DRAFT — pending professional legal review. this text is not legal advice.
// privacy policy
updated 2026-07-19
controller
[PLACEHOLDER: controller full name] [PLACEHOLDER: street + number, postcode + city, country] [PLACEHOLDER: contact email]
what we store
Only what the service needs to work: your email address (login identity), short-lived one-time login codes (stored salted + hashed, never in plain text), active sessions, the terms version you accepted and when, and the journal data you enter — trades, tags, notes, rationale, and their timestamps. Nothing is collected behind your back: every stored field is one you typed or one the login flow requires.
cookies + tracking
One cookie: an HttpOnly session cookie that keeps you logged in. No analytics, no behavioral tracking, no advertising or third-party scripts. Server logs are scrubbed of trade contents.
processors
Two processors touch your data, both under data-processing agreements: Hetzner Online GmbH (Germany) hosts the servers, database volumes, and encrypted backups in EU data centers (Falkenstein / Nuremberg); Resend delivers the one-time login-code emails — it processes your email address and the code, never your journal data. [PLACEHOLDER: Resend processing region + safeguards (EU region or SCCs) — confirm while signing the Resend DPA]. No other third party receives your data.
legal basis + retention
Processing rests on performance of the service you signed up for (Art. 6(1)(b) GDPR) and our legitimate interest in keeping it secure (Art. 6(1)(f) — rate limiting, abuse prevention). Login codes expire within minutes and are purged; expired sessions and rate-limit records are purged on a schedule; journal data is kept until you delete it or your account.
your rights
Access and portability are built in: export your full journal as CSV from the account page. Deletion is built in too — deleting your account permanently removes your trades, tags, notes, sessions, and identity in one cascade; no tombstones remain. For rectification, restriction, or objection, contact the controller above. You also have the right to lodge a complaint with a data-protection supervisory authority.
changes
Material changes to this policy bump the date above and, where they affect the terms you accepted, the terms version shown on the terms page.