Privacy Policy

Almost everything the app holds is something you typed into it yourself. There is no hidden collection, no tracking pixels and no advertising network.

Account details, needed to give you a login:

• Your email address.
• Your password, stored only as a salted hash by Supabase Auth. Nobody, including us, can read your password.
• A display name, used to greet you in the app. You choose it at signup and can change it in Settings.

Trading accounts you create inside the app:

• The account name, its type (live, paper or prop challenge), its starting balance and its currency.

Trade records, which is the bulk of what the app stores:

• Date, session, market, instrument, direction, setup and higher timeframe bias.
• Entry time and price, exit time and price, quantity, point value, stop loss, take profit, planned risk in currency and planned risk to reward ratio.
• Result in R, realised profit and loss, commission and fees, and maximum adverse and favourable excursion.
• A trade number and the time the record was created.

Psychology and review entries, which are the reason this app exists and are often the most personal thing in it:

• Confidence, execution quality and focus, each scored from 1 to 10.
• The emotions you tag on a trade, whether you followed your plan, the mistakes you tag, and whether your checklist was clean.
• A grade for the trade, plus free text notes and lessons.
• Weekly reviews: your best and worst trade of the week, your biggest lesson, your most common mistake, your biggest improvement and your focus for next week.
• Monthly reviews: your best and worst setup, your most common mistake and your lesson for the month.

Screenshots you choose to upload:

• Chart images attached to a trade, held in a private storage bucket. They are not public, they are not indexed by search engines, and they are reachable only through short lived signed links issued to you.

Preferences, so the app behaves the way you expect:

• Your timezone, used to work out which trading session a trade falls into.
• Your custom session windows, meaning the start and end times you define for each session.
• Your custom dropdown options for setups, mistakes, emotions, sessions, markets, higher timeframe bias and grades. A default set is created for you at signup and you can add your own.

Technical records created automatically:

• A session cookie that keeps you logged in. It is required for the app to work and is not used to track you anywhere else.
• Standard server logs kept by our hosting and database providers, which include IP addresses and request times and exist for security and reliability.

• No payment details. The app takes no payments.
• No broker credentials, API keys or connections to any brokerage account.
• No analytics, advertising or behavioural tracking, and no third party trackers of any kind.
• No contacts, location or device identifiers beyond what is in a normal web server log.

We use your data to run the journal for you and for nothing else. We do not sell it, rent it, share it for marketing, or use it to train machine learning models.

• To provide the service you asked for, which covers storing your trades, computing your statistics and showing you your own history. Legal basis: performance of a contract, GDPR Article 6(1)(b).
• To keep accounts secure and prevent abuse, which covers server logs and authentication records. Legal basis: legitimate interests, GDPR Article 6(1)(f).
• To meet legal obligations where one applies. Legal basis: GDPR Article 6(1)(c).

Your trading and psychology entries are not special category data under GDPR Article 9. We are aware they can still feel deeply personal, since they record how you felt and where you went wrong, so they are protected the same way as everything else here.

We use two service providers, both acting as processors on our instructions under GDPR Article 28. Neither is permitted to use your data for its own purposes.

• Supabase, which provides the database, authentication and file storage.
• Vercel, which hosts and serves the application.

Where a provider processes data outside the European Economic Area, that transfer relies on the European Commission's Standard Contractual Clauses. The specific hosting region for this project should be confirmed before launch and named here.

• Every table in the database has row level security enabled, with policies that scope every read and write to the account owner. One user cannot read another user's rows even if the application code were wrong.
• The screenshot bucket is private, and each file lives under a folder keyed to its owner. Access is granted only through signed links with a short lifetime.
• All traffic is served over HTTPS with HSTS, and the app sets a content security policy along with other protective headers.
• Passwords are hashed by Supabase Auth and are never stored or transmitted in readable form.
• New passwords are checked against known breach lists, and a minimum length is enforced on the server rather than only in the browser.

Your data stays for as long as your account exists. There is no automatic expiry, because a trading journal is only useful if the history stays intact.

When you delete your account, your trading accounts, trades, weekly and monthly reviews, settings, session windows, custom options and uploaded screenshots are removed permanently. The deletion is immediate and there is no recovery period. Backups held by our providers roll off on their own schedule, typically within 30 days.

There is no self-serve export yet, so if you want a copy of your data before deleting, or at any other time, email us and we will send it to you in a machine readable format.

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Correct anything inaccurate. Most of it you can edit directly in the app.
• Erase your data, which you can do yourself from Settings at any time.
• Restrict or object to processing.
• Receive your data in a portable, machine readable format.
• Withdraw consent where processing relies on consent.

To exercise a right that the app does not already let you perform yourself, email [CONTACT EMAIL]. We will respond within one month, as the GDPR requires.

If you think we have handled your data badly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or to the supervisory authority in the EU country where you live.

You need to be at least 16 to hold an account. We do not knowingly collect data from anyone younger. If you believe a child below that age has an account, contact us and we will remove it.

If this policy changes in a way that affects you, we will update the date at the top and tell you in the app before the change takes effect. Continuing to use the app after that means you accept the updated policy.

Questions about this policy or about your data go to [CONTACT EMAIL].