Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

• Name: TrackTrade
• Email: privacy@tracktrade.org
• Website: https://www.tracktrade.org

2. Information We Collect

Providing your data is voluntary. If you choose not to provide certain data, some features may not be available to you.

2.1 Account Information

• Email address and display name (via Firebase Authentication / Google Sign-In)
• Authentication tokens (managed by Firebase; we do not store passwords)

2.2 Trading Data (User-Provided)

• Trade records (symbol, direction, entry/exit prices and times, PnL)
• Journal entries and notebook content
• Trade screenshots (uploaded by you)
• Account balances, tags, setups, and strategy metadata
• Backtest sessions and custom indicator scripts

2.3 Broker Integration Data

• Tradovate OAuth tokens (stored as encrypted httpOnly cookies and in Firestore)
• Tradovate account IDs, positions, and trade history (fetched during sync)

2.4 Gmail Import Data

• When you choose to import prop firm emails, we access your Gmail via Google OAuth with read-only scope
• We only read emails matching specific prop firm criteria; we do not store full email content

2.5 Analytics Data (with consent)

• Firebase Analytics collects anonymized usage data (pages visited, feature usage)
• This data is only collected if you consent via our cookie banner

2.6 Technical Data

• IP address, browser type, and device information (collected automatically by hosting providers)
• Language preference (stored locally in your browser)

3. Purposes of Processing

4. Third-Party Services

We share data with the following third-party processors, solely for the purposes described above:

We do not sell your personal data to any third party.

5. Cross-Border Data Transfers

Your data is stored and processed on servers located in the United States (Firebase/Google Cloud, Vercel, Render) and the EU (Brevo). Israel has EU adequacy status under the GDPR, permitting data transfers between Israel and the EU. For transfers to the US, we rely on the standard contractual clauses and privacy frameworks provided by our cloud service providers.

6. AI-Powered Features

When you use the AI Trade Review feature, your trade data and chart screenshots are sent to OpenRouter (which uses Google Gemini) for automated analysis. This is an optional feature initiated by you. The AI output is for informational purposes only and does not constitute investment advice.

7. Data Retention

• Trading data and journals: Retained as long as your account is active
• Broker tokens: Retained until you disconnect the integration or they expire
• Analytics data: Retained per Firebase Analytics defaults (14 months)
• After account deletion: All user data is permanently deleted within 30 days

8. Cookies & Local Storage

Analytics cookies are only activated after you provide consent via our cookie banner. You can change your preference at any time by clearing your browser storage and revisiting the site.

9. Your Rights

Under the Israeli Protection of Privacy Law and the GDPR (for EU residents), you have the right to:

• Access — Request a copy of all personal data we hold about you
• Correction — Request correction of inaccurate data
• Deletion — Request deletion of your data and account
• Data portability — Export your trading data in a standard format
• Withdraw consent — Withdraw analytics consent at any time
• Revoke access — Disconnect broker integrations from your account settings

To exercise any of these rights, contact us at privacy@tracktrade.org. We will respond within 30 days.

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• All data is encrypted in transit (TLS/HTTPS) and at rest (Firebase/Google Cloud encryption)
• Broker tokens are stored as httpOnly cookies, inaccessible to client-side JavaScript
• Firebase Security Rules enforce per-user data isolation
• Backend API endpoints use rate limiting and IP-based abuse prevention
• Firebase Admin SDK access is restricted to server-side only

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page with an updated "Last Updated" date. Continued use of the Service after changes constitutes acceptance.