metadata.

4. Information processed by Lotra Cloud

5. Information processed and retained on your computer

Lotra needs substantial local information to display portfolios, authenticate to brokers, apply safety rules, and submit or reconcile orders. This information is not uploaded to RAR7 LLC merely because it exists locally. It can still be transmitted directly to a broker, Discord, Cloudflare, or another provider when you use the related feature.

6. Legal website data

These static legal pages contain no account forms, advertising, analytics scripts, pixels, or first-party cookies. Cloudflare processes ordinary web-request and security metadata when it serves the pages. Following a Discord or other external link moves you to that provider, whose privacy practices then apply.

7. How RAR7 LLC uses information

We use the information described above to:

• present and record Terms and Privacy acceptance;
• authenticate Discord users and confirm server membership, Premium access, and administrator authority;
• bind one installation, authenticate signed requests, revoke sessions, and process owner-approved unbinding;
• create, quote, deliver, claim, authorize, expire, complete, and de-duplicate signals;
• connect locally to selected brokers, show portfolios, apply settings, and submit or reconcile user-authorized orders;
• protect accounts, rate-limit abuse, troubleshoot failures, and investigate security incidents;
• provide support, respond to privacy requests, enforce the Terms, and resolve disputes; and
• comply with law, lawful process, provider requirements, and recordkeeping obligations.

We do not use Discord API data, broker data, or device-binding data to build advertising profiles or for an unrelated commercial purpose.

8. Legal bases where required

Where a law requires a legal basis, processing may be based on: performance of our contract with you; steps you request before entering that contract; RAR7 LLC's legitimate interests in operating, securing, improving, and enforcing the Service; compliance with legal obligations; protection of users and legal rights; or consent where the law requires consent. You may withdraw consent for future processing where consent is the basis, but withdrawal does not make earlier processing unlawful and may make the related feature unavailable.

9. Service providers and disclosures

Information may be processed or disclosed to:

• Discord, for OAuth identity, membership/roles, commands, messages, interactions, and community support;
• Cloudflare, for Pages, Workers, D1 database, network routing, security, logs, and backups;
• your selected brokerage and its authentication/data providers, for login, market data, account information, previews, and orders;
• Microsoft Windows credential services, for local keyring storage, and Google Chrome or compatible browsers for browser-assisted broker workflows;
• Auth0, where a selected broker uses it for passwordless authentication;
• professional advisers, contractors, or transaction counterparties under appropriate duties when needed to operate, secure, finance, reorganize, or transfer the Service; and
• courts, regulators, law enforcement, providers, or affected parties when reasonably necessary to comply with valid process, protect rights or safety, address fraud or abuse, or investigate an incident.

Discord messages can remain under Discord and server retention even after the corresponding short-lived D1 signal record is deleted. Brokers independently control records required for account, order, regulatory, tax, fraud, and security purposes.

10. No sale, sharing for targeted advertising, or advertising profiles

RAR7 LLC does not sell or rent personal information, exchange it for cross-context behavioral advertising, or share it for targeted advertising. The legal site contains no third-party advertising or analytics trackers. We also do not knowingly sell or share personal information of anyone under 18.

11. Retention and deletion

We may retain information longer where reasonably necessary for fraud prevention, security, legal claims, tax/accounting duties, provider disputes, or compliance, and may delete it earlier when no longer needed. Deletion can be delayed in backups until the ordinary backup cycle completes.

Local deletion controls

• Clear Sessions removes supported request-session files, Webull tokens, broker browser profiles/cookies, and certain safety state, but keeps saved credentials and broker/account settings.
• Delete Session & Cookies removes the selected managed browser profile/session while keeping credentials and account settings.
• Delete Login removes the selected profile and associated saved username/password, Webull token, and supported session snapshot, but may not remove all historical portfolio/order/safety records or every browser artifact.
• Reset Portfolio Records removes many portfolio snapshots and Lotra order-history records but intentionally retains certain baseline, protected-ticker, tracked-play, and safety/deduplication records.
• Discord logout attempts remote session revocation and clears the local cloud token. Owner-only unbinding removes the cloud device binding and revokes active sessions.

12. Automated access and order processing

Lotra automatically checks Discord membership, Premium role, administrator status, policy version, session status, signed device proof, replay state, signal deadline, and device binding to allow or deny Service access. An owner unbind command removes a binding and revokes sessions. You can ask for review of an access decision through the contact method below.

If you manually start the cloud listener, the desktop automatically receives eligible administrator signals, requests broker quotes and previews, applies enabled account selectors and safety checks, obtains server authorization, and can submit live buy or sell orders without a per-signal local confirmation. Lotra does not use a financial profile to determine suitability. Stop the listener to prevent new signals; stopping may not interrupt an order already submitting. See the automatic-execution Terms before enabling it.

13. Security

Measures include TLS with certificate and hostname verification, OS-keyring storage for selected secrets, hashed cloud session/state values, short-lived sessions, per-installation request signatures, nonce replay protection, Discord interaction- signature verification, live role checks, restricted administrator/owner commands, limited cloud preview fields, no-cache responses, rate limiting, and credential/error redaction.

No system is perfectly secure. Lotra does not provide certificate pinning, TPM-backed device keys, traffic-analysis-tool detection, or a guarantee that local software, device traffic, browser state, or files cannot be inspected, copied, altered, or reverse engineered. Protect your Windows account, enable device encryption where available, use broker MFA, and do not run Lotra on an untrusted or shared computer.

14. Your choices and privacy rights

Depending on your location and subject to legal exceptions, you may request:

• confirmation of processing and access to personal information;
• correction of inaccurate information;
• deletion of information that is no longer required;
• a portable copy of information you provided;
• restriction of or objection to certain processing;
• withdrawal of consent where consent is the legal basis;
• review of certain automated access decisions; and
• an appeal if a covered U.S. state privacy request is denied.

We may verify a request using Discord identity, the bound device, transaction or purchase information, or other reasonable evidence. We will not ask you to post a password, MFA code, full brokerage account number, or government identifier publicly. An authorized agent may submit a request where law permits, but we may require proof of authority and direct confirmation from the user.

Some information cannot be deleted immediately because it is needed for security, fraud prevention, contract records, legal obligations, protected rights, or completion of a request you made. We do not discriminate against users for exercising applicable privacy rights, although deleting information needed for access can make the Service unavailable.

15. U.S. state privacy notice

The categories collected during the preceding 12 months can include identifiers; internet/network activity; account-access and financial information processed locally; commercial/subscription records if access is purchased; device/security identifiers; and inferences limited to Premium, administrator, access, and signal status. Sources, purposes, recipients, and retention are described above.

If a state privacy law applies to RAR7 LLC and your request, you may have rights to know/access, correct, delete, obtain portability, opt out of sale or targeted advertising, opt out of certain covered profiling, limit certain sensitive-data uses, use an authorized agent, appeal, and receive nondiscriminatory treatment. RAR7 LLC does not sell personal information or share it for targeted advertising, so there is no sale or targeted-advertising opt-out necessary for current practices.

16. Global Privacy Control and Do Not Track

Because the legal site has no advertising trackers and RAR7 LLC does not sell personal information or use it for targeted advertising, Global Privacy Control and legacy browser Do Not Track signals do not change current site behavior. We do not permit third parties to track visitors across unrelated sites through these legal pages. If practices change, we will update this disclosure and honor legally required opt-out signals.

17. Children's privacy

Lotra is intended only for adults age 18 or older. We do not knowingly collect personal information from a child under 13 or knowingly allow a minor to use automated brokerage features. If you believe an underage person submitted information, contact RAR7 LLC so the account and records can be reviewed and deleted where appropriate.

18. International processing

RAR7 LLC and its providers are based in or operate from the United States, and Discord, Cloudflare, brokers, and other providers use infrastructure in multiple countries. Information can therefore be processed outside your home jurisdiction, where laws may differ. Where required, transfers rely on provider contractual safeguards, adequacy decisions, consent, or another lawful mechanism.

19. Changes to this Policy

We may update this Policy when the Service, law, providers, risks, or data practices change. The effective date will be revised. Material changes may be announced in the desktop application or official Discord community and may require you to accept the new Terms and Privacy version before continuing or creating a new device binding.

20. Contact RAR7 LLC

Submit privacy questions or requests through the official Lotra Discord community and ask to continue in a private channel. Do not post passwords, MFA codes, API secrets, session data, full account numbers, government identifiers, or other sensitive information publicly.

Identify the request as a RAR7 LLC privacy request and include your Discord username and a general description of the request. We may ask you to verify the request through Discord OAuth or the bound installation before acting.