Privacy Policy

1. Overview

This page covers both the Trading Diary marketing site (the pages at trading-diary.co that describe the product and let you request live demo access) and the Trading Diary cloud application itself, once you have an account. It is run by the provider named in the Terms of Service, who is the controller of your personal data: [operator name, address and company ID — to be filled in].

It doesn't cover the desktop app running fully offline with no cloud account connected — in that mode, your data never leaves your computer, so none of this applies. It also doesn't fully cover third-party AI providers you may choose to connect yourself (for example an AI copilot feature) — that's described in-app, next to where you'd turn it on, since it only applies if you opt in.

2. What the marketing site collects

The marketing site asks for very little, because it does very little: right now, the only thing it collects outside of an actual account is what you give it through the "Try the live demo" and "Join the waitlist" forms.

• Your name and email address — required, so we can grant demo access or send an invite when one opens up.
• Marketing consent — an optional checkbox on that same form. Left unchecked by default; only checked if you check it yourself.
• Standard server request logs — the same technical logging (IP address, timestamp, requested page, user agent) any web server keeps for security and troubleshooting, kept only as long as needed for that purpose.

That's it for the marketing pages. They don't ask for a password, a payment method, or anything about your trading activity.

3. What your Trading Diary account collects

Once you have an account, the app stores what it needs to actually be a trading journal:

• Account basics — your email address, a securely hashed password (never the password itself), and when the account was created.
• Country — the country you give when you register (required). We need it to apply the right taxes and consumer rules to you.
• Phone number — optional. Only stored if you choose to enter it, and only used to contact you about your account or support. You can add, change or remove it on the Account page at any time.
• Subscription and billing — once paid plans exist: which plan you are on, billing country, and invoice records. Card details are entered with, and held by, our payment provider (see “Subprocessors”); we never see your full card number.
• Your trading data — everything you log yourself: trades, journal/reflection entries, notes, your playbook/strategy text, and any screenshots you attach to a trade or note.
• App settings — your preferences and configuration inside the app.
• Two-factor authentication status — whether you've turned on 2FA. The 2FA secret itself is stored encrypted on the server and is never included in a data export or shown back to you after setup.
• Devices and sign-in sessions — a record of devices/browsers connected to your account (so you can review and revoke them from the Account page), and the IP address of requests, used for rate-limiting abuse (like repeated failed logins) and for a security audit trail of sensitive account actions (password changes, 2FA changes, account deletion).

We don't collect anything about your trading beyond what you choose to type in or import yourself — no automatic connection to a broker or exchange reads or reports your activity to us.

4. How we use it

• Running the app itself — storing and showing you back your own trades, journal, and analytics.
• Taking payment and meeting tax and accounting obligations (invoices, VAT based on your country, records we are required by law to keep).
• Contacting you about your account: security notices, billing, changes to the terms, and replies to your support requests.
• Getting you into the live demo, or sending an invite once early-access spots open up.
• Sending you product updates or offers from the marketing site — only if you checked the consent box on the waitlist/demo form. If you didn't, we won't email you anything beyond the demo access or invite itself.
• Basic abuse prevention (rate-limiting logins and signups, rejecting automated spam submissions) and a security audit log of sensitive account actions.

Legal bases (GDPR Art. 6). Running your account and the app is performance of the contract with you. Billing records and tax data are kept to meet a legal obligation. Abuse prevention and the security audit log are our legitimate interest in keeping the service safe. Product emails from the marketing site, and anything else optional, rest on your consent, which you can withdraw at any time.

Nothing else. We don't build a marketing profile from this data, we don't analyze your trading data for any purpose other than showing it back to you inside the app, and we don't use it to personalize anything beyond what's described above.

5. What we don't do

• We don't sell or share your email address, or any of your trading data, with any third party, for any reason.
• Neither the marketing site nor the app runs third-party analytics, ad trackers, or tracking pixels of any kind — no external requests leave your browser for that purpose. See "Cookies" below for the full picture on cookies specifically.
• We don't share your in-app trade data with any third party beyond what's described in-app for opt-in features (like connecting your own AI provider account), and only when you've turned that on yourself.

6. Where your data is stored

The cloud application runs on a single server rented from netcup, a German hosting provider. (We haven't independently pinned down netcup's exact data-center location for this policy — please verify it directly with netcup before treating this as a legal representation of where data physically sits; netcup's own data centers are in Germany.)

The domain (trading-diary.co) and its DNS are managed through Cloudflare, and a small background feedback-inbox feature (the in-app "Send feedback" form) runs on Cloudflare Workers with Cloudflare KV storage — see "Subprocessors" below.

7. Cookies

The app sets a small number of first-party cookies needed to make it work — nothing more:

• Session cookie — keeps you signed in. Strictly necessary; without it, the app can't tell who you are.
• Demo-mode cookie — set only when you're using the public live demo, so the demo knows which sandbox account to show you.
• Admin impersonation cookie — set only for our own admin accounts during a support/troubleshooting session, never for regular users.

None of these are used for advertising, tracking across sites, or building a profile of you — they only carry a signed identifier the server needs to serve the right account. Because the only cookies in use are strictly necessary for the service to function, this site does not show a cookie consent banner; under GDPR/ePrivacy rules, consent isn't required for cookies that are essential to the service you asked for.

8. Data retention

If you join the waitlist or request a demo and never go on to create an account, we keep your name, email, and consent choice for up to 24 months from your last interaction with us (signing up, or a later update), after which it's deleted. If your waitlist signup converts into an actual account, your data from that point on is governed by the account itself, not this waitlist record.

Billing and invoice records are the exception to deletion: where tax or accounting law requires us to keep them, we keep only what the law requires, for as long as it requires, and then delete them.

For an actual account: your data is kept for as long as your account exists. If you delete your account yourself (Account page → "Delete my account"), your trades, journal, screenshots, notes, settings, and account record are removed from the live database and file storage immediately — the deletion isn't held in a pending queue you have to wait out. A safety copy is kept separately for 30 days afterwards (in case of an accidental deletion, or as evidence of what was deleted and when), and then permanently erased on the same automatic schedule as our regular backups.

9. Your rights

If you have an account, the fastest way to exercise most of these rights is directly in the app, on the Account page:

• Access / portability — the "Download my data" button on the Account page gives you a complete export of your account and trading data as a single file, on demand, any time.
• Erasure — the "Delete my account" button on the Account page permanently deletes your account and data (see "Data retention" above for exactly what that means and the 30-day safety-copy window).
• Rectification — most of your data (trades, journal, settings) is directly editable in the app, and your country and phone number can be changed on the Account page; for account-level details you can't edit yourself, email us.
• Objection and restriction — you can object to processing based on our legitimate interest, or ask us to restrict processing, by emailing us.
• Complaint — you can complain to the data protection authority in the country where you live or work. In the Czech Republic that is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz). We would appreciate the chance to fix the problem first.

For anything not covered by those two buttons — questions, corrections we haven't given you a self-service way to make, or requests about waitlist/demo data — email us; see "Contact for data requests" below. We'll confirm the request and act on it without unreasonable delay.

10. Subprocessors

We use a small number of outside services to run Trading Diary. None of them get access to your trading data beyond what's strictly needed to provide their piece of the infrastructure:

• netcup — hosts the server the application and your account data run on.
• Cloudflare — manages DNS/domain routing for trading-diary.co, and runs the small feedback-inbox feature (Cloudflare Workers + KV) behind the in-app "Send feedback" form.
• Payment provider [provider name — to be filled in] — processes subscription payments and issues receipts once paid plans open. It receives your email, billing country and payment details, and acts as an independent controller of the payment data it needs for fraud prevention and its own legal duties.

Some of these providers may process data outside the European Economic Area. Where they do, we rely on the transfer safeguards the GDPR provides for, such as the European Commission’s standard contractual clauses or an adequacy decision.

11. Contact for data requests

Email privacy@trading-diary.co for anything covered by "Your rights" above. For anything else — general questions about the product — the general contact address in the footer works just as well.

12. Changes to this policy

If this policy changes in a way that matters — what we collect, or how we use it — we'll update the "Last updated" date at the top of this page and, where practical, mention it prominently on the marketing site itself. We won't backdate a change to make it look like it was always the policy.