Privacy Policy

COT-Reports ("we", "us") operates COT-Reports.com, a free website that publishes the U.S. Commodity Futures Trading Commission (CFTC) Commitments of Traders reports along with related analytical tools and a live economic calendar. The site is operated by an individual; we do not have a physical office and we do not collect more data than we need to run the site.

Technical data on every visit: IP address, user agent, referring page, screen size, and locale preference. With your explicit consent, Google Analytics 4 records aggregated usage stats (pages viewed, session duration, approximate country derived from anonymised IP). With the same consent, Microsoft Clarity records how pages are used — clicks, scrolling and anonymised session replays — so we can find and fix confusing pages; anything typed into forms and all account pages are masked in the browser. When you create an account, we collect your email address and a salted-hash of your password (the password itself is never stored or transmitted to us in plain text — Supabase Auth handles authentication). While you are signed in, we also record the country you are visiting from, as reported by our hosting provider from your IP address at that moment; we store only the country, never the IP address. While you are signed in and the page is open, we also record the time you were last active on the site — a single timestamp, overwritten every few minutes, with no history and no IP address — so we can see how many people are using the site at that moment; it is deleted together with your account and included in your data export. Together with that time we also record the address of the page you are viewing (only the page's path, never anything you type), for the same purpose. When you subscribe to COT-Reports Premium, our payment processor Stripe handles your card details on its own infrastructure and we never see, store or transmit them; we receive and store a Stripe customer ID, subscription ID, billing period, status, and the timestamp of the next billing cycle. For a subscription we also keep, with the subscription at Stripe, the countries that decide which consumer law applies to it: your billing country, the country of your card or PayPal account, and the country the order was placed from (derived from your IP address at that moment; the address itself is not kept). We use them to determine whether the contract carries a statutory right of withdrawal. If your plan includes the How to Read the Simplified COT Report guide and you open the full guide while you can still withdraw from the subscription, we record that first opening: your account and email address, the subscription, the time, the price shown to you, the page language, a hash of your IP address and your browser's user agent. We use it to calculate, and to be able to prove, the refund if you withdraw, and we keep it for as long as we keep the records of that contract. When you open one of our payment pages (Premium or a marketplace product), we also note which plan or product it was for, when you opened it and whether the payment was completed, so we can see payments that did not go through and help if something went wrong. When you subscribe to the newsletter, release alerts (CFTC publication notifications), or the weekly extreme-positioning digest, we store your email address, locale, the source of the signup and a salted SHA-256 hash of your IP for anti-spam rate limiting. If you tick the optional cross-promo checkbox, we also record your consent so our sister product TradeLog can send you product updates — this is opt-in only and you can unsubscribe at any time from the link in every email. When you submit a contact form, we store your name, email, message, IP-hash and user-agent so we can reply and detect abuse. When you apply to sell on the Marketplace, we store, with your account and its email address, what the application form asks for: your name, brand or company, whether you built the product or represent its creator, your website, the support email for buyers, the country you live in, your city (optional), the country of your Stripe account, the details and screenshots of your product, the page language and a salted hash of your IP address. We use them to review your application, including comparing the countries you declare with the country you visit the site from while signed in; your applications and their screenshots are deleted together with your account. Once you are approved and set up your storefront, we also store the seller identity you enter there — your legal name, whether you sell as a trader or as a private person, your address, city, country, contact email, and your phone and company register number if you give them, and the links to your terms, licence and refund policy — and we publish it on each of your product pages, so buyers know who they buy from: for a trader with the full address (the law requires it), for a private person with only the city and country (the street address stays private and is shown to no one); your Stripe Payment Links and the price, currency and billing period we read from them; your restricted read-only Stripe key, stored encrypted and never shown again; the Stripe customer and card reference we use to charge the monthly commission invoice (Stripe keeps the card itself); and your monthly commission statements (sales base, refunds, disputes, commission and invoice status), kept as accounting records for as long as the law requires. When you submit an Ultima Markets bonus request, we store your name, email, country and (optional) UM account ID for processing — see §5.

Technical data operates and secures the site (rate limiting, abuse prevention, error diagnostics). Aggregated analytics tells us which pages are useful and where visitors get stuck. Account data lets you sign in and receive transactional emails (welcome, password reset, subscription receipts, account deletion confirmation). It also lets us send you the four short tips & offers emails of your first month described in section 12, unless you refused them at sign-up or unsubscribe. Subscription data lets us grant Premium access to the right account and renew or cancel billing through Stripe. Newsletter, release-alert and digest data lets us deliver the emails you opted into. Contact-form data lets us answer your message. We never sell personal data, we never use it for advertising profiles, and we do not engage in cross-site behavioural tracking. Stripe applies its own anti-fraud and tax-compliance processing on payment data — see Stripe's privacy policy at stripe.com/privacy for details.

Where EU data protection law applies (GDPR), our legal bases under Article 6 are: (a) Article 6(1)(f) legitimate interest — for security, abuse prevention, rate limiting, error diagnostics, site operation, and for sending existing customers our weekly COT recap and extreme positioning alerts under the 'soft opt-in' permitted by e-privacy law — the same basis covers the four tips & offers emails sent to free-account holders in their first month (section 12); (b) Article 6(1)(a) explicit consent — for optional analytics cookies, newsletter subscription, release alerts, the weekly extreme-positioning digest and the optional cross-promo checkbox; (c) Article 6(1)(b) performance of a contract — for account creation, Premium subscription processing, Marketplace purchases and the COT Data API service; (d) Article 6(1)(c) legal obligation — for VAT and tax record keeping where applicable, and for retaining payment records under accounting law. You can withdraw consent at any time via the cookie banner, your account settings, or the unsubscribe link in every email.

We share the minimum data needed with the vendors that run our infrastructure, each acting as a data processor under our instructions: Vercel (hosting), Supabase (database, authentication, file storage), Stripe (payment processing for Premium subscriptions and Marketplace purchases — Stripe is a controller for cardholder data and a processor for everything else, see stripe.com/privacy), Resend (transactional and digest email delivery), Google Analytics 4 and Microsoft Clarity (anonymised analytics, only after consent). We also use Sentry (error reports from the site and your browser — technical data only), Cloudflare Turnstile (the bot check on our forms), Groq and Google Gemini (they write the support chatbot's answers from the question you type) and Telegram (private alerts to our founder about orders and new accounts, which can include your email address). We also fetch public data from government agencies (CFTC, BLS, BEA, Federal Reserve, ECB, Eurostat, ONS, Bank of England) — these are one-way calls that do not share your data. When you submit an Ultima Markets bonus request through the Brokers section, the form data (name, email, country, UM account ID if provided) is sent to the Ultima Markets VIP Bonus Desk so they can process your upgrade — this is the entire purpose of that form, and Ultima Markets becomes a separate data controller from that point. Click and impression events on broker and prop-firm banners are stored in our own Supabase analytics tables in aggregated form, hashed by IP, and never shared with third parties. We never sell your data and we never share it for advertising or profiling.

Several of our processors are based in the United States — Vercel (hosting), Stripe (payments), Google (Analytics) and Resend (email infrastructure). Where personal data leaves the European Economic Area, we rely on GDPR Chapter V transfer mechanisms: the European Commission's Standard Contractual Clauses (SCCs, Decision 2021/914/EU) and the EU-U.S. Data Privacy Framework adequacy decision (Decision 2023/1795). Stripe, Google and Resend are certified under the EU-U.S. DPF; Vercel processes under SCCs and offers EU-region hosting which we use by default. Supabase processes our user and account data inside the EU (Frankfurt region). You can request the specific transfer mechanism applicable to your data for any of our vendors by emailing us. Sentry stores error reports in the EU (Germany). Groq, Google (Gemini), Cloudflare and Telegram may process data outside the EEA; where they do, the transfer relies on the safeguards they offer under GDPR Chapter V (Standard Contractual Clauses or the EU-U.S. Data Privacy Framework).

Server access logs are kept for up to 30 days for security purposes and then deleted. Analytics data is retained for up to 14 months. Any message you send to contact@cot-reports.com is kept only as long as needed to handle your request and is then archived or deleted. If you withdraw from a contract (the 14-day right) or are owed a refund after canceling an annual plan, we keep that record (your name, e-mail address, the contract and the date and time) for as long as needed to establish, exercise or defend the legal claim it concerns, also after you delete your account (GDPR art. 17(3)(b) and (e)), and then delete it.

You have the right to access, correct, delete or export your personal data, and to object to or restrict its processing. You can exercise these rights at any time by emailing contact@cot-reports.com. We will respond within 30 days. If you believe we have not handled your request properly, you have the right to lodge a complaint with your local data protection authority.

We use a minimal set of cookies: a session cookie to remember your language and theme preference, and optional Google Analytics and Microsoft Clarity cookies that only fire after you click Accept on our banner. Full details are in our Cookie Policy.

When you purchase the COT Data Dump or subscribe to the COT Data Spreadsheet, we store your order record (Stripe customer ID, subscription ID where applicable, product slug, amount, status, completed-at timestamp, and how many times you have re-downloaded the file). We do not store the archive itself in association with your account; the file in our private Storage bucket is delivered to you via short-lived signed URLs and is not personalized. When you subscribe to the COT Data API, we generate a bearer token, store its SHA-256 hash, the last four characters for UI identification, an optional label, the linked Stripe subscription ID, and per-request usage counters; the raw token itself is shown to you exactly once and never written to our servers. Every API request is logged with a salted SHA-256 hash of the originating IP, the user-agent, the referer, the endpoint, and the response status; raw IP addresses are never persisted. API request logs are retained for 7 days and then deleted by an automatic prune job. You can revoke any token at any time from /account/api; revocation hits the API on the very next request, with no grace period.

COT-Reports.com is intended for users aged 18 or over. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us with data, please contact us so we can remove it.

We send two optional email updates: a weekly COT recap and extreme positioning alerts. If you create a free account you receive them only if you opt in, via an unticked checkbox shown at sign-up. If you purchase a product or subscription, we may send you these same updates as a customer, as permitted by the 'soft opt-in' under applicable e-privacy law — we tell you so at the time of purchase. When you create a free account, we also send you four short emails in your first month (days 3, 7, 14 and 30) with tips on using the site and on our own Premium plan, likewise under the 'soft opt-in': you can refuse them with a checkbox at sign-up. Either way, every marketing email carries a one-click unsubscribe link, and you can turn these emails on or off anytime under Email alerts in your account settings. We never sell or share your email address.

When you use the support chatbot on the site, we store the conversation — the messages you send and the assistant's replies — so our team can review it and improve the support we provide. If you are signed in to an account, your account email address is stored together with the conversation; if you are not signed in, no email address is stored. If you choose to leave your email address in the chat yourself, we use it only to reply to that conversation, and it is deleted together with the conversation (at the latest 12 months after the last message). We never store your raw IP address, only a salted, irreversible hash of it. The lawful basis for this processing is our legitimate interest in operating and improving customer support. Conversations are automatically deleted 12 months after the last message, and they are deleted immediately if you delete your account. You can also ask us to delete a conversation sooner by emailing contact@cot-reports.com. Separately, each chatbot request leaves a short technical record — the hashed IP address, the language, the length of the message (not its text), the token counts and which AI provider answered — kept for 90 days to enforce usage limits, prevent abuse and monitor the service. To answer repeated questions faster, an answer may also be cached together with the text of the question (with no link to any account, email address or IP address) for up to 24 hours; it is deleted within 48 hours. If the assistant cannot answer and you send us a message through the form inside the chat (name, email address and message), it is handled exactly like a message sent through our contact form.

COT-Reports runs a Model Context Protocol (MCP) server, so an AI assistant such as Claude (Anthropic), ChatGPT (OpenAI) or Gemini (Google) can fetch COT data for you. What we record: a request made without signing in leaves nothing that identifies you — each tool call adds one row to a single shared counter of all requests without an account (no IP address, no identifier; deleted after 7 days), which caps their total, and short-lived counters in memory, keyed to a hashed IP address, only watch the volume; if a single address sends an abnormal volume of requests, our founder receives a private alert with the request count and a short fragment of the hashed address. A request made with your account or a Data API key leaves one technical record per request — your account or key ID, a salted, irreversible hash of your IP address, the service called and whether the request was allowed — used only to apply your plan's limits and prevent abuse, and deleted after 7 days. We do not store the questions you ask, the content of the request or the answers. Connecting an AI app to your account (OAuth): when you click Allow, we store the app's name and its return addresses, and a connection record — your account, the app, when it was created, when it was last used (updated at most every 5 minutes) and, if so, when it was disconnected. Authorization codes and access and refresh tokens are stored only as SHA-256 hashes, never in readable form; a code is valid for 5 minutes, an access token for 1 hour and a refresh token for 30 days (it is replaced each time it is used). Expired codes and tokens are deleted 24 hours after they expire, and an app that never completed a connection is deleted after 30 days. You can disconnect an app at any time from your account page; the connection is then marked as disconnected, stays in your account history (it is part of your data export) and is deleted together with your account. Who receives what: the answers you ask for are delivered to the AI app you connected — for example Anthropic, OpenAI or Google — which processes them under its own privacy policy, as a separate controller; we do not send them your account details. Links in the answers point to cot-reports.com pages; they carry only the campaign parameters utm_source=mcp and utm_medium=ai_assistant, which tell our analytics that a visit came from an AI assistant — nothing that identifies you or your account. The lawful basis is the performance of our contract with you (providing the service you connect to) and our legitimate interest in preventing abuse.

We may update this Privacy Policy from time to time, for example when we add a new tool or change a vendor. Significant changes are announced on this page and, where a change affects how we use the data of an active paid subscription, by e-mail to its holder. The "Last updated" date at the top of this page always reflects the current version.

COT-Reports.com is operated by Valentin Dima, Romania. Contact: contact@cot-reports.com. The operator is the trader for every purchase of a COT-Reports product or subscription on this site, and the controller of your personal data under the GDPR. Products that third-party sellers list in the Marketplace are not sold by the operator: each one is sold by the seller named on its product page.