Tradecraft Journal

Privacy Policy

Last updated: September 8, 2026

This explains what personal data Tradecraft Journal collects, why, how it's protected, who it's shared with, and the rights you have over it. It's written to match exactly what this app actually does — not a generic template — so if something below sounds oddly specific, that's why.

Tradecraft Journal (https://tradecraftjournal.com) is the "data controller" for the personal data described here — the party responsible for deciding why and how it's processed. Contact tradecrafthelp@outlook.com for anything privacy-related, including the requests listed under "Your rights" below.

Account details. Username, email address, password (see "Security" — we never see or store it in readable form), first and last name, and a postal address and phone number collected at sign-up.

Your journal data. Everything you log yourself: trades, deposits, withdrawals, trading accounts, calculator templates, trade checklists, and (if you're on the Plus plan) your custom dashboard layout. This is the actual content of the product — we store it so your journal is there when you come back, and for no other reason.

Broker/prop-firm statement verification. If you link an account for leaderboard verification, we parse the trades out of the statement you upload (platform, broker name, whether it's a demo account, and the resulting trade data) and keep a cryptographic hash of the file to detect duplicate uploads. The statement file itself is not kept — it's processed and discarded.

Billing. Your plan (Standard/Plus), its status (trial/active/canceled), and identifiers Stripe assigns to you (customer ID, subscription ID). Card numbers and other payment details are entered directly into Stripe's own checkout page and never reach our servers — see "Who we share data with" below.

Leaderboard participation. Off by default. If you opt in from your profile, your name, username and score become visible to other signed-in users on the relevant leaderboard. Turning it back off removes you immediately.

Support tickets. The category, subject, message and any screenshots you submit through Help & Support are emailed directly to our support inbox to be answered — they are not stored in the app's database.

Automatically, from using the site. Your IP address and standard request logs are recorded by the web server, as they are for essentially every website, for security and abuse prevention. See our Cookie Policy for cookies and local storage.

• To provide the service (create your account, run your journal, calculate your stats, process your subscription) — necessary to perform our contract with you.
• Leaderboard participation and its verification checks — based on your consent, given by opting in, and withdrawable at any time from your profile.
• Security (fraud prevention, 2FA, "remember this device," blocking abuse) — our legitimate interest in keeping accounts and the service safe, balanced against your rights.
• Billing and tax records — a legal obligation once a payment has been made.
• Responding to support requests — necessary to perform our contract with you, or our legitimate interest in providing support if you email us before creating an account.

Your password is hashed with bcrypt — a one-way function, so even we can't read it back. Your name, address, phone number and email address are encrypted at rest with AES-256-GCM before they're stored; your email is additionally protected by a keyed HMAC "blind index" so the app can find your account at login without ever storing the address itself in plain, searchable form. Sessions use HTTP-only, SameSite cookies, every state-changing request is protected against cross-site request forgery, and sign-in supports email-based two-factor verification.

We don't sell personal data, to anyone, ever. It's shared only with the services that make the app work:

• Stripe — processes all payments and subscriptions. Stripe receives your email and whatever billing details you give it directly; we only ever see the resulting customer/subscription IDs and plan status. See Stripe's own privacy policy.
• TradingView — only if you turn on "Third-Party / Embedded Content" in Cookie Settings, to show the live market heatmaps on the Heatmap tab. Nothing is sent to TradingView unless you've explicitly allowed this. See TradingView's own privacy policy.
• Our hosting provider — stores the database and runs the application on our behalf, under our instructions, and doesn't use your data for its own purposes.

Internally, only the one administrator account can see the email address behind a leaderboard entry — used solely to follow up if a top result ever needs to be verified by hand. No one else, including other users, ever sees your email.

Some of the services above (Stripe, TradingView) may process data outside your own country. Where that happens outside the EU/EEA, it's covered by that provider's own safeguards (such as Standard Contractual Clauses) — see their respective privacy policies linked above for specifics.

Your account and journal data is kept for as long as your account is active. If you delete your account, personal identifiers are removed or anonymized promptly, except where we're required to keep billing/tax records for a longer period under applicable law. Support ticket emails follow our mailbox's own retention, since they're never written into the app's database.

Depending on where you live, you generally have the right to:

• Access the personal data we hold about you.
• Correct it if it's inaccurate — most of it you can already edit yourself, from your profile.
• Delete it ("right to be forgotten"), subject to the legal retention above.
• Export it in a portable format — the in-app Backup & Restore feature does this for your journal data on demand.
• Restrict or object to certain processing.
• Withdraw consent at any time (leaderboard opt-in, optional cookies) without affecting anything done before you withdrew it.
• Lodge a complaint with your local data protection authority if you believe we've mishandled your data.

To exercise any of these, email tradecrafthelp@outlook.com.

Tradecraft Journal is not directed at, and is not intended for use by, anyone under 18. We don't knowingly collect personal data from minors.

Full detail on every cookie and local-storage value this app uses — name, purpose, provider and how long it lasts — is in our Cookie Policy.

If this policy changes in a material way, we'll update the date at the top and, for significant changes, let you know in the app.