• Account: email address, name if you give one, sign-in method, plan / subscription status, AI credit balance, referral code.
• Your content: strategies (stored encrypted), imported indicators and Pine scripts, chart layouts, alerts and watchlists, scanner call records, paper-trading accounts.
• Trading journal: trades you enter, import (CSV) or sync from an exchange, including notes, emotions and checklists; exchange API keys you connect are stored encrypted and must be read-only.
• Notifications: Web Push subscriptions, push tokens of the mobile app, and Telegram chat id / bot token (encrypted) if you set up alerts; webhook URLs you add.
• Connections: OAuth clients, access and refresh tokens and personal access tokens for AI assistants you connect (only hashes of tokens are stored).
• Billing: handled by Stripe, Apple, Google and RevenueCat; we receive subscription status and identifiers, never your full card details.
• Usage and technical data: IP address, device / browser type, request logs, rate-limit counters, feature usage, feedback you send.
• Analytics: Vercel Web Analytics — aggregated page views without cookies or cross-site tracking.
• Some settings (e.g. layouts, local-only alerts) are kept only in your browser's local storage and never reach us.

• To provide the Service you signed up for — accounts, backtests, alerts, sync, subscriptions (performance of a contract).
• Security, abuse prevention, debugging and improving the Service (our legitimate interests).
• Billing records and tax (legal obligation).
• Marketing emails, if any (your consent, which you can withdraw at any time).

We do not sell your personal data and do not use it for automated decisions with legal effects on you.

When you use a cloud AI feature, the prompt and the relevant strategy, indicator, journal summary or market data are sent to the AI provider to produce the answer. When you connect your own assistant (e.g. Claude or ChatGPT) via OAuth or a personal token, that assistant can read and change the data its tools give access to; its provider handles what it receives under its own privacy policy. You can revoke any connection or token in Settings at any time.

• Supabase — database and sign-in emails.
• Vercel — hosting, server functions, logs and web analytics.
• Stripe — web payments.
• Apple App Store / Google Play and RevenueCat — in-app subscriptions.
• Expo (mobile push notifications), your browser's Web Push service, and Telegram if you use it.
• AI providers — Moonshot AI, Anthropic and OpenAI, only for the AI features you use.
• Market-data and news sources (e.g. Binance, Yahoo Finance, Hyperliquid, CoinGecko, CoinMarketCap, Deribit, Brave Search, Forex Factory): we send them symbol and time queries, not your identity.
• Exchanges you connect for journal sync (with your read-only key).
• Authorities, where the law requires it.

Some processors are outside the EU/EEA (for example in the United States). Such transfers rely on an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.

• Account data and your content: while your account exists.
• Server logs and rate-limit records: up to 30 days.
• Billing records: 7 years, as Dutch tax law requires.
• Backups: overwritten on their normal cycle after deletion.
• Aggregated market recordings (exchange-wide funding, open interest, public leaderboard positions) contain no account data and are kept up to two years.

You can delete your account in the app or on the website (Settings). This removes your profile, strategies, indicators, journal and synced trades, alerts, watchlists, scanner records, paper accounts, push tokens, connected exchange keys and AI connections / tokens. Billing records we must keep by law are retained, and copies in backups expire on their normal cycle. Deleting your account does not cancel an App Store / Google Play subscription — cancel it in the store.

Under the GDPR you have the right to access, correct, delete or export your data, to restrict or object to processing based on legitimate interests, and to withdraw consent at any time. Contact us through the feedback form in the app; we answer within one month. You can also complain to your data protection authority — in the Netherlands the Autoriteit Persoonsgegevens.

We use encryption in transit, encrypted storage of strategies and credentials, hashed tokens and access controls. No system is perfectly secure. The Service is not intended for anyone under 18. We will announce material changes to this policy in the Service or by email. See also our Terms of Service.