Privacy Policy

1. What we collect & why

We collect only what's needed to run your trading journal:

• Email + display name — the only personal identifiers we hold. Used to log you back in and address you in the app.
• Your password is never stored or visible to us. Supabase Auth one-way-hashes it the moment you submit it. The plaintext leaves your browser only over TLS, is hashed, and discarded. Nobody at TradeJournal — admins included — can read, recover, or send you your password. Forgot it? Use “Reset password”.
• Trading data — trades, notes, screenshots, setups, rules, and journal entries you create or import. Scoped by Row-Level Security so even admins can't query other users' trades.
• Broker credentials — IBKR Flex Token + Query ID, only if you set up auto-sync. Only used to fetch your own statements; admins cannot see your token.
• Brokers connected through SnapTrade (Schwab, TradeStation, Alpaca and others) — you sign in on SnapTrade's page, never ours, and grant read-only access; SnapTrade Inc. (Toronto, Canada) then passes your transactions to us when you sync. We store only SnapTrade's user id and secret for your account, server-side; Disconnect deletes them and your registration at SnapTrade.
• Sync diagnostics — for each broker sync or file import: the broker, whether it worked, how many rows it read and inserted, and the error message if it failed. Never a symbol, a price or a P&L. It shows the administrator which broker connection fails, so it can be fixed. If you press Report a problem, your message and, if you leave it ticked, the sync log of that session are sent to us.
• Ask AI — when you ask the assistant a question, the question and the figures of your journal it needs to answer (summaries and the trades it looks at) are sent to Anthropic, which runs the Claude model, through our server; your API conversations are not used to train their models under Anthropic's commercial terms. Your conversations are saved in your account, readable by you only; the administrator sees how many questions are asked, never what they say. You can delete a conversation at any time.
• Session cookies — to keep you signed in across reloads. No third-party tracking.
• Service-quality activity counts — timestamps already attached to your own trades and notes (e.g. “trade saved at 14:22”) are read in aggregate from a private admin dashboard to monitor how the app is used. The admin sees counts and timestamps, never the contents of your trades or notes. No third-party analytics service receives any of this.

We do not sell, share, or rent your data. No Google Analytics, no Facebook Pixel, no tracking pixels of any kind.

2. Where it's stored

Your data lives in a Supabase Postgres database (operated by Supabase Inc., GDPR Article 28 compliant). Row-Level Security ensures each row is only readable by the account that owns it. Data is encrypted in transit (TLS) and backups are encrypted at rest.

The application is hosted at tradejournal.ch. No data leaves Supabase's infrastructure for processing.

3. Cookies & local storage

• One session cookie set by Supabase Auth so you stay signed in — strictly necessary, so no consent banner is required for it under ePrivacy/GDPR.
• Browser localStorage caches your trades for offline reads and stores UI preferences (theme, language, filters). It never leaves your browser unless you're signed in and syncing.
• Where you came from. If you reach the site through a link that names its source (for example ?src=reddit on an ad or a post), from a search engine, or through a friend's invite link (?ref=), your browser keeps that one word in localStorage for 60 days. It is sent only if you create an account, and then stored on your account as its sign-up source, so we can tell which channels bring members. No cookie, no third party, no profile of your browsing.

No tracking cookies, no ad cookies, no analytics or advertising pixels.

4. Your rights (GDPR / Swiss nFADP)

• Access & portability — download a JSON bundle of your data (in the app: Settings → Account → “Export my data”).
• Erasure — permanently delete your account and every trade, note, screenshot, and credential we hold (Settings → Account → “Delete my account”). Irreversible.
• Rectification — edit any trade or note directly in the app, or contact us to correct your email.
• Withdraw consent & restrict processing — disconnect broker auto-sync or sign out at any time.
• Lodge a complaint — in Switzerland with the FDPIC (edoeb.admin.ch); in the EU with your country's data protection authority.

5. Retention

We keep your data as long as your account exists. When you delete your account, your rows and Storage screenshots are removed within minutes; copies in encrypted backups are purged on the next cycle (≤30 days).

6. Security

Passwords are hashed, never stored. Sessions use refresh tokens with rotation. We recommend a unique password not reused on other sites.

7. Contact

For any privacy request — access, deletion, correction, complaint — email contact@tradejournal.ch. We respond within 30 days as required by GDPR.