ZimmBot Privacy Policy
Effective September 28, 2026 · Version 1.0
1. Who we are and what this covers
This Privacy Policy explains what Dream State Investments LLC, an Indiana limited liability company ("ZimmBot", "we", "us"), collects when you use the service at zimmbot.com (the "Service"), what we do with it, who else sees it, and what you can do about it. It applies to the website, the dashboard, and the trading bots the Service runs on your behalf.
The short version: we collect what it takes to run your bots and bill you, we do not sell it, we do not run advertising trackers, and the only things we ever send to an AI model are market data and anonymous platform-wide statistics — never who you are, what you hold, or what you traded.
2. What we collect
Account. Your email address and a one-way hash of your password. We never store the password itself.
Billing. Your plan and a Stripe customer identifier. Card numbers and billing addresses are entered on Stripe's pages and held by Stripe, not by us.
Exchange connection. If you connect a Binance.US account, the API key and secret you enter. They are encrypted before they are stored and are never displayed again after entry. We ask you to create keys with trading permission only and to restrict them to our server's IP address. Before a bot goes live the Service verifies that the key can read your account and place orders (a test order Binance.US validates but never executes); Binance.US does not expose whether a key has withdrawal permission, and the Service never calls a withdrawal endpoint, so that setting is yours to confirm and the exchange's to enforce.
Bot configuration and trading records. Each bot's settings, its engine state, the orders it places and the fills it receives, realized results, fees, the market read the five models produced at the time, and an audit trail of every settings change and its reason. These records are the product: the receipts you see on the dashboard are built from them.
Live-trading consent records. When you switch a bot to live trading we record the version of the risk disclosures you were shown, the acknowledgments you ticked (including your agreement to the Terms of Service), the balance you allocated, your IP address, your browser's user-agent string, and the pre-flight receipt (which checks were verified, which could only be acknowledged, and what the exchange reported), so that there is a record of what you agreed to and when.
Server logs. Like every web server, ours records each request's IP address, path, timestamp, status, and user agent. These logs are rotated weekly and kept for four weeks, then deleted.
Session cookie. One cookie that keeps you logged in. It holds your account number, your email address and your plan; it is signed so it cannot be altered, is sent only over HTTPS, and cannot be read by scripts on the page. It does not track you across other sites.
3. What we do not collect
- No card numbers, bank details, government identifiers, or exchange login passwords — only the API key you create for us.
- No use of withdrawal permission on your exchange account, ever: we ask you not to grant it, the Service never calls a withdrawal endpoint, and Binance.US does not let us see that setting from our side.
- No location data beyond the IP address in server and consent logs.
- No advertising identifiers, no cross-site trackers, no third-party analytics.
- We do not send marketing email. The Service itself sends no automated email today; notifications appear in the dashboard. We write to you from support@zimmbot.com only when the Terms or this Policy call for it, for example notice of a material change.
4. How we use what we collect
- To run your bots — reading your balances and placing, cancelling and reconciling orders in your exchange account, on the settings you chose.
- To show your own data back to you — every vote, every receipt, every state change.
- To keep a record of live-trading consent (§2).
- To bill you through Stripe and to apply the limits of your plan (coin set, capital cap, per-coin depth ceilings).
- To keep the platform honest. We compute anonymous, platform-wide aggregates — for example the share of winning sells per coin, or per market-sentiment zone, across all users and all bots — and include those aggregates, with no identifiers, in the market read the five AI models produce every 30 minutes.
- To warn you when something about your bot needs attention (a slice above a coin's depth ceiling, a paused block, a drawdown gate), through in-dashboard notifications.
- To investigate abuse, secure the Service, and meet legal obligations.
We do not sell personal information and we do not share it for advertising.
5. Who else sees it (service providers)
We use a small number of providers to run the Service. Each receives only what its role requires.
| Provider | Role | What it receives |
|---|---|---|
| Supabase | Database hosting (PostgreSQL) | Everything in §2 that is stored, at rest |
| Linode (Akamai) | Server hosting | The running Service and its logs |
| Stripe | Billing | Your email, plan, and payment details you enter on Stripe's pages |
| Binance.US | Your exchange | Orders and balance reads made with your API key, from our server's IP |
| Five AI model providers (large-language-model APIs) | AI market read | Market data, indicators, and the anonymous aggregates in §4 — never your identity, balances, keys, orders or trades |
| Market-data and news sources | Market and sentiment data | Nothing about you; server-side requests only |
Loaded by your browser. The dashboard's price chart is a TradingView widget served from tradingview.com, and pages load fonts from Google Fonts; those servers see your IP address and browser details under their own privacy policies. The dashboard may also fetch public prices directly from Binance.US.
We may also disclose information when the law requires it, to protect the Service or its users, or as part of a merger, acquisition or sale of assets, in which case this Policy continues to apply to the transferred data.
6. How long we keep it
- Account data — while your account exists.
- Trading records, settings history and receipts — while your account exists. They are the audit trail of what the Service did with your money; deleting a bot hides it from your dashboard but retains its records.
- Consent records — while your account exists, and afterwards for as long as we may need them to show what you agreed to (for example, to resolve a dispute).
- Server logs — rotated weekly and kept for four weeks, then deleted (the current week plus four weekly archives, about five weeks on disk at most).
- Exchange API keys — until you disconnect them, delete them on Binance.US, or close your account. Deleting the key at Binance.US revokes our access immediately, independent of anything we do.
Account deletion. There is no self-service delete-account button today. Email us at support@zimmbot.com (§12) and we will delete your account and personal data within 30 days, except records we must keep to meet legal obligations or to show what you agreed to (such as billing and live-trading consent records), which we keep only as long as described above.
7. How we protect it
Passwords are stored only as one-way hashes. Exchange API keys are encrypted at rest and never displayed after entry. All traffic to the Service uses HTTPS. Our server's outbound IP is fixed so that you can restrict your exchange key to it. We recommend, and the setup guide walks you through, creating a trading-only key with withdrawals disabled; the Service verifies trading permission with a never-executed test order and cannot verify the withdrawal setting on Binance.US (it never calls a withdrawal endpoint).
No system is perfectly secure. If we learn of a breach affecting your data we will notify you by email and in the dashboard without unreasonable delay, and within any deadline the law sets.
8. Your choices
- See it. Your dashboard shows every setting, order, fill, vote and receipt for your bots. Plans that include export can download trade history as CSV. For anything not shown, ask (§12) and we will provide a copy.
- Fix it. You can change your settings at any time; email us to correct account details.
- Disconnect the exchange. Remove your API key in the dashboard (Settings → Manage API Keys), or delete the key on Binance.US, which revokes our access immediately. Removing the key in the dashboard first stops any live bot you have — cancelling that bot's resting orders while the key still works — and then deletes the stored key and secret from our database. Encrypted copies can remain in our database provider's backups until those backups expire on the provider's schedule.
- Delete the account. §6.
- Stop. Stopping a bot stops new orders immediately and does not sell your coin. Stopping or deleting a live bot also cancels that bot's own orders resting on the exchange; if the exchange cannot be reached, the dashboard warns you and the orders remain until you cancel them on Binance.US (Terms Section 4.7 and the go-live acknowledgments).
9. State privacy rights
Where a state privacy law applies to you, you may have the rights to know, access, correct, delete, and port your personal information, and to opt out of its sale or sharing. We do not sell or share personal information for cross-context advertising. To exercise a right, contact us (§12); we will verify the request against your account email. If we decline a request, we will tell you why, and you can ask us to reconsider by replying to that email.
10. Children
The Service is for adults. You must be at least 18 to create an account, and we do not knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
11. Changes to this Policy
We will post the date and version of each revision at the top of this page. If a change materially affects how we use your information, we will tell you in the dashboard and by email at least 14 days before it takes effect.
12. Contact
Dream State Investments LLC (ZimmBot)
4128 N County Road 50 E, Logansport, Indiana 46947-8731
Email: support@zimmbot.com