Privacy policy

TradeProtocol is responsible for the processing of your personal data as described here (the "controller" under the General Data Protection Regulation, the GDPR).

• Account data: your email address, your name if you give it, and your password. Passwords are stored only as a secure hash by our authentication provider; we can never see them.
• Settings: your base currency, default risk per trade, breakeven zone, theme and display preferences.
• Your trading data: everything you enter in the app, such as trades, results, notes, tags, chart screenshots, trading accounts, prop-firm targets and rules.
• AI mentor conversations: the questions you ask, the answers and any screenshots you attach.
• Subscription data: your plan, its status and renewal date, and a customer reference from our payment provider. Your card details go directly to Stripe; we never receive or store them.
• Technical data: basic server logs such as IP address, browser type and the time of a request, which our hosting provider records to keep the service secure and working.

• To provide the service you signed up for: your account, journal, statistics, AI mentor and subscription. Legal basis: performance of our agreement with you (GDPR art. 6(1)(b)).
• To keep the service secure, prevent abuse and fix problems. Legal basis: our legitimate interest in a safe, working service (art. 6(1)(f)).
• To meet legal obligations, such as keeping payment records for tax purposes. Legal basis: legal obligation (art. 6(1)(c)).
• To email you about your account, such as confirming your address, resetting your password or important changes to the service. We don't send marketing emails without your consent.

We don't use your data for automated decisions that have legal or similarly significant effects on you.

The AI mentor only works when you use it. When you send a question, we send it to OpenAI together with the parts of your journal that are needed to answer it (such as your trades, statistics and tags) and any screenshots you attach. OpenAI generates the answer and sends it back to us.

Under OpenAI's terms for business use, data sent through their API is not used to train their models by default and may be kept for a limited time to detect abuse. Don't include information in your questions or screenshots that you don't want processed, such as account passwords.

We use a small number of service providers ("processors") that process data on our behalf and under our instructions:

• Supabase: database, login and file storage for your journal and screenshots.
• Vercel: hosting of the website and app.
• Stripe: payments and subscription management. Stripe is also independently responsible for some payment data, for example to prevent fraud.
• OpenAI: generating AI mentor answers, only when you use the mentor.

We don't sell your data and don't share it with advertisers. We only share data with others when the law requires it.

Some of these providers are based in the United States or may process data there. Where that happens, the transfer is protected by the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

We only use cookies that the app needs to work. We don't use advertising or tracking cookies.

• Login cookies keep you signed in securely.
• Preference cookies remember your theme and whether results show in R or P&L.

Because these are strictly necessary or remember a choice you made, we don't ask for cookie consent.

• Your account and journal data are kept for as long as you have an account.
• When you delete your account in Settings, your account, journal data and screenshots are deleted immediately. If you ask us by email instead, we do it within 30 days. Encrypted backups are overwritten in the normal backup cycle shortly after.
• Payment and invoice records are kept for 7 years, as Dutch tax law requires.
• Server logs are kept for a short period only, for security.

Data is sent over encrypted connections (HTTPS). Every user can only access their own journal: this is enforced in the database itself. Screenshots are stored in private storage, and secret keys are kept on the server only. No system is perfectly secure, but we take reasonable measures and will inform you and the authorities of a data breach when the law requires it.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have incorrect data corrected;
• have your data deleted;
• restrict or object to certain processing;
• receive your data in a commonly used format (data portability);
• withdraw consent you gave, at any time.

Send your request to tradeprotocol@outlook.com. We respond within one month. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the EU country where you live.

TradeProtocol is meant for adults. You must be at least 18 years old to create an account.

We may update this policy when the service or the law changes. The date at the top shows the latest version. We'll tell you by email or in the app about important changes. See also our terms of service.