Privacy Policy

1. Summary

This Privacy Policy explains how Trade5 ("we", "us", "our") handles personal data when you use Trade5 (also called "TradeFive"), including our website and web app (together, the "Service"). Please read it together with our Terms of Service and Risk Disclaimer.

2. Who we are

The Service is operated by Trade5, located at [MAILING ADDRESS]. For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, Trade5 is the controller of the personal data described in this policy. Under California law, we are the "business" that collects your personal information.

You can reach us about privacy at any time at [CONTACT EMAIL].

3. Data we collect

3.1 Account data

When you create an account or sign in, we collect:

• Your email address;
• Your password, if you sign up with email (it is handled by Supabase Authentication and stored by Supabase only in hashed form; we never see it);
• Your name only if you choose "Continue with Google" and Google provides them;
• Your account user ID (a unique identifier for your account, assigned by Supabase);
• Your email-verification status; and
• Sign-in timestamps (such as when your account was created and when you last signed in).

3.2 Journal content you store in the cloud

To sync your journal across devices, we store the content you create, including:

• Trades: dates, assets or pairs, setups, direction (long/short), profit and loss (P&L), risk and notes;
• Screenshots and photos you attach to trades or setups;
• Setups, your trading rules (such as daily loss limit, max risk per trade, max trades per day and stop-after-N-losses) and A+ checklists, plus trade grades;
• "What went wrong" tags you apply to trades;
• Practice-mode session results (simulated trades and outcomes);
• Learn progress, such as flash-card progress, XP, levels, streaks and badges; and
• Your app preferences.

3.3 Payment data

If you subscribe to Pro, payment is handled by Stripe through Stripe Checkout. Your card details are entered directly with Stripe; we never see or store your full card number. We receive and store information such as your Stripe customer ID, subscription status, plan (monthly or yearly), billing period dates and payment status. Limited card details, such as the card brand and last four digits, may be visible to us in Stripe's dashboard. Stripe processes your payment data under its own privacy policy.

3.4 Consent record

When you create an account, we record the date and time you accepted our Terms of Service and acknowledged this Privacy Policy, so we can show when you agreed.

3.5 Data stored on your device

The app keeps a local copy of your journal in your browser's IndexedDB storage so it loads quickly and works when your connection is poor. It also uses localStorage for preferences, such as which Mindset videos you have watched and display settings. This data stays on your device unless it is synced to your account. Clearing your browser data removes the local copy; your cloud copy remains in your account.

3.6 Technical data and logs

We don't run our own analytics. However, our infrastructure providers (such as Supabase, Vercel and Stripe) automatically process technical data needed to deliver and secure their services, such as IP addresses, browser and device type, request timestamps and error logs. These are held by those providers under their terms. Content delivery networks and font providers also see your IP address when your browser requests files from them (see Section 6).

3.7 Communications

If you email us, we keep your message and our reply so we can help you and keep a record of the request.

3.8 Data we do not collect

We don't connect to your brokerage account, we don't collect your brokerage credentials, and we don't execute trades. We don't intentionally collect government ID numbers or sensitive personal information as defined by law beyond what you choose to write in your own notes.

4. How we use your data

We use personal data only to:

• Provide the Service: store your journal, show your calendar, rules, setups, practice and Learn features, and order the Mindset library based on your tags;
• Sync your journal across your devices;
• Authenticate you, verify your email address and keep your account secure;
• Bill for Pro subscriptions and manage your subscription status;
• Support you when you contact us, and send essential service messages (such as email verification, password resets, billing receipts from Stripe, and notices of material changes to our terms);
• Protect the Service, prevent fraud and abuse, and fix problems; and
• Comply with legal obligations, such as tax and accounting rules.

We do not:

• show advertising or use your data for advertising;
• sell your personal information, or "share" it for cross-context behavioral advertising (as those terms are defined under California law);
• use third-party analytics or tracking tools (currently); or
• use your journal content to train machine-learning models or for any purpose unrelated to providing the Service to you.

If we ever want to use your data in a materially different way, we will update this policy and, where required, ask for your consent first.

5. Legal bases (GDPR / UK GDPR)

If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, we rely on the following legal bases:

6. Service providers & third parties

We use the following providers to run the Service. Some act as our processors (they handle data on our instructions); others are independent third parties whose content your browser loads directly and who handle data under their own privacy policies.

We may also disclose personal data: (a) to professional advisers (such as lawyers and accountants) under confidentiality obligations; (b) if required by law, court order or a valid legal request; (c) to protect the rights, safety or property of our users, the public or us; or (d) to a successor if Trade5 is involved in a merger, acquisition or sale of assets, in which case we will notify you and this policy will continue to apply to your data.

7. Cookies & local storage

We do not use advertising or analytics cookies. We use only strictly necessary browser storage to keep you signed in and to make the app work:

• Supabase Authentication stores sign-in tokens in your browser (local storage) to keep you signed in;
• IndexedDB holds a local copy of your journal; and
• localStorage holds preferences such as watched videos and display settings.

Because this storage is strictly necessary for the Service you request, we don't ask for cookie consent for it. Some third-party pages and widgets set their own cookies when you use them, including Stripe Checkout (for payment security and fraud prevention) and the optional TradingView live chart widget. Opening a YouTube video takes you to YouTube, which uses its own cookies. You can block or delete cookies and site data in your browser settings, but parts of the Service may stop working.

8. Data retention

• Account data and journal content are kept until you delete them or delete your account.
• When you delete your account, we delete your data from our active systems promptly, and it is removed from backups within [30] days, unless we must keep certain information to comply with law or resolve disputes.
• Billing records are kept by Stripe, and by us where required, for as long as tax, accounting and other laws require.
• Support emails are kept for as long as needed to handle your request and for a reasonable period afterwards.
• Technical logs held by our providers are kept according to those providers' retention schedules.
• Local data on your device stays until you sign out and clear it, or clear your browser's site data.

9. Security

We take reasonable measures to protect your data, including:

• encryption in transit (HTTPS/TLS) and encryption at rest provided by our infrastructure providers;
• database and storage access rules that restrict each account to its own data; and
• delegating password handling and card handling to specialist providers (Supabase Authentication and Stripe) so we never hold your password or full card number.

No method of transmission or storage is 100% secure, and we can't guarantee absolute security. Please use a strong, unique password and keep your devices secure. If we become aware of a data breach that affects you, we will notify you and the relevant authorities as required by law.

10. Your rights

Depending on where you live, you may have the following rights. We aim to honor reasonable requests from all users, wherever they are.

• Access: ask for a copy of the personal data we hold about you.
• Correction: fix inaccurate data. You can edit most of your journal directly in the app.
• Deletion: delete your account and associated data using "Delete account" in the app, or by contacting us.
• Portability / export: download your journal at any time using the in-app JSON export.
• Objection and restriction: object to processing based on legitimate interests, or ask us to restrict processing in certain circumstances.
• Withdraw consent: where we rely on consent, withdraw it at any time. This doesn't affect processing that happened before you withdrew it.
• Complain: if you are in the EEA or UK, you can complain to your local data protection supervisory authority (in the UK, the Information Commissioner's Office). We'd appreciate the chance to resolve your concern first.

We don't make decisions about you based solely on automated processing that produce legal or similarly significant effects. Features such as trade grading and Mindset video ordering are tools for you and have no such effects.

11. California (CCPA/CPRA) & US state rights

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) gives you specific rights. Residents of other US states with comprehensive privacy laws may have similar rights.

Categories of personal information we collect

In the last 12 months we have collected: identifiers (email, name if provided via Google, account user ID, IP address as processed by our providers); customer records (subscription and limited billing information); commercial information (your plan and subscription history); internet or electronic activity (sign-in timestamps and technical logs held by our providers); and user-generated content (your journal, notes, tags and screenshots), which may include inferences about your trading behavior that you create yourself. Sources: you, your devices, Google (if you use Google sign-in) and Stripe. Purposes: those listed in Section 4. We disclose these categories to the service providers listed in Section 6 for business purposes only.

Your rights

• Right to know / access the categories and specific pieces of personal information we have collected about you, the sources, purposes and recipients;
• Right to delete personal information we collected from you, subject to legal exceptions;
• Right to correct inaccurate personal information;
• Right to opt out of sale or sharing: we do not sell your personal information and do not share it for cross-context behavioral advertising, and have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16;
• Right to limit use of sensitive personal information: we use any sensitive information only as necessary to provide the Service, so this right is not triggered; and
• Right to non-discrimination: we will not deny you service, charge you a different price or provide a different quality of service because you exercised your rights.

We do not offer financial incentives in exchange for personal information.

12. How to make a request

Many requests can be handled instantly in the app: use JSON export to get a copy of your journal and Delete account to erase your account. For anything else, email [CONTACT EMAIL] with the subject "Privacy request" or write to [MAILING ADDRESS].

Verification. To protect your data, we will verify your identity before acting on a request, normally by asking you to send the request from, or confirm it via, the email address on your account. We may ask for more information if needed. An authorized agent may submit a request on your behalf with your signed permission, and we may still ask you to verify your identity directly.

Timing. We will respond within one month (GDPR/UK GDPR) or 45 days (CCPA/CPRA), and may extend these periods where the law allows, in which case we'll tell you why. If we decline a request, we'll explain why and, where applicable, how you can appeal.

13. International transfers

Our servers and main providers are located in the United States. If you use the Service from outside the US, your data will be transferred to and processed in the US, which may have different data protection laws from your country. Where required, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) included in our providers' data processing terms, or a provider's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions. You can contact us for more information about these safeguards.

14. Children

The Service is not intended for anyone under 18, and you must be 18 or older to create an account. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us at [CONTACT EMAIL] and we will delete it.

15. Changes to this policy

We may update this policy from time to time. We'll change the "Last updated" date at the top and, if the changes are material, notify you by email or in the app before they take effect. Where the law requires your consent for a change, we'll ask for it.

16. Contact us

Trade5
[MAILING ADDRESS]
Email: [CONTACT EMAIL]