Privacy policy:
what we keep, and why.

Last updated: 5 November 2026

Who we are

TPcopier runs tpcopier.com: a signal copier and trade copier that reads trading signals from the sources you link and places trades on the accounts you connect, plus software that runs on your own computer. In this policy "we" means TPcopier and "you" means you, the customer. For anything about your data, write to support@tpcopier.com.

What you give us

• When you sign up - your full name, e-mail address, country and password, and your tick to say you have read the trading-risk warning and accept that payments are final.
• Your WhatsApp number, if you give it - it is optional. We use it only to send you updates about TPcopier and your account. Write to us and we stop and delete it.
• Your password - we keep it only as a salted PBKDF2-SHA256 hash (200,000 rounds). Nobody at TPcopier can read it.
• Two-factor sign-in - if you turn it on, the secret your authenticator app uses is stored encrypted, and your ten one-time recovery codes are stored only as SHA-256 hashes.
• When you write to us - your messages and our replies, so we can help you.

What we collect when you use TPcopier

• Telegram - you sign in with your own Telegram account, using your phone number and the code Telegram sends you. We keep your phone number and an encrypted Telegram session on our servers so we can read the channels and groups you link. We list your channels and groups (names and member counts) so you can pick. Private chats are skipped, and for chats you have not linked we only count new messages.
• WhatsApp - TPcopier joins your WhatsApp as a linked device when you scan a QR code. We read only the groups you tick, never private chats, and we never send anything. The link is kept on our servers, so a restart does not need a new scan.
• Discord - you sign in with a QR code, with your e-mail or phone and password, or with a bot token. We keep the resulting sign-in token (or your bot token), encrypted - never your Discord password. We read only the channels you tick and never post.
• TradingView - TradingView sends your alerts to your own feed address on TPcopier (a webhook).
• Signals and trades - for each signal or alert we receive from a linked source: the message text, how it was read, when it arrived and what each of your accounts did with it, plus an activity log. This is what you see on the website.
• Cloud MetaTrader accounts - the account number, server and trading password. The password is sealed with our cloud server's own key the moment you enter it, and the website itself cannot read it again. The MetaTrader terminal runs on our servers and logs in to your broker.
• Binary broker accounts (Quotex, Pocket Option, IQ Option, Binomo, Olymp Trade, ExpertOption, Binolla) - you sign in yourself, in the broker's own sign-in window, shown to you from our servers. What you type there goes straight to the broker's page and is never logged or kept, so we do not have your broker password. We keep the session that results (a session id and cookies, encrypted) and the browser profile used for it, and use them to place your trades. We also keep the account's balance and a masked form of its e-mail address to show you. Your broker traffic goes through a server region you pick (Asia, Europe or US), to match where you normally log in from.
• Free-trial records - to allow one free trial per channel, sender and account, we remember the identities used in a trial (a Telegram account, WhatsApp number or Discord account, a channel or group, a broker account id, a MetaTrader server and login) only as HMAC-SHA256 hashes keyed with our server's secret. For our admin we keep a chat's title, or otherwise its last three characters.
• Payments - with Binance Pay, we receive the order's status from Binance, never your card or wallet details. If you pay by transfer (UPI, bank transfer, cash or crypto), we keep the payment reference you give us. We keep your orders, bills and amounts, and the time you confirmed that a payment is final.
• Logs - our servers log requests, including IP addresses and times, for security and to fix faults.

How we use it

• To run the service you set up: read your linked sources, turn signals into trades, place them on your accounts and show you what happened.
• To sign you in and keep your account safe.
• To run the free trial fairly - one per channel, sender and account.
• To trade on TPcopier's own accounts: the operator of TPcopier may also place trades on its own accounts from the signals read in the channels and groups linked to TPcopier. Only those signals are used this way - never your broker accounts, your trades or your personal details.
• To bill you and deliver what you paid for.
• To send you service e-mails: sign-in, billing and alerts.
• To find and fix faults, and to stop abuse.

We do not use your account, signal or trade data for advertising, and we do not sell it. The ads on our public pages are chosen by Google, as described under Google AdSense below.

When AI reads a message

Our own reader reads signals on our servers. When it cannot read a message, we send that message's text, with our instructions and your keyword lists, to a third-party AI model provider chosen by TPcopier (or to a backup provider if the first one fails), to work out what it means. Your name, e-mail address and broker logins are not sent with it. You do not need an AI account or key of your own.

Who else sees it

• The AI model provider - the text of messages our own reader could not read, as above.
• Binance - when you pay with Binance Pay, Binance handles the payment and tells us the order's status.
• Our e-mail provider - it carries the e-mails we send you from support@tpcopier.com.
• Hosting providers - your data is held on servers we rent from hosting providers, which may be outside your country.
• Google Analytics - our public pages (not the signed-in app) use Google Analytics 4 to count visits, the pages viewed and sign-ups. Google receives your IP address, browser details and the pages you open, and sets its own analytics cookies (_ga). We use it only to see how people find and use the website, not to choose ads.
• Google AdSense - our public pages (not the signed-in app) may show ads served by Google. Google and its partners receive your IP address, browser details and the page you are on, and may set or read cookies to choose and measure those ads - see how Google uses information from sites that use its services. We do not send Google your name, e-mail, broker accounts, signals or trades.
• Google Fonts - our public pages use fonts served from our own server, but the signed-in app loads its fonts from Google (fonts.googleapis.com and fonts.gstatic.com), so Google receives your IP address and browser details when an app page loads.
• The platforms and brokers you connect - Telegram, WhatsApp, Discord, TradingView, MetaTrader and your brokers see our servers working for you: reading what you linked, signing in to your accounts and placing your trades. Their own privacy policies apply.

We do not sell your data, and we do not give it to anyone else unless the law requires it.

Cookies and local storage

• One sign-in cookie - set by us when you log in, to keep you signed in. Page scripts cannot read it (httpOnly), on our https site it is marked Secure, it is not sent with requests from other sites (SameSite=Strict), and it lasts 12 hours.
• The admin console has its own sign-in cookie, used only by our staff.
• Google Analytics cookies (_ga and _ga_<id>) on our public pages, to count visits - see Google Analytics above. You can block them in your browser or with Google's opt-out add-on, and the site works the same.
• Advertising cookies on our public pages, when they show ads. Third-party vendors, including Google, use cookies to serve ads based on your earlier visits to this website or other websites. Google's advertising cookies let Google and its partners show you ads based on your visits to our site and other sites on the internet. You can turn off personalised ads in Google's Ads Settings, and opt out of other vendors' cookies at aboutads.info. In the European Economic Area, the UK and Switzerland, a consent message asks you first, and you can choose non-personalised ads or refuse.
• Your browser's storage - local storage remembers whether you picked the light or dark look in the app, and while a tab is open, session storage remembers the last bridge you opened there. Neither is sent to us.

The Android app

The TPcopier Android app signs in to the same account and shows the same data as the website. It asks for no phone permission (no contacts, location, camera or files), has no ads and no analytics, and talks to tpcopier.com only, over HTTPS.

Software on your own computer

The Indian broker apps, for Zerodha, Angel One, Upstox, Dhan, Fyers, Groww, ICICI Direct, 5paisa, Kotak Neo and Alice Blue, run on your own Windows PC, because SEBI's static-IP rule means broker orders must come from your own registered IP address. Your broker API keys and your Telegram login stay on that computer, sealed to it, and are not sent to us.

For these apps TPcopier.com checks the licence. The Indian TeleCopier reads Telegram with your own login on your computer, and TradingView sends its alerts straight to the Indian TvCopier on your computer, so neither your messages nor your alerts pass through our servers. An older install of the Binance or Delta TvCopier may still collect alerts from a TPcopier address it was given; those alerts pass through our server on the way.

To check a licence, our software for your own computer (the Indian apps and the Lifetime Software) sends us the licence key, an identifier for that computer, the computer's name and the app version. We keep the identifier and name with the key they are bound to, a record of each time a key is activated on a computer or refused, and the time and IP address of the latest check-in. We keep your licence key as a hash, plus an encrypted copy so you can see it again in your account. Our record of which computers have had a free demo holds only hashes.

Security

• Passwords are kept only as salted PBKDF2-SHA256 hashes, with 200,000 rounds.
• Telegram sessions, Discord sign-ins, binary broker sessions, two-factor secrets and licence keys are stored encrypted. A MetaTrader password is sealed so that only the cloud server running your terminal can open it.
• You can turn on two-factor sign-in with an authenticator app.
• A password-reset link works once, for one hour, and we keep only a hash of it.
• When one of our staff opens a decrypted token, cookie or key, that access is written to an audit log. The secret itself never is.
• Server logs help us spot abuse and fix faults.

No system is perfectly safe, so please use a strong password and turn on two-factor sign-in.

How long we keep it

• Your account - your details, settings, signals and trade history are kept while your account is in use, until you delete it.
• Sessions and sign-ins - when nothing pays for a bridge any more (no paid time and no running trial), it stops at once. After a short grace period we delete the binary broker sessions and Telegram, WhatsApp and Discord sign-ins it used, and we warn you a day before. Your trade history stays.
• Cloud MetaTrader accounts - not deleted. When a free trial ends, the terminal on our server is closed and deleted at once; when a paid plan ends, one day later. The account and its sealed password are kept, stopped, so that paying makes it again without typing the password. You can delete it yourself at any time.
• Logs, payments and trial records - kept for as long as we need them for security, our accounts and the trial rules.

Your choices and rights

• Delete your account - in the Android app (Account, then Delete my account) or on the website (Settings, then Account, then Delete my account). It happens at once. What goes and what is kept.
• See or correct your data - write to support@tpcopier.com from the e-mail address on your account, so we know it is you.
• Sign out or remove things yourself - signing out of Telegram, WhatsApp or Discord in the app deletes that session from our servers. Removing a binary broker account deletes its session and saved browser profile. Deleting a cloud MetaTrader account closes its terminal, removes its data on the cloud server and erases the sealed password.
• Cookies - you can block or delete cookies in your browser, but without the sign-in cookie you cannot stay signed in.
• If the law where you live gives you more rights over your data, write to us and we will help.

Children

TPcopier is not for anyone under 18. We do not knowingly keep data about anyone under 18. If you think we do, tell us and we will delete it.

Changes to this policy

When what we keep or how we use it changes, we update this page and the date at the top. For a big change we will also tell you by e-mail.

Contact

Questions about your data or this policy? Write to support@tpcopier.com. Our terms and conditions and refund policy cover the rest.