Privacy policy

This describes what Trading Journal stores, who else sees it, and how to get it back or get rid of it.

What we store

• Your account: name, email address, and a hash of your password. We never store the password itself.
• Your book: the fills you import and everything derived from them — trades, fees, accounts, tags, notes, session plans, rules, saved views and dashboard layout.
• Your conversations: questions you ask the assistant, its answers, and any image you paste into it.
• Billing state: your plan, your Stripe customer and subscription identifiers, and how many assistant messages you have used this month. No card details.

We do not use tracking cookies or third-party analytics. The only cookies are your session and your display preferences.

Who else sees it

Only these, and each only for the feature it provides:

• Anthropic — when you use the AI assistant. This is the significant one: answering a question about your book means sending your question, the trade rows needed to answer it, and any screenshot you attach. If you would rather no third party saw your trades, do not use the assistant; every other feature works without it.
• Stripe — your name, email and payment details when you upgrade. Card details are entered on Stripe’s own hosted page and never touch our servers.
• Resend — your email address, to send verification and password-reset mail.
• Databento — market data provider. Receives instrument symbols and date ranges only. Price bars are shared across all users, so nothing about you is sent.

We do not sell your data, use it for advertising, or use it to train models.

Where it lives

In a PostgreSQL database on a server we control, not a shared platform database. Your rows carry your account’s identifier and every query is filtered by it.

How long we keep it

Until you delete it. Deleting your account removes everything listed above immediately and permanently — accounts, fills, trades, notes, plans, rules, conversations and attachments — and it cannot be undone. Backups are retained for a short period for disaster recovery and are then overwritten. Billing records are kept where tax law requires.

Your rights

You can export your data at any time from Settings, in CSV. You can delete your account at any time from Settings. You can correct anything from within the app. If you are in the UK or EU you also have the rights the GDPR gives you, including to object and to complain to your supervisory authority.

Security

Traffic is encrypted in transit. Passwords are hashed. The database is not reachable from the internet. Access to production is limited to the operator. No system is perfectly secure, and we will tell you promptly if we learn of a breach affecting your data.

Contact

Questions about any of this, or a request under the rights above: privacy@gojournalbro.com.