Privacy Policy

This Privacy Policy explains how CSignals Ltd ("we", "us", "our") collects, uses and protects your personal data. It covers the tradeloggr website and journaling app ("Service"). We are the controller of this data.

We comply with the UK GDPR and Data Protection Act 2018.

Account Information

We collect:

• Email address
• Name (display name)
• Password (encrypted)
• Subscription information (via Stripe)

We do not collect unnecessary personal data.

Trading Data

We collect user-generated trading information:

• Trades
• Entry and exit prices
• Risk settings
• Tradespaces
• Performance metrics
• Notes and images uploaded by users

This data is private by default. It can be shared via invitation or via private links with optional expiration.

Technical Data

We process technical data to run and protect the Service. With analytics consent, we also collect data for usage analysis. Technical data can include:

• IP address
• Browser information
• Device information
• Usage data

Vercel Web Analytics and Microsoft Clarity run only after analytics consent. They help us understand website use and improve the site. Clarity records interactions such as clicks, scrolling and session playback. You can withdraw analytics consent through Cookie settings in the footer.

Website Enquiries

When you use the contact form, we collect your name, email address, subject and message. Resend delivers them to our inbox so we can answer your enquiry and follow up.

We send your client IP address to Upstash to prevent abuse of the contact form. The limit is three messages per hour per IP address. These records include the IP address, time and rate-limit outcome and are kept for 90 days.

Our lawful basis is legitimate interests: answering enquiries and protecting the contact form from spam and abuse.

Signup Attribution

When you create an account, we record first-touch signup attribution to understand how people find tradeloggr and improve signup and onboarding. This includes UTM source, medium, campaign and content, selected language, a privacy-safe referring path, landing path and capture timestamp. We keep this acquisition metadata with your account.

For a direct email and password signup, the attribution is sent with the account-creation request even if you reject analytics cookies. In this case, we do not store it before account creation.

If signup involves an email or OAuth redirect, we may temporarily store the attribution in the first-party HttpOnly tradeloggr_acquisition cookie, but only if you consent to analytics cookies. It lasts no more than 7 days and is deleted after the attribution is saved to your account.

First-Party Product Analytics

In our own Supabase database, we record one-time, account-linked events for signup completion, tradespace creation, the first and fifth logged trades, a return on day 7, and a Pro upgrade. Each event includes your account's acquisition metadata. We also keep a private, increasing trade counter to identify the trade milestones.

We use these records to understand onboarding and product use and to improve the journaling service. Our legal basis is our legitimate interest in understanding and improving the service. These records are accessible only to our server service role. We do not send the lifecycle events to separate analytics providers.

Lifecycle events and the private trade counter are kept with your account, included in your account data export, and deleted when your account is deleted. You can request access, correction or deletion and object to this legitimate-interest processing by contacting us.

We use cookies for:

• Authentication sessions
• Affiliate tracking (60-day cookie)
• Analytics
• Optional signup-attribution redirect cookie (only with analytics-cookie consent)

We do not use cookies to serve targeted adverts or share data with advertising networks. The optional signup-attribution cookie helps us measure how people find the service.

Payments are handled by Stripe.

We do not store credit card details or payment credentials. Stripe processes payment information securely.

We send data from our servers to OpenAI to provide these journaling features. Each feature starts when you ask for it, except the weekly digest, which runs automatically every Sunday for paid users.

• Overview coach: summary statistics for your selected filters and statistics about following your strategy rules.
• Trade critique: the trade pair, direction, prices, size and profit or loss; your free-text journal note, mood, confidence, labels and mistake tags; and the strategy name and rules.
• Weekly digest: weekly statistics, top symbols, selected trade identifiers with their pairs and profit or loss, and previous review text.
• Q&A: your free-text question and relevant analytics, including statistics, symbols, recent trades, mistakes and drawdowns.
• Strategy architect: supporting statistics, mistake tag names and categories, and symbols.
• Screenshot import: the trade screenshot you upload, sent as an image.

Our lawful basis for this processing is performance of our contract with you: providing these features as part of the journaling service.

We also send AI prompts and outputs to Langfuse to monitor how the features work. These traces include token use, cost, your account identifier and tradespace identifier. Q&A traces include your question text. Our lawful basis is our legitimate interest in operating reliable AI features and monitoring their costs.

OpenAI states that API inputs and outputs are not used to train its models by default, unless a customer opts in. Its abuse-monitoring logs may contain prompts and responses. They are normally kept for up to 30 days. OpenAI may keep them longer where required by law or reasonably necessary to protect its services or others from harm. Images flagged as possible child sexual abuse material may be kept for manual review.

We use your data to:

• Provide the Service
• Manage subscriptions
• Improve product functionality
• Provide customer support
• Prevent fraud or abuse
• Comply with legal obligations

We use the following lawful bases for these purposes:

• Performance of our contract with you: creating your account, storing your journal, managing subscriptions, providing AI features and sending broadcasts to Discord when you connect them. This includes the automatic weekly digest for paid users.
• Legitimate interests: we answer enquiries and follow-up messages and prevent fraud and abuse, including through contact-form IP rate limiting. We monitor errors, performance and AI operation, and understand signup attribution and onboarding. Our interests are a secure, reliable service, helpful support, and improving the website and journaling app.
• Legal obligations: keeping required billing and tax records, handling data-protection requests and complaints, and responding to lawful requests from authorities.
• Consent: Vercel Web Analytics, Microsoft Clarity, optional affiliate tracking and the temporary signup-attribution redirect cookie. You can withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal.

We share personal data with these providers for the purposes listed:

• Stripe: payments and subscription administration.
• Supabase: account authentication, database and file storage, including journal data and saved AI outputs.
• Vercel: hosting and, only after analytics consent, Web Analytics.
• Resend: email delivery, including contact-form messages to our inbox.
• Upstash: Redis infrastructure and abuse rate limiting; QStash for scheduled jobs, including weekly digests.
• Microsoft Clarity: usage analysis and session playback, only after analytics consent.
• OpenAI: processing the AI feature inputs described above and generating outputs.
• Langfuse: AI monitoring, including prompts, outputs, usage, cost and account and tradespace identifiers.
• Sentry: error and performance monitoring, with your account identifier attached to events.
• Discord: posting broadcasts on your behalf when you connect a broadcast.

Providers may also process certain data for their own purposes under their privacy notices. We may disclose data where the law requires it. Sharing features also disclose the content you choose to share to the people or channels you select.

Exchange APIs

We use the following exchange APIs for live price data only:

• Binance
• MEXC
• Bybit
• OKX
• Bitget
• KuCoin
• Gate.io
• Kraken

These are used only for price data suggestions. No user data is shared with these providers.

We keep account and journal data while your account is active. This includes signup attribution, lifecycle events and the private trade counter. Deleting your account removes its associated records from our app database. You may request deletion at any time. Separate provider records and legally required records follow the periods or criteria below.

• Saved AI summaries, critiques, digests, answers and strategy blueprints are kept with your account. There is no fixed automatic deletion period for this history. Deleting your account or the linked tradespace deletes these records from our app database.
• Vercel Web Analytics reports cover up to 12 months on our Pro plan. This is a reporting window, not a deletion deadline. Vercel says it may store the data longer.
• Microsoft Clarity keeps session playback data for 30 days. Labeled, favorited and sampled recordings may be kept for up to nine months. Click and heatmap data are kept for nine months.
• Contact-form messages are kept only as long as needed to handle the enquiry and any follow-up.
• Upstash keeps contact-form IP addresses, with the time and rate-limit outcome, for 90 days for abuse prevention.
• We keep records required by law, such as billing and tax records, for the period the law requires.

Subject to the conditions and limits in data-protection law, you have the right to:

• Access your data
• Correct your data
• Delete your data
• Receive your data in a portable format
• Withdraw consent at any time, without affecting earlier lawful processing
• Restrict the processing of your data in certain circumstances
• Object to processing based on legitimate interests, including our signup attribution, product analytics and abuse-prevention processing

To exercise your rights, email legal@tradeloggr.app. You can also withdraw analytics consent through Cookie settings in the footer.

You can complain about how we use your personal data by emailing legal@tradeloggr.app or using our contact form. We will acknowledge your complaint within 30 days of receiving it. We will investigate and respond without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data-protection regulator. Visit the ICO complaints page or call 0303 123 1113.

We use encryption, HTTPS, secure authentication, and access control. We take reasonable measures to protect your data.

Our providers may process personal data outside the UK and European Economic Area (EEA), including in the United States. For transfers that need safeguards, the providers' published terms provide the following:

• Vercel: its Data Processing Addendum incorporates EU Standard Contractual Clauses (SCCs) and its UK international data transfer addendum (UK IDTA). Vercel Inc. also certifies under the UK Extension to the EU-US Data Privacy Framework.
• Stripe: the EU-US Data Privacy Framework and its UK Extension for covered US transfers. Its Data Transfers Addendum provides SCCs with the UK International Data Transfer Addendum as a fallback.
• Supabase, Resend, Upstash, OpenAI and Langfuse: their published data-processing terms include EU SCCs with the UK Addendum for restricted UK transfers. SCCs are contractual commitments to protect personal data; the UK Addendum adapts them for UK law.
• Microsoft, Sentry and Discord: the EU-US Data Privacy Framework and its UK Extension for transfers covered by their US certifications.

To ask about a transfer or obtain a copy of the relevant safeguards, email legal@tradeloggr.app.

You must be at least 18 years old to use tradeloggr.

We may update this policy. We will notify users of significant changes via email or in-app notification.

CSignals Ltd

legal@tradeloggr.app