Privacy Policy
Last updated 2026-10-31
This explains what Trading Journal (the "service") stores about you, why, who else handles it, and how you control it. The short version: your journal is private, it is never sold, and you can export or delete it yourself at any time.
What is stored
- Account: your username, display name and a salted, one-way hash of your password (never the password itself). If you turn them on: an optional recovery email address (also given if you tick "Email me a weekly trading review" when creating your account — it's used only once you confirm it) and your two-step sign-in secret (stored encrypted).
- Your journal: trades, fills, imports, notes, reviews, screenshots, goals, prop-account settings and payouts that you enter or import, and broker sync tokens if you connect one (stored encrypted).
- Social features, if you use them: friend requests, messages and comments you write, and which accounts and trades you share with which friends. Messages you post in the Community chat, and cards you share there, are visible to everyone with an account until you delete them (shared cards show results only — never your notes, account names, balances or broker ids, and screenshots only if you include them). Reports you send about a message are seen only by the operator.
- Verified page: private — only you see it. If you verify a trading account, people you share that account with (and Community account cards) see "Verified", the broker's name and the date it was verified.
- Moderation: if the operator mutes or bans an account, the action, its reason and time are recorded.
- AI coach, if you opt in: your conversations with it.
- Security records: for each sign-in, the IP address and browser name (deleted when the 48-hour sign-in expires); short-lived counters keyed by IP address or username to stop password guessing and spam (deleted within about two days); and a log of security events on your account, such as password changes.
Why
Only to run the service for you: to sign you in, keep your account secure, store and calculate your journal, send the emails you ask for, and answer your AI coach questions. There are no ads, no tracking or analytics, and your data is never sold or used to train AI models by the operator.
Cookies
Only strictly necessary cookies: your sign-in (48 hours), a 10-minute cookie during two-step sign-in, and your visual-effects setting for this device. No advertising or tracking cookies.
Who else handles it
- Cloudflare hosts the service and its database, and keeps short-lived request logs (such as IP address and page requested) to operate and protect it.
- Google (Gemini), only if you use the AI coach: your question and the journal data needed to answer it are sent to Google to generate the reply. The coach uses Google's free tier, under which Google may use that content to improve its products. Don't use the coach if you're not comfortable with that.
- Google (Gmail), only if you add a recovery email: account emails (confirmations, password resets, security notices, and the weekly trading review if you turn it on) are sent through a Gmail account.
- Your broker, only if you connect one: the service fetches your trade history with the read-only token you provide.
Other people in the service see only what you choose: friends see your display name and username, and a friend you share an account or a trade with can view it (including its journal, notes and screenshots) and comment on it. Everyone who can view a trade sees all of its comments with each commenter's display name and username, so only comment what you're happy for them to read. The operator does not browse members' journals.
Your control
- Export everything at any time: Settings → Data → Export.
- Delete your account and everything in it at any time: Settings → Data → Delete account. Deleted data may remain in database backups for up to 30 days before it is gone for good.
- Correct your details in Settings; turn the AI coach off and withdraw consent on the AI Coach page.
Depending on where you live (for example under the GDPR or US state privacy laws) you may have further rights, such as to object or complain to a data-protection authority.
For any privacy question or request — including access, correction or deletion if you can't sign in — email alecio.trades@gmail.com. Requests are answered within 30 days; you may be asked to prove the account is yours.
Security
Connections are encrypted (HTTPS), passwords are hashed, sensitive tokens are encrypted, every journal is separated by account, and sign-in is rate-limited with optional two-step sign-in. No system is perfectly secure; if a breach affects your data you will be told as the law requires.
Age
The service is for adults (18+) and is not directed at children. Accounts found to belong to children are deleted.
Changes
This policy may be updated; the date at the top shows the latest version.