ARVO GuardARVO Guard Privacy Policy
Last updated: 12 November 2026
1. Who we are
ARVO Guard is a Chrome extension provided free of charge by the individual who runs the Wealthminers trading community ("we", "us"). Wealthminers is a community name, not a registered company or legal entity. Privacy contact: cfcwork2026@gmail.com.
ARVO Guard is an independent tool. It is not made, endorsed, sponsored or operated by Bybit.
2. What ARVO Guard does
ARVO Guard adds a risk-management panel to Bybit's USDT perpetual trading page. It works out position sizes from the risk and stop-loss you choose, and sends orders to Bybit only when you press its buttons, using your own Bybit API key. Anyone can install it, but its trading features only work for people whose email address we have approved.
3. Information we collect and why
We collect only what we need to check that you are an approved user and to protect the licence system.
| Information | Where it is stored | Why we need it |
|---|---|---|
| Email address | Our licence database (Supabase) | Identifying your account and licence; sending sign-in codes |
| Account ID and sign-in session | Supabase Auth; the session token is also kept in your browser | Keeping you signed in |
| Licence record: status, plan, approval and expiry dates, administrator notes | Supabase | Deciding whether ARVO Guard may open trades for you |
| Device record: a random installation ID, your browser's public key, a short device name (for example "Chrome on Windows · added 8 Nov 2026"), first and last seen times | Supabase | One active computer per licence; stopping copied sign-ins |
| Shortened IP address: the first three parts only (for example 203.0.113) | Supabase (access log and device record) | Detecting shared licences and abuse |
| Access log: sign-ins, licence checks, device moves, refusals, security flags | Supabase | Security, abuse prevention and support |
| Extension version | Sent with each licence check; not stored | Refusing new trades from outdated versions |
| Sign-in code requests: email, time, outcome | Supabase | Limiting floods of code requests |
| Sign-in email: your address and the one-time code | Sent through Resend | Delivering your sign-in code |
| Security check: when the check is switched on, Cloudflare Turnstile runs a short check on our website before a sign-in code is sent. Cloudflare processes technical signals from your browser and your IP address to tell people from bots | Cloudflare (under Cloudflare's own privacy policy); we receive only a one-time pass/fail token, which is used once and not stored | Stopping automated abuse of the sign-in system |
Our service providers also keep their own technical logs, for example request times and full IP addresses in Supabase's and our website host's platform logs, under their own policies.
We do not collect:
- your Bybit API key or secret
- your Bybit balances, positions, orders or trade history
- your browsing history
- the content of web pages you visit
- analytics, advertising or tracking identifiers
4. Information that stays on your computer
The following is stored only in your browser profile and is never sent to us:
- Your Bybit API key and secret. They are kept in Chrome's extension storage, which only the extension's own pages and background worker can read; Bybit's web page cannot. They are used only to sign requests that go directly from your browser to Bybit.
- Panel settings: risk percentage, defaults, the Demo or Live choice, and the panel position.
- Records of recent ARVO orders: coin, side, size, time and order ID. These are kept for up to 24 hours to prevent duplicate orders.
- Record of orders ARVO sent: order ID, coin, side, account type (Demo/Live) and time, kept for up to 60 days so that "Cancel ARVO orders" only ever cancels orders ARVO itself placed.
- Auto-breakeven records: for positions opened by ARVO Guard: order ID, coin, side, the stop distance and the position size ARVO expects, so that automatic breakeven never touches a position it didn't open on its own.
- Device private key. Your browser creates it and marks it as non-extractable, so it cannot be read out or copied, not even by ARVO Guard.
Removing the extension from Chrome deletes this local data.
5. Service providers
| Provider | What it does for ARVO Guard | Location |
|---|---|---|
| Supabase (supabase.com) | Database, sign-in and licence server | Tokyo, Japan |
| Resend (resend.com) | Sends sign-in code emails | United States |
| Cloudflare (cloudflare.com) | Hosts this website (https://arvo-guard.pages.dev/) and runs the Turnstile security check on the sign-in page | Global network |
| Bybit | Your trading platform. Your browser talks to Bybit directly with your own API key; we receive nothing from these requests | Bybit's own terms and privacy policy apply |
We do not sell your information. We share it only with the providers above, so that they can run ARVO Guard for us, or where the law requires it.
6. Chrome Web Store Limited Use
ARVO Guard's use of information received from users complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. We use the information above only to provide and secure ARVO Guard's single purpose: licensed risk management for trading on Bybit. We never use or transfer it for advertising, for creditworthiness or lending decisions, or for any other unrelated purpose, and we never sell it. People do not read it except where needed for security, to comply with the law, or with your permission (for example, when you ask for support).
7. How long we keep it
| Data | How long we keep it |
|---|---|
| Routine licence-check records | Deleted automatically after 90 days |
| Sign-in code request records | 30 days |
| Temporary sign-in blocks | Removed 1 day after they expire |
| Account, licence and device records | While your account exists |
| Other security events (activations, moves, refusals, flags) | While your account exists. If your account is deleted, these events are kept without any link to your account; they are not deleted automatically |
8. Deleting your data
Email cfcwork2026@gmail.com from the address on your licence and ask us to delete your account. We will delete your sign-in account. Your licence and device records are deleted with it automatically, and security events are kept as described in section 7. We will confirm by email once it is done.
You can also sign out on the ARVO Guard licence page, remove your API key in Settings, or remove the extension from Chrome at any time.
9. Security
- All connections use HTTPS.
- The licence database cannot be read or changed from the extension; only our server functions can reach it.
- Licence passes are digitally signed and tied to your browser's device key.
- Sign-in uses one-time email codes.
No system is perfectly secure. ARVO Guard runs on your computer, so a person who controls your computer or modifies the extension can bypass its checks. Keep your computer and your Bybit API keys secure.
10. Your rights
You can ask to see, correct or delete the information we hold about you by writing to cfcwork2026@gmail.com. Depending on where you live, you may have further rights, for example under Australia's Privacy Act 1988 or the EU/UK GDPR.
11. Children
ARVO Guard is for adults trading on their own accounts. It is not meant for anyone under 18.
12. Changes to this policy
We will publish any changes on this page and update the date at the top. We will also mention significant changes in the extension.
13. Contact
cfcwork2026@gmail.com · https://arvo-guard.pages.dev/support/