CAVARASign in

Privacy Policy

Cavara is a personal tool that Brad Stubbs built to run rule-based stock and options bots on his own brokerage accounts. It is not offered to the public. This policy explains what information Cavara handles, why, and the choices anyone with access has.

Effective October 23, 2026

1. Who we are

Cavara (cavara.app) is operated by Brad Stubbs, an individual based in Texas, United States (“Cavara”, “we”, “us”), for his own personal trading. Cavara is not a commercial service: it has no paying customers, is not marketed, and access is by invitation only. Questions about this policy go to brad.a.stubbs@gmail.com.

Because Cavara is a personal tool, the “you” in this policy is almost always its operator. It also applies to anyone the operator invites, and to anyone who submits the sign-up form.

2. Information we collect

Account information

  • Your email address and the display name you choose.
  • Your password, stored only as a salted PBKDF2-SHA256 hash. We never store or see your password in plain text.
  • Your account role and approval status. A sign-up request creates a pending account that cannot sign in unless the operator approves it.

Brokerage connections

  • Alpaca: the API key pair you paste in. It is encrypted with AES-256-GCM before it is stored, and it is only decrypted on the server to talk to Alpaca on your behalf. It is never sent back to your browser.
  • Moomoo: Cavara reaches moomoo through the OpenD gateway you run on your own computer. Your moomoo login and trading password stay in OpenD and are never sent to Cavara.
  • SnapTrade (when available): if you connect a brokerage through SnapTrade, you sign in to your brokerage on SnapTrade’s or your brokerage’s own pages. Cavara never receives your brokerage username or password. Cavara stores the identifier and access secret SnapTrade issues for your connection, encrypted the same way as above.
  • From connected accounts we read balances, buying power, positions, open orders, fills and market clock data.

Trading activity in Cavara

  • Bots you create and their rules, your risk limits and kill-switch state.
  • Orders Cavara proposes or places, the reason recorded for each, approvals and declines.
  • A trade journal of positions the bots opened and closed, used for performance figures.
  • Bot run logs (each scheduled check and why it did or did not trade).
  • Trade history files you choose to upload (for example a broker CSV export) so Cavara can suggest bot settings.
  • Rule changes Cavara suggests or makes from your results, and whether each was kept or reversed.

Cavara AI

When you ask Cavara AI a question, the question and a summary of your bots, orders, runs and trades are sent to the AI model to answer it. We log the first 400 characters of each question with timing and error information, to diagnose problems.

Technical information

  • A sign-in session cookie (HttpOnly, Secure, SameSite=Lax) that expires after 30 days. Cavara uses no advertising or analytics cookies.
  • A setting or two saved in your browser’s local storage, such as your preferred ticker.
  • Counters for failed sign-ins and request rate limits, keyed to your email, used to protect your account.
  • Standard request logs (such as IP address, time and path) kept by our hosting provider for security and reliability.

3. How we use information

  • To run your account and sign you in.
  • To run your bots: read your connected accounts, evaluate your rules, and submit, monitor or cancel orders as described in the Terms of Service and on How Cavara works.
  • To show you balances, positions, orders and performance.
  • To send you email notices about orders waiting for your approval or orders that failed, if email is enabled.
  • To answer your Cavara AI questions.
  • To keep the service secure, prevent abuse and fix problems.

We do not sell your personal information, and we do not share it for advertising.

4. Who processes your information

We use these service providers, only for the purposes above:

  • Cloudflare: hosting, database storage, request logs, and the Workers AI model that powers Cavara AI.
  • Alpaca: brokerage and market data, when you connect an Alpaca account.
  • moomoo / Futu: brokerage, through the OpenD gateway on your computer, when you connect moomoo.
  • SnapTrade: brokerage connections, when you connect a brokerage through SnapTrade.
  • Resend: delivery of notification emails, when enabled.
  • Market data providers receive ticker symbols and dates only, never information about you.

Each brokerage and provider handles data under its own privacy policy. We may also disclose information if required by law, or to protect the rights, property or safety of Cavara, its users or others.

5. Security

Traffic is encrypted with HTTPS. Passwords are hashed, brokerage secrets are encrypted at rest, sessions use secure HttpOnly cookies, failed sign-ins are rate limited, and accounts must be approved before use. No system is perfectly secure, so please use a unique password and tell us right away if you suspect unauthorized access.

6. How long we keep information

  • Account, bot, order and trade records: while your account is open.
  • Bot run logs: about 45 days.
  • Cavara AI question logs: 90 days.
  • Sign-in sessions: 30 days, or until you sign out.
  • When your account is deleted, we delete your account and the data above. Database backups held by our hosting provider can retain copies for up to 30 days before they expire.

7. Your choices and rights

  • Disconnect a brokerage at any time by removing it in Cavara’s broker settings, revoking the API key at your broker, closing OpenD, or removing the connection in SnapTrade.
  • Access, correct or delete your information by emailing brad.a.stubbs@gmail.com. We respond within 30 days.
  • Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act. We honor those requests through the same email.

8. Children

Cavara is for adults 18 and older. We do not knowingly collect information from anyone under 18.

9. Changes to this policy

If we change this policy, we will update the effective date above and, for significant changes, tell you in the app or by email before they take effect.

10. Contact

Brad Stubbs · brad.a.stubbs@gmail.com