Privacy Policy

Effective date: September 20, 2026

MCP connection disclosure updated: October 3, 2026

Hosting-location wording corrected: October 20, 2026

Thanks for using fxfeed.io for exchange-rate data and currency conversions and
entrusting us with your account information. Holding onto your private information is a serious
responsibility, and we want you to know how we're handling it.

The short version

We collect your information only with your consent; we only collect the minimum
amount of personal information that is necessary to fulfill the purpose of your
interaction with us; we don't sell it to third parties; and we only use it as
this Privacy Statement describes.

Of course, the short version doesn't tell you everything, so please read on for
more details!

What information fxfeed.io collects and why

Information from website browsers

If you're just browsing the website, we collect the same basic information
that most websites collect. We use common internet technologies, such as cookies
and web server logs. This is stuff we collect from everybody, whether they have
an account or not.

The information we collect about all visitors to our website includes the
visitor’s browser type, language preference, referring site, additional websites
requested, and the date and time of each visitor request. We also collect
potentially personally-identifying information like Internet Protocol (IP)
addresses.

Why do we collect this?

We collect this information to better understand how our website visitors use
fxfeed.io, and to monitor and protect the security of the website.

Information from users with accounts

If you create an account, we require some basic information at the time of
account creation. You will create your own user name and password, and we will
ask you for a valid email account. You also have the option to give us more
information if you want to, and this may include "User Personal Information."

"User Personal Information" is any information about one of our users which
could, alone or together with other information, personally identify him or her.
Information such as a user name and password, an email address, a real name, and
a photograph are examples of “User Personal Information.”

User Personal Information does not include aggregated, non-personally
identifying information. We may use aggregated, non-personally identifying
information to operate, improve, and optimize our website and service.

Why do we collect this?

• We need your User Personal Information to create your account, and to provide
  the services you request.
• We use your User Personal Information, specifically your user name and email
  address, to identify you on fxfeed.io.
• We will use your email address to communicate with you, if you've said that's
  okay, and only for the reasons you’ve said that’s okay. Please see our
  section on email communication for more
  information.
• We limit our use of your User Personal Information to the purposes listed in
  this Privacy Statement. If we need to use your User Personal Information for
  other purposes, we will ask your permission first.

ChatGPT, Codex, and other MCP connections

This policy also applies when you connect FxFeed to ChatGPT, Codex, or another
MCP client to look up exchange rates or convert currency amounts.

Information we receive. The client sends the selected tool's parameters,
such as currency codes, an amount, and an optional historical date, along with
authorization information needed to use your FxFeed account. The tools do not
request your full conversation, uploaded files, bank account details, payment
card details, or permission to transfer money or execute trades. Avoid including
personal information in a rate request.

Why we process it. We use these requests to return the rates or conversions
you ask for, enforce your account's access and request limits, record usage,
protect the service, and investigate errors. API usage records associate the
request with your organization and API-key identifier and include the endpoint,
currency/date/amount query parameters, time, response status, errors, request
and response sizes, and client software information. API keys are removed from
recorded query strings.

Connected-account authorization. When you approve an OAuth connection, we
store the client registration, your user and organization identifiers, granted
permissions, authorization dates, and credential-validation records. Token
signatures are stored as hashes rather than raw OAuth tokens. The connection
can read rates and perform conversions; it cannot change billing or team
settings. If you grant offline access, the client can renew access while its
authorization remains valid. An authorization has a maximum lifetime of 90
days and may end earlier if you revoke it or your account access changes.

Information returned to the client. We send the requested exchange-rate or
conversion result, its data date, and any relevant access or error information
to the client you connected. That client's handling of requests and results is
also governed by its own privacy policy, including OpenAI's policy when you use
ChatGPT or Codex. Our hosting and network service providers process requests as
needed to operate and secure FxFeed, as described elsewhere in this policy.

Disconnecting and deletion. You can revoke an authorization from your
FxFeed connected-app settings. Revocation stops further authorized calls but
does not itself delete your FxFeed account or existing usage and security
records. The retention and deletion provisions below apply to those records.
For access or deletion requests, contact [email protected]. No password, API
key, or OAuth token is needed in a support request.

What information fxfeed.io does not collect

We do not intentionally collect sensitive personal information, such as
social security numbers, genetic data, health information, or religious
information. Although fxfeed.io does not request or intentionally collect any
sensitive personal information, we realize that you might store this kind of
information in your account, such as in a an application. If you store any
sensitive personal information on our servers, you are consenting to our storage
of that information on our servers, which are in Europe.

We do not intentionally collect information that is stored in your
applications or other free-form content inputs. Information in your
applications belongs to you, and you are responsible for it, as well as for
making sure that your content complies with our
Terms of Service. fxfeed.io employees do not access
applications unless required to for security or maintenance, or for support
reasons, with the consent of the application owner.

If you're a child under the age of 13, you may not have an account on
fxfeed.io. fxfeed.io does not knowingly collect information from or direct any
of our content specifically to children under 13. If we learn or have reason to
suspect that you are a user who is under the age of 13, we will unfortunately
have to close your account. We don't want to discourage you from learning to
code, but those are the rules. Please see our
Terms of Service for information about account
termination.

How we share the information we collect

We do not share, sell, rent, or trade User Personal Information with third
parties for their commercial purposes.

We do not disclose User Personal Information outside fxfeed.io, except in the
situations listed in this section or in the section below on
Compelled Disclosure.

We do share certain aggregated, non-personally identifying information with
others about how our users, collectively, use fxfeed.io, or how our users
respond to our other offerings, such as our conferences or events. For example,
we may compile statistics on the usage of HTTP content types across fxfeed.io.
However, we do not sell this information to advertisers or marketers.

We do not host advertising on fxfeed.io. We may occasionally embed content from
third party sites, such as YouTube, and that content may include ads. While we
try to minimize the amount of ads our embedded content contains, we can't always
control what third parties show.

We may share User Personal Information with your permission, so we can perform
services you have requested.

We may share User Personal Information with a limited number of third-party
vendors who process it on our behalf to provide or improve our service, and who
have agreed to privacy restrictions similar to our own Privacy Statement. Our
vendors perform services such as payment processing, customer support ticketing,
network data transmission, and other similar services.

We may share User Personal Information if we are involved in a merger, sale, or
acquisition. If any such change of ownership happens, we will ensure that it is
under terms that preserve the confidentiality of User Personal Information, and
we will notify you on our website or by email before any transfer of your User
Personal Information. The organization receiving any User Personal Information
will have to honor any promises we have made in our Privacy Statement or in our
Terms of Service.

Our use of cookies and tracking

Cookies

fxfeed.io uses cookies to make interactions with our service easy and
meaningful. We use cookies (and similar technologies, like HTML5 localStorage)
to keep you logged in, remember your preferences, and provide information for
future development of fxfeed.io.

A cookie is a small piece of text that our web server stores on your computer or
mobile device, which your browser sends to us when you return to our site.
Cookies do not necessarily identify you if you are merely visiting fxfeed.io;
however, a cookie may store a unique identifier for each logged in user. The
cookies fxfeed.io sets are essential for the operation of the website, or are
used for performance or functionality. By using our website, you agree that we
can place these types of cookies on your computer or device. If you disable your
browser or device’s ability to accept cookies, you will not be able to log in or
use fxfeed.io's signed-in services.

Website and acquisition analytics

We use our Umami installation at umami.parap.ly to understand website visits
and which pages help developers start using the API. Umami receives page and
interaction events from pages where analytics is enabled. Pages containing
account verification or password reset tokens do not load the tracker.

For signup attribution, we use a first-party cookie named fx_acquisition
that expires after 30 days. It remembers the first public landing-page path,
referring hostname, campaign labels and visit time. This attribution cookie
does not contain an email address, API key or unique visitor identifier. Do
not put personal information in campaign labels.

When you create an account, we associate this source information and the
country reported by Cloudflare with your new organization. We record signup,
verification, API key creation, first successful rates API use, and repeat use
to measure acquisition and onboarding. Attribution collection honors browser
Do Not Track and Global Privacy Control signals. Missing attribution remains
unknown; it does not prevent signup or API use.

The application's acquisition records are retained for up to one year and
are removed when the related account or organization is deleted. Milestone
events sent to Umami use an opaque organization identifier, with source and
country information, rather than your email address or API credentials.
Umami's analytics records are stored separately. Contact [email protected]
with questions or requests concerning those records.

Certain pages on our site may set other third party cookies. For example, we may
embed content, such as videos, from another site that sets a cookie. While we
try to minimize these third party cookies, we can’t always control what cookies
this third party content sets.

Tracking

"Do Not Track" is a privacy preference you can set in
your browser if you do not want online services to collect and share certain
kinds of information about your online activity from third party tracking
services. We use Umami and first-party acquisition tracking as described above.
Attribution collection honors browser Do Not Track and Global Privacy Control
signals. We do not track your browsing activity across other online services.

If you are interested in turning on your browser’s privacy and Do Not Track
settings, the Do Not Track website has browser-specific
instructions.

Please see our section on email communication to
learn about our use of pixel tags in marketing emails.

How fxfeed.io secures your information

fxfeed.io takes all measures reasonably necessary to protect User Personal
Information from unauthorized access, alteration, or destruction; maintain data
accuracy; and help ensure the appropriate use of User Personal Information. We
follow generally accepted industry standards to protect the personal information
submitted to us, both during transmission and once we receive it.

No method of transmission, or method of electronic storage, is 100% secure.
Therefore, we cannot guarantee its absolute security.

fxfeed.io's global privacy practices

Information that we collect will be stored and processed in Europe
in accordance with this Privacy Statement. However, we understand that
we have users from different countries and regions with different privacy
expectations, and we try to meet those needs.

We provide the same standard of privacy protection to all our users around the
world, regardless of their country of origin or location, and we are proud of
the levels of notice, choice, accountability, security, data integrity, access,
and recourse we provide. We have appointed a Privacy Counsel and we work hard to
comply with the applicable data privacy laws wherever we do business.
Additionally, we require that if our vendors or affiliates have access to User
Personal Information, they must comply with our privacy policies and with
applicable data privacy laws, including signing data transfer agreements such as
Standard Contractual Clause agreements.

In particular:

• fxfeed.io provides clear methods of unambiguous, informed consent at the time
  of data collection, when we do collect your personal data.
• We collect only the minimum amount of personal data necessary, unless you
  choose to provide more. We encourage you to only give us the amount of data
  you are comfortable sharing.
• We offer you simple methods of accessing, correcting, or deleting the data we
  have collected.
• We provide our users notice, choice, accountability, security, and access, and
  we limit the purpose for processing. We also provide our users a method of
  recourse and enforcement. These are the Privacy Shield Principles, but they
  are also just good practices.

Resolving Complaints

If you have concerns about the way fxfeed.io is handling your User Personal
Information, please let us know immediately. We want to help. You may email us
directly at [email protected] with the subject line "Privacy Concerns." We will
respond within 45 days at the latest.

How we respond to compelled disclosure

fxfeed.io may disclose personally-identifying information or other information
we collect about you to law enforcement in response to a valid subpoena, court
order, warrant, or similar government order, or when we believe in good faith
that disclosure is reasonably necessary to protect our property or rights, or
those of third parties or the public at large.

In complying with court orders and similar legal processes, fxfeed.io strives
for transparency. When permitted, we will make a reasonable effort to notify
users of any disclosure of their information, unless we are prohibited by law or
court order from doing so, or in rare, exigent circumstances.

How you can access and control the information we collect

If you're already a fxfeed.io user, you may access, update, alter, or delete
your basic user profile information by contacting [email protected].

Data Retention and Deletion

fxfeed.io will retain User Personal Information for as long as your account is
active or as needed to provide you services.

We may retain certain User Personal Information indefinitely, unless you delete
it or request its deletion. For example, we don’t automatically delete inactive
user accounts, so unless you choose to delete your account, we will retain your
account information indefinitely.

If you would like to cancel your account or delete your User Personal
Information, you may do so by emailing [email protected]. We will retain and use
your information as necessary to comply with our legal obligations, resolve
disputes, and enforce our agreements, but barring legal requirements, we will
delete your full profile (within reason) within 30 days.

How we communicate with you

We will use your email address to communicate with you, if you've said that's
okay, and only for the reasons you’ve said that’s okay. You have a lot of
control over how your email address is used and shared on and through fxfeed.io.

Depending on your email settings, fxfeed.io may occasionally send notification
emails about new features, requests for feedback, important policy changes, or
offer customer support. We also send marketing emails, but only with your
consent. There's an unsubscribe link located at the bottom of each of the emails
we send you.

Our emails might contain a pixel tag, which is a small, clear image that can
tell us whether or not you have opened an email and what your IP address is. We
use this pixel tag to make our email more effective for you and to make sure
we’re not sending you unwanted email. If you prefer not to receive pixel tags,
please opt out of marketing emails.

Changes to our Privacy Statement

Although most changes are likely to be minor, fxfeed.io may change our Privacy
Statement from time to time. We will provide notification to Users of material
changes to this Privacy Statement through our Website at least 30 days prior to
the change taking effect by posting a notice on our home page or sending email
to the email address specified in your fxfeed.io primary account. For changes to
this Privacy Statement that do not affect your rights, we encourage visitors to
check this page frequently.

Contacting fxfeed.io

Questions regarding fxfeed.io's Privacy Statement or information practices
should be directed to [email protected].