AspiXR Privacy Policy
Effective date: 18 July 2026
Last updated: 18 July 2026
This Privacy Policy explains how XRY Ltd handles personal data in connection with the AspiXR iPhone and iPad application, the AspiXR website, and support communications (together, the Services).
1. Who we are
XRY Ltd is the controller of personal data described in this Policy.
- Company: XRY Ltd
- Company number: 16932214
- Registered in: England and Wales
- Privacy contact: privacy@aspixr.com
- Support contact: support@aspixr.com
TopstepX, Rithmic, Apple, Discord, your prop firm, broker, or trading firm may separately process your data under their own privacy terms. XRY Ltd does not control those independent services.
2. Local-first design
AspiXR is designed so that trading-provider credentials, account information, market data, positions, orders, executions, chart data, and trading settings are processed on your device for the functions you request.
TopstepX and Rithmic credentials and authentication tokens are stored locally on your iOS device using Apple Keychain. They are not stored on an XRY Ltd-operated remote server.
When you connect to a supported provider, the app is designed to communicate from your device directly with that provider's services. XRY Ltd does not currently operate a remote credential store, account-data service, or order-routing server for AspiXR, and your provider credentials and trading data are not intended to pass through an XRY Ltd-operated remote server.
This does not mean that no personal data is processed or collected in connection with the Services. Data is processed locally on your device, providers receive data necessary to provide their services, and XRY Ltd may receive limited data through support, Apple, and the website as described below.
3. Personal data we handle
A. Data processed locally in the app
Depending on the features you use, the app may process and store locally:
- provider credentials and authentication tokens;
- provider account identifiers and account configuration;
- balances, account status, positions, working orders, order history, and executions;
- instruments, prices, market data, and chart history;
- order settings, quantities, brackets, stop-losses, profit targets, copy-trading selections, and risk settings;
- chart drawings, selected symbols, timeframes, and interface preferences;
- a local consent receipt containing a random installation identifier, accepted legal-document versions and hashes, acceptance timestamp, app version/build, and acceptance types;
- locally cached data needed for performance and continuity; and
- local diagnostic events and technical state used to troubleshoot the app.
Local diagnostics can include timestamps and uptime, active screen and interface state, quotes and recent chart data, Provider status, account identifiers, balances and risk/RMS values, order and position identifiers, instruments, prices, quantities, P&L, errors, request metadata, bridge calls, lifecycle events, timing information, and Rithmic session metadata such as unique_user_id.
XRY Ltd does not receive this locally processed information merely because you use the app. Information is received by XRY Ltd only if another flow described in this Policy applies, such as when you deliberately send a diagnostic export or screenshot to support.
B. Data sent to trading providers
The app sends the credentials, connection requests, account requests, market-data requests, and order instructions necessary to the TopstepX or Rithmic service selected by you. Those providers, and any connected prop firm, broker, or trading firm, process that information under their own terms and privacy policies.
C. Support and community data
If you contact us by email, through the official Discord community, or another support channel, we may receive:
- your name, username, email address, and contact details;
- the content of your messages and our responses;
- screenshots, screen recordings, and diagnostic logs you choose to provide, which may contain Provider/account/order identifiers, positions, balances, P&L, prices, quantities, risk values, technical events, and other trading context;
- device, app-version, operating-system, provider, account-state, and order-related details contained in those materials; and
- information needed to investigate a technical, safety, billing, or legal issue.
Please redact credentials, authentication tokens, financial documents, and unrelated personal information before sending materials. We will never ask you to send your provider password through Discord or ordinary email.
D. Apple and App Store data
Apple processes app downloads, subscriptions, payments, trial eligibility, refunds, and certain App Store analytics. XRY Ltd may receive limited information made available to developers through App Store Connect, such as subscription status, transaction or product information, country or region, aggregated usage metrics, crash or performance reports, and information you submit in an App Store support or refund context. XRY Ltd does not receive your full payment-card details from Apple.
E. Website data
The current website does not offer user registration or an AspiXR account. The web-hosting provider may nevertheless process ordinary server and security logs, which can include IP address, date and time, requested page, referrer, browser, operating system, device information, and error or security events.
The website does not currently use Google Analytics or advertising cookies. If XRY Ltd later introduces Google Analytics or another non-essential analytics service, this Policy and the cookie information will be updated before activation, and consent will be requested where required.
4. How and why we use data
Where UK data-protection law applies, we use personal data for the following purposes and lawful bases:
| Purpose | Data | Lawful basis |
|---|---|---|
| Provide app functionality requested by you | Locally processed provider, account, market, order, and settings data | Performance of our contract; steps taken at your request |
| Connect your device to your selected provider | Credentials, tokens, provider requests, and order instructions | Performance of our contract; steps taken at your request |
| Record Terms and risk acceptance locally and require it before Provider connection | Installation identifier, document versions/hashes, timestamp, app version/build, and acceptance types | Performance of our contract; legitimate interests in demonstrating informed acceptance and managing legal risk |
| Administer subscriptions and entitlement | App Store product, transaction, entitlement, and related support data | Performance of our contract; legal obligations |
| Respond to support requests and investigate defects | Contact details, messages, screenshots, diagnostics, and relevant trading context | Performance of our contract; legitimate interests in support, security, and product reliability |
| Protect the Services and enforce the Terms | Technical, security, support, and incident information | Legitimate interests; legal obligations |
| Improve the app using feedback and voluntarily supplied diagnostics | Feedback, support content, and diagnostic material | Legitimate interests in improving the Services; consent where required |
| Maintain legal and accounting records and handle disputes | Transaction, support, incident, and correspondence records | Legal obligations; establishment, exercise, or defence of legal claims |
| Operate and secure the website | Access, error, and security logs | Legitimate interests in availability, security, and abuse prevention |
Where we rely on legitimate interests, we consider the necessity and impact of the processing and your rights. Where consent is required, you may withdraw it at any time, although withdrawal does not affect earlier lawful processing.
5. Data disclosures
We may disclose relevant personal data to:
- TopstepX, Rithmic, and connected trading firms, at your direction and as required to connect and use their services;
- Apple, for App Store distribution, subscriptions, payments, trial administration, refunds, app analytics, and platform support;
- Discord, if you choose to use the official community or support channel;
- our website and email providers, to deliver and secure those services;
- professional advisers, including lawyers, accountants, auditors, and insurers, where necessary;
- regulators, courts, law enforcement, or public authorities, where disclosure is required or legally justified; and
- a purchaser, investor, or successor, in connection with a genuine corporate transaction, subject to appropriate confidentiality and data-protection measures.
We do not sell personal data. We do not use provider account or trading data to provide personalised investment advice or make trading decisions on your behalf. We do not disclose personal data for third-party behavioural advertising.
6. International transfers
Some providers, including Apple, Discord, trading providers, web hosts, or email providers, may process personal data outside the United Kingdom. Where XRY Ltd is responsible for such a transfer, we will use an available lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another permitted safeguard.
TopstepX, Rithmic, and your connected trading firm may make their own international transfers as independent controllers. Review their privacy terms for details.
7. Retention
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including applicable legal, accounting, security, and dispute requirements.
- Ordinary app data stored locally remains on the device until it is removed through an available in-app control, device storage management, or app deletion, subject to Apple's backup and restoration behaviour. TopstepX and Rithmic credentials and authentication tokens are stored separately in Apple Keychain and follow the same storage and deletion behaviour. Using the relevant supported logout or “Forget” control deletes the corresponding Keychain items. Deleting the app itself may not delete Keychain items, and those items may remain available if the app is reinstalled on the same device. Credentials for both providers are configured not to migrate to another device through backup restoration.
- The local consent receipt remains on the device until removed through the applicable app-data deletion process. If no valid receipt exists, or the legal documents materially change, AspiXR requires renewed acceptance before a new Provider connection.
- Routine support correspondence, screenshots, and diagnostic material will normally be deleted or de-identified within 24 months after the support matter is closed, unless a shorter period is practical or a longer period is reasonably required for security, a dispute, legal compliance, or legal claims.
- Records relevant to a reported order incident or legal dispute may be retained until the issue and applicable legal limitation periods have expired.
- Subscription and transaction records available through Apple are retained in accordance with Apple's systems and any legal record-keeping duties that apply to XRY Ltd.
- Website access and security logs controlled by XRY Ltd are normally retained for up to 30 days. The hosting provider may retain certain infrastructure, security, or backup records for its own documented retention periods.
We may retain anonymous or aggregated information that can no longer identify you.
8. Security
We use technical and organisational measures intended to protect personal data, including local iOS security facilities for credentials and access controls for company records. No device, application, network, or storage method can be guaranteed completely secure.
You are responsible for securing your device, passcode, Apple Account, provider credentials, email, and Discord account. Do not share provider credentials with XRY Ltd or another person. If you believe credentials have been exposed, contact the relevant provider immediately and change or revoke them using the provider's procedures.
9. Your data-protection rights
Depending on the law that applies, you may have rights to:
- be informed about processing;
- request access to your personal data;
- correct inaccurate or incomplete data;
- request deletion;
- restrict processing;
- object to processing based on legitimate interests;
- receive certain data in a portable form;
- withdraw consent where processing is based on consent; and
- complain to a data-protection authority.
These rights are not absolute and may not apply to data controlled independently by Apple, Discord, TopstepX, Rithmic, or a connected trading firm. XRY Ltd also cannot retrieve information that exists only on your device and has never been sent to us.
To exercise your data-protection rights concerning personal data controlled by XRY Ltd, contact privacy@aspixr.com. We may request information reasonably necessary to verify your identity. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority. Information about making a complaint is available at ico.org.uk. Where applicable, you may also complain to the data-protection authority in the country where you live or work, or where you believe an infringement occurred.
10. Children
The Services are for adults aged 18 or over. We do not knowingly offer the Services to children or knowingly collect their personal data. If you believe a child has provided data to XRY Ltd, contact us so that we can investigate and delete it where appropriate.
11. Policy changes
We may update this Policy when the Services, providers, data flows, or legal requirements change. The current version will be made available in the app and on the website. Material changes may also be notified in the app, through an App Store update, or through the official Discord community. Where required, we will request consent or renewed acknowledgement.
12. Contact
Questions or requests concerning this Policy may be sent to:
XRY Ltd
Privacy: privacy@aspixr.com
Support: support@aspixr.com