Privacy Policy

Last updated: 2026-10-18

What we store

  • Account data — your email address; a hashed password (salted PBKDF2-SHA256 keyed with a server-side secret, never plaintext) or a Google identity reference; account dates.
  • Synced light data (only when you sign in and enable sync) — your backtest records (including embedded drawings, journal, tags), per-test drawings, your app/chart settings and watchlists, replay alerts, and small dataset metadata records. Candles and tick data never sync: they stay in your browser (or re-download from the public cloud data bucket).
  • Sessions — the devices you signed in from (up to 3), each identified by a keyed verifier, never the raw credential.
  • Audit log — basic auth events (signup/login/logout/reset/delete) with IP and user-agent for security. The IP address and user-agent are removed 90 days after the event by a daily job; the event itself (what happened, when, and which account) is kept, because that is the point of a security log. A refused sign-in from a suspended account is logged the same way, with no IP retained beyond that window.
  • Operator records — if our administrator suspends, bans or otherwise acts on an account, the console stores a reason and a short record of what changed. Notes and tags an operator adds about an account are deleted with that account. A banned address is stored only as a keyed one-way hash (never the address itself, and not reversible by us without trying the address), and it is kept after deletion by design — that is what stops a banned address from simply registering again. This is disclosed rather than claimed to be anonymous.
  • Trial marker — for anyone who ever uses a trial (phase 3): a peppered, pseudonymous hash of the email. It is not the email, is not reversible by us without the original address inputs, and survives account deletion. Hashing it does not make it non-personal, and we do not claim GDPR certification of this practice.
  • Support messages — a message sent from the public contact form (no account needed) is stored as a support ticket: the email address you typed, your message, and every reply in the thread. It is not attached to any account, is not used for anything but answering you, and the answer reaches you by email. Messages from inside the app are stored the same way, under your account.

Payments, plans and support

  • What — for each purchase: the invoice (network, the exact USDT amount, the receiving address we showed you, status and expiry), the payment we observed on the public blockchain (transaction id, amount, network, confirmations, and the administrator's decision if it needed a manual check), and the license it granted (start, end, days). Support tickets store the subject, every message in the thread and, if you chose one, the payment it is about. A small log records which reminder email (trial / plan ending) was sent when.
  • Why and on what basis — contract: to sell and deliver your plan, verify your payment and answer your tickets; legitimate interest: fraud prevention, bookkeeping and dispute handling.
  • We never see your wallet — we only read our own receiving addresses on public ledgers (TronGrid for TRON, a public BNB Smart Chain node). We never ask for or store a seed phrase or private key.
  • Blockchain transactions are public and permanent — anyone can see a transfer to our address on the chain, and nobody (including us) can erase it.
  • How long — payment records are separated from your identity the moment you delete your account (anonymized) and are deleted 5 years later; invoices, licenses and the reminder log are deleted with your account at the 30-day purge; support tickets are deleted one year after they are closed (a reply re-opens a ticket and restarts that clock).
  • Account balance — your balance, every movement of it (top-up, purchase, adjustment by our administrator with its note), each top-up request (network, address, the cents code, its 60-minute window) and each transfer you pasted or we matched (transaction id, the sending address as the blockchain shows it, amount, time, confirmations, the checks we ran and the administrator's decision). The balance itself is deleted with the account at the 30-day purge; the movement and transfer records are then separated from your identity and deleted 5 years later, like payment records.
  • Refunds — crypto payments and balance top-ups are final (see the Terms); a disputed payment is handled through a support ticket.
  • Promo codes — if you redeem one at checkout, the invoice records the code you used, the undiscounted price and the discount; the redemption (code, discount, status) is part of that invoice record and follows the same retention as the invoice. Codes are checked but never published on the pricing page.

Why we process it (legal basis)

  • Contract — providing the account and sync service you signed up for.
  • Legitimate interest — security (rate limiting, session/verifier checks, audit log) and preventing repeat trial abuse (the pseudonymous trial hash).
  • Consent — optional sync itself: nothing syncs until you sign in and confirm your first migration.

How long we keep it

  • Deleting your account revokes access immediately (sessions and tokens die at once). A hard purge of your synced data and account row runs 30 days after deletion — this grace window is a purge delay, never a way to restore your account.
  • When your trial or plan ends and no other plan follows, your synced data is deleted from our server 30 days later (the pricing page states the current period). Your account stays, and nothing on your own device is touched; buy a plan with sync before then and syncing carries on.
  • Backups: we do not keep separate backup copies yet. The only recovery layer is our database provider's short built-in point-in-time history (prior states of the database for a limited window). If we add backups later, this section will say how long they are kept before that starts.
  • The trial-consumed hash is permanent by design (prevents repeat trials) and is disclosed here. If you change your email, a trial already used stays used for the new address too. The banned-address hash works the same way and for the same reason.
  • IP addresses and browser strings in the security log are removed 90 days after the event; the events themselves stay. Operator notes and tags about an account are deleted with it at the 30-day purge.
  • What survives account deletion, and for how long: anonymized payment records (5 years), support tickets (one year after closing), the trial-consumed hash (permanent), and — only for the database provider's short point-in-time recovery window — earlier database states. Everything else of the account is purged 30 days after deletion.
  • Support tickets — from the public contact form or from inside the app — are kept while the thread is open and for one year after it is closed. A contact-form ticket is not part of an account, so deleting an account does not remove messages you sent without one; ask us and we delete those too.

Third parties

Cloudflare (Pages + Workers + KV), Neon (Postgres database), Resend (transactional email — verification, reset, deletion confirmations, license and plan reminders; never marketing), Google (optional sign-in identity), TronGrid and a public BNB Smart Chain node (read-only lookups of OUR receiving addresses — no personal data is sent to them).

Cookies, browser storage and error monitoring (§8.3 inventory)

  • Cookies — the sign-in session cookie (fx_session, HttpOnly, Secure, SameSite=Lax), and during a Google sign-in only, a short-lived (15-minute) cookie that ties the sign-in to your browser (fx_oauth_bind). There are no tracking, advertising or analytics cookies.
  • Browser storage (this device) — IndexedDB holds your datasets/candles, tests, journals, drawings and app databases; localStorage holds UI preferences (theme, layout, favorites, tool styles, dismissed notices, onboarding state). All of it stays on your device; clearing site data removes it.
  • Error monitoring — when enabled, Sentry (cloud) receives crash reports from the app: the release, and the file/line locations of the failing code. Error message text is removed before sending, and no cookie, advertising identifier, account data or candle/tick data is attached. It is diagnostic-only, never used for analytics or profiling.
  • Web analytics — Cloudflare Web Analytics (aggregate, cookieless): the pages served from this site record page views with no cookies, no per-person identifiers and no cross-site tracking; the beacon runs from Cloudflare's own script origin and sends counts (visits, page views, referrer host, device/browser type, performance) to Cloudflare as the processor. Your account's support tickets, payments and synced data are NOT part of it, and per-person bounce/exit is not available.

Your rights

You can download a full machine-readable JSON export of your synced data and account metadata from the account menu (Export data), delete sessions from the same menu, and delete your account from it too. Requests via support also work. We answer GDPR requests within the statutory window.

Sync scope honesty

Everything works locally without an account. With an account, only the light-data categories listed above transmit; candles and execution stay on your device.

Contact

Use the contact form — data-protection requests too. We answer by email to the address you enter.