FX CURIO is an analysis platform. We never hold your money, never connect to your broker, and never see your payment card. This page documents exactly what that means in practice.
No access to your money — by design
The most important security property of FX CURIO is architectural: there is nothing to steal that touches your trading capital.
FX CURIO never connects to a broker, exchange, or trading account. There is no API-key upload, no account linkage, no trade execution.
We never hold, transfer, or manage client funds at any point.
Your watchlists, journal entries, and analyses are the only data you store with us — never deposits, balances, or positions at a broker.
Encrypted connections
All traffic between your browser and FX CURIO is encrypted in transit.
The entire platform is served exclusively over HTTPS (TLS).
This applies to the website, the application, and all API endpoints.
Account security
Authentication is handled by a managed auth service rather than our own implementation.
Passwords are never stored in plain text — they are stored only as cryptographic hashes by the managed authentication provider.
Sign-in is available via email/password and Google OAuth. With Google sign-in we never see your Google password.
Password resets happen exclusively through signed, time-limited email links.
Your session is tied to your browser via secure tokens and can be ended at any time by signing out.
Isolated user data
Your data is separated from other users at the database level, not just in application code.
Every user-facing table enforces row-level security (RLS): each account can only read and write its own rows, enforced by the database itself.
Your journal, watchlists, prop-firm challenges, and settings are invisible to other users.
Public content (knowledge base, track record) is strictly separated from personal account data.
Payments via Stripe
Subscriptions are processed by Stripe, a PCI-DSS-certified payment provider.
Your card details are entered directly at Stripe — they never touch our servers or our database.
We only store your subscription status and a customer reference, never payment instrument data.
Cancellation, upgrades, and invoices run through Stripe's infrastructure.
AI processing
Analyses are generated by Curio AI, our proprietary analysis layer.
Chart screenshots you upload are used to produce your analysis. Do not upload screenshots containing personal information, account numbers, or balances.
AI-generated content is market analysis, not financial advice — see the methodology page for what the engine can and cannot do.
What we deliberately do not do
No broker or exchange linkage
There is intentionally no feature to connect trading accounts. This removes the largest attack surface a trading tool can have.
No sale of personal data
We do not sell or rent personal data to third parties. Data is used to operate the platform — nothing else.
No marketing trackers in the app
The authenticated application is built for work, not for ad-network profiling.
No exaggerated claims
We do not advertise certifications we do not hold. This page describes the actual measures in place — no more, no less.
Found a security issue?
If you believe you have found a vulnerability in FX CURIO, please report it via our contact form with the topic "Technical problem". We take every report seriously and investigate it before any public disclosure.