Last updated: August 8, 2026
We collect the account information you provide when you sign up (email address and authentication data, handled via AWS Cognito), the API credentials you supply to connect your account on a supported cryptocurrency exchange (each, an "Exchange"), and the portfolio configuration you set (target allocations, tolerance bands, and related settings). We also retain trade and cost basis history needed to calculate rebalancing trades and tax-loss harvesting opportunities, billing information processed by Stripe (we do not store your card details), and standard technical/usage logs (e.g. request logs, error logs) used to operate and troubleshoot the Service.
We use this information to provide the rebalancing and tax-loss harvesting Service you configure, to authenticate your account, to process billing and manage your subscription, to send transactional emails (e.g. rebalance event notifications, trial and billing reminders), to respond to support requests, and to maintain and improve the Service's reliability and security.
Your Exchange API keys are encrypted at rest using AWS Secrets Manager. We request trade-only permissions and never request withdrawal access — our integration does not support withdrawal actions, so granting broader permissions than trade-only is unnecessary. Keys are used solely to execute the rebalancing and tax-loss harvesting trades you configure and to read account balances/history needed for those calculations. You can revoke Rebalance's access at any time directly from your Exchange account settings.
We share data only with the third-party processors necessary to operate the Service: AWS (hosting and infrastructure), Stripe (payment processing), and your connected Exchange (trade execution, only as directed by your configuration). We do not sell your data or share it with third parties for advertising or marketing purposes.
We retain your account and portfolio data for as long as your account is active. To request deletion of your account and associated data, email support@rebalancelab.com. We will delete your stored API credentials and account data within 30 days of a verified request, except where we are required to retain limited billing records for legal or accounting purposes.
Questions about this policy can be sent to support@rebalancelab.com.