Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

• Name: TrackTrade
• Email: privacy@tracktrade.org
• Website: https://www.tracktrade.org

2. Information We Collect

Providing your data is voluntary. If you choose not to provide certain data, some features may not be available to you.

2.1 Account Information

• Email address and display name (via Firebase Authentication / Google Sign-In)
• Authentication tokens (managed by Firebase; we do not store passwords)

2.2 Trading Data (User-Provided)

• Trade records (symbol, direction, entry/exit prices and times, PnL)
• Journal entries and notebook content
• Trade screenshots (uploaded by you)
• Account balances, tags, setups, and strategy metadata
• Backtest sessions and custom indicator scripts

2.3 Broker Integration Data

• Tradovate OAuth tokens (stored as encrypted httpOnly cookies and in Firestore)
• Tradovate account IDs, positions, and trade history (fetched during sync)

2.4 Gmail Import Data

• When you choose to import prop firm emails, we access your Gmail via Google OAuth with read-only scope
• We only read emails matching specific prop firm criteria; we do not store full email content

2.5 Analytics Data (with consent)

• Firebase Analytics collects anonymized usage data (pages visited, feature usage)
• PostHog collects product analytics (pages visited, feature usage, device and browser information) and, once you are signed in, links it to your account using your user ID, email address, display name and subscription plan
• PostHog also records session replays. All text and all form inputs are masked before the recording leaves your browser, so account balances, P&L figures, broker account numbers and payment details are not captured
• None of this is collected — and neither provider is loaded at all — unless you consent via our cookie banner. You can withdraw at any time in Settings → Data & Privacy, and it stops immediately

2.6 Technical Data

• IP address, browser type, and device information (collected automatically by hosting providers)
• Language preference (stored locally in your browser)

3. Purposes of Processing

4. Third-Party Services

We share data with the following third-party processors, solely for the purposes described above:

We do not sell your personal data to any third party.

5. Cross-Border Data Transfers

Your data is stored and processed on servers located in the United States (Firebase/Google Cloud, Vercel, Render, and — with your consent — PostHog) and the EU (Brevo). Israel has EU adequacy status under the GDPR, permitting data transfers between Israel and the EU. For transfers to the US, we rely on the standard contractual clauses and privacy frameworks provided by our cloud service providers.

6. AI-Powered Features

When you use the AI Trade Review feature, your trade data and chart screenshots are sent to OpenRouter (which uses Google Gemini) for automated analysis. This is an optional feature initiated by you. The AI output is for informational purposes only and does not constitute investment advice.

7. Data Retention

• Trading data and journals: Retained as long as your account is active
• Broker tokens: Retained until you disconnect the integration or they expire
• Analytics data: Retained per Firebase Analytics defaults (14 months); PostHog events per our PostHog retention settings, with session replays kept for a shorter period
• Consent records: Your analytics decision, and the history of changes to it, are kept on your account for as long as it exists, as the record that consent was given or withdrawn
• After account deletion: All user data is permanently deleted within 30 days

8. Cookies & Local Storage

Analytics cookies are only activated after you provide consent via our cookie banner: neither PostHog nor Firebase Analytics is loaded before you accept, so no analytics cookie is written and no analytics request is sent. You can change or withdraw your choice at any time in Settings → Data & Privacy, and withdrawal takes effect immediately.

9. Your Rights

Under the Israeli Protection of Privacy Law and the GDPR (for EU residents), you have the right to:

• Access — Request a copy of all personal data we hold about you
• Correction — Request correction of inaccurate data
• Deletion — Request deletion of your data and account
• Data portability — Export your trading data in a standard format
• Withdraw consent — Withdraw analytics consent at any time
• Revoke access — Disconnect broker integrations from your account settings

To exercise any of these rights, contact us at privacy@tracktrade.org. We will respond within 30 days.

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• All data is encrypted in transit (TLS/HTTPS) and at rest (Firebase/Google Cloud encryption)
• Broker tokens are stored as httpOnly cookies, inaccessible to client-side JavaScript
• Firebase Security Rules enforce per-user data isolation
• Backend API endpoints use rate limiting and IP-based abuse prevention
• Firebase Admin SDK access is restricted to server-side only

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page with an updated "Last Updated" date. Continued use of the Service after changes constitutes acceptance.