Privacy Policy

TraderStack ("we," "our," "us") is committed to protecting your privacy. This Privacy Policy applies to all data collected through our website, web application, and related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy.

Information you provide directly:

Information collected automatically:

We use the data we collect for the following purposes:

• To provide, operate, and maintain the Service, including processing your trade logs, journal entries, and analytics.
• To manage your account, authenticate your identity, and process payments.
• To send essential transactional communications such as account confirmations, password resets, and billing receipts.
• To provide customer support and respond to your inquiries.
• To detect, investigate, and prevent fraudulent activity, abuse, and security incidents.
• To improve the Service, fix bugs, and develop new features based on aggregate usage patterns.
• To comply with legal obligations and enforce our Terms & Conditions.

We do not sell, rent, or trade your personal information to third parties. We may share your data only in the following limited circumstances:

• Service providers who process data on our behalf to deliver the Service (e.g., cloud infrastructure, auth, payments), bound by data protection agreements.
• Legal requirements - where required by law, subpoena, or lawful government request.
• Protection of rights - where necessary to protect the safety of TraderStack, our users, or the public.
• Business transfers - in a merger, acquisition, or asset sale, with advance notice provided to you.
• With your explicit consent - in any other case, we will ask first.

TraderStack integrates with a small number of carefully selected third-party services. Each processes your data only as necessary to fulfil their function:

TraderStack uses a minimal set of cookies and browser storage to operate the Service. We do not use cookies for advertising or cross-site tracking.

You can control cookie preferences through your browser settings. Disabling essential cookies will prevent the Service from functioning correctly.

We implement industry-standard security measures to protect your data:

• All data is transmitted over encrypted HTTPS connections.
• Passwords are hashed and never stored in plaintext.
• Database access is restricted using row-level security policies (Supabase RLS).
• Payment data is handled exclusively by Stripe's PCI-DSS compliant systems.
• We conduct periodic security reviews and address identified vulnerabilities promptly.

We retain your personal data for as long as your account is active or as needed to provide the Service:

• Account data is retained for the lifetime of your account, plus up to 30 days following deletion to allow for recovery.
• Trade data and journals are retained while your account is active. You can export or delete your data from account settings at any time.
• Billing records are retained for a minimum of 7 years as required by applicable tax regulations.
• Server logs are retained for up to 90 days for security and debugging purposes, then automatically purged.
• Support communications are retained for up to 3 years.

When you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law.

Depending on your location, you may have the following rights regarding your personal data:

To exercise any of these rights, contact us at traderstack.contact@gmail.com. We will respond within 30 days.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child under 18 has provided us with personal information, we will take immediate steps to delete it.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at traderstack.contact@gmail.com.

TraderStack operates primarily from the United States. If you are located outside the US, your data may be transferred to and processed in the US or other countries where our service providers operate.

We take appropriate steps to ensure international transfers are protected in accordance with applicable data protection laws. Where required, we rely on standard contractual clauses approved by relevant data protection authorities.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and notify you by email where appropriate.

Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy, please reach out:

We aim to respond to all privacy-related inquiries within 5 business days, and to rights requests within 30 calendar days.