Privacy Policy

1. The short version

Your journal is yours. We collect what the product needs to run and nothing else, we never ask for the password you log in to your trading platform with, nothing in this product can place a trade, we run no advertising trackers, and we do not sell or share your trading data with anyone. Your written record exports as CSV whenever you want it, and you can delete the account permanently yourself, without asking us.

2. Who is responsible for your data

The data controller is the operator of TradeLunar: its founder, trading as TradeLunar, based in the United Kingdom. When the business incorporates, the company name and number will be added here with notice by email. For anything in this document, write to support@tradelunar.io; the postal address is available on request from the same inbox. UK data protection law (UK GDPR and the Data Protection Act 2018) applies to how we handle your data.

3. What we collect, in full

• Account details. Your email address, a hash of your TradeLunar password (scrypt; the password itself is never stored), the fact and time that you agreed to the legal documents, whether your account is paid, and session records for your logins.
• Journal records. Everything you write in the app: trades with their planned and actual prices, setups, rules kept and broken, per-trade dollar risk if you state it, skipped setups, daily notes, playbook strategies with their rules, checklists and routines, and the chart screenshots you upload (capped at four per trade).
• Accounts you define. The trading accounts you name in the app, their type, and the dollar risk per trade you assign to them.
• Platform connections. If you connect Topstep, tastytrade, TradeStation or cTrader: the API credential you created at that platform, encrypted at rest; its last four characters as a hint so you can recognise which credential is stored; the platform’s identifier and name for the connected account; the account balance the platform reports; the time of the last sync; and the fills the platform reports, exactly as received: the platform’s own identifier, contract, time, price, size, side, profit and loss where the platform reports it, and fees.
• Market data key. If you add a Databento key for backtesting: the key, encrypted at rest, plus its last four characters as a hint.
• Purchase records. That you paid, when, the amount and currency, the payment’s status, and Stripe’s reference for it. Card numbers never touch our servers; Stripe handles the card end to end.
• Affiliate records. If you use the affiliate dashboard: your referral code, each referral with its amount, status and dates, and the identifier of the Stripe account you connect for payouts. Stripe’s own onboarding collects what Stripe needs for identity checks under Stripe’s own policy.
• Support messages. What you write to support@tradelunar.io or through the contact form, and the address you write from, kept for as long as the conversation and a reasonable record of it need.
• Email events. When we send you a transactional email (password reset, welcome, receipt), our email provider records that it was sent and whether it was delivered.
• Technical data. IP address, browser and device type, and request timestamps, kept in server logs for up to 30 days for security, rate limiting and abuse prevention.
• Giveaway claims. If you claim a free account with a campaign code, we store which campaign it was and a one-way hash of the connection you claimed from, so a capped run of accounts cannot be taken by one person behind many sign-ups. The hash cannot be turned back into your address, it differs for every campaign so it cannot be used to link them, and it is deleted when the campaign closes.

4. What we never collect

• The password you use to log in to your broker, prop firm or trading platform. Connections use an API credential you create in the platform’s own settings, in your own name, revocable there at any time.
• Order placement rights. The connection code reads accounts, fills and balances, and where a platform requires it refreshes its own tokens; that is the whole list. No code path to an order endpoint exists. Where a platform’s credential is not scoped read-only by the vendor (Topstep’s is not), the connect screen says so in plain words before you paste it.
• Payment card numbers. Stripe handles cards; we see a reference, never the number.
• Advertising identifiers, cross-site tracking data, or anything collected to profile you. There are no ad trackers on the site or in the app.
• Data about you from data brokers. Everything we hold came from you, your connected platform, or Stripe.

5. Why we hold it, and the legal bases

• To run the product (contract): storing your journal, syncing and importing fills, computing your statistics, processing your purchase, running affiliate payouts you asked for, and sending the emails the product needs: password resets, a welcome note, payment receipts.
• To keep it safe (legitimate interest): server logs, rate limiting, abuse prevention, and encryption of stored credentials.
• Because the law requires it (legal obligation): keeping the record that a payment happened for accounting and tax, and responding to lawful requests from authorities, which we would only do where legally compelled and as narrowly as the law allows.
• With your consent: anything optional we add later, such as a marketing email list, would be opt-in, separate, and never a condition of using the product. Today we send no marketing email at all.

6. Who processes it for us

A small number of processors, each used only to run the service, each bound by its own data processing terms:

• Vercel hosts the site and the app, and counts page views without cookies.
• Neon hosts the database, in an EU/UK region.
• Stripe processes payments and affiliate payouts, and holds card and identity data under its own policy.
• Resend sends the transactional email and records delivery.
• Plausible counts page views on the marketing site, without cookies and without storing anything on your device.
• Google Analytics, only if you say yes to it: see the analytics section below. Never loaded before you answer.

Two more parties see data because you connect them, acting on your instruction: the trading platform you connect (we send it your credential to read your own fills back), and Databento if you add a data key (we send it your key to fetch the bars your own studies request). Nobody buys your data from us, because we do not sell it, rent it, or share it for advertising, with anyone, ever.

7. Where it goes (international transfers)

The database lives in an EU/UK region. Some processors (Vercel, Stripe, Resend) and the platforms you connect operate partly in the United States and elsewhere. Where personal data leaves the UK, it travels under recognised safeguards: the UK’s adequacy decisions, the UK International Data Transfer Addendum, or standard contractual clauses in the processor’s data processing agreement.

8. How it is protected

• Everything travels over HTTPS, and the site sets strict security headers including a content security policy.
• Your TradeLunar password is hashed with scrypt. It is never stored, logged or emailed.
• Platform credentials and your data key are encrypted at rest with AES-256-GCM, decrypted only inside the sync or backtest operation that needs them, never returned by any route, and shown in the app only as their last four characters.
• Sessions are httpOnly, secure, sameSite cookies, so scripts cannot read them.
• Login, signup, password reset, connections and payment routes are rate limited.
• Every record is scoped to the account that owns it, enforced on the server on every request, not just hidden in the interface.

9. If something goes wrong

If a breach ever puts your data at risk, we will tell you what happened, what was affected and what we are doing about it, without undue delay, and notify the ICO within 72 hours where the law requires it. We will never quietly sit on a breach.

10. How long we keep it

• Journal records, accounts, connections and keys: for as long as your account exists.
• On disconnecting a platform: the credential is deleted immediately. The synced fills stay in your journal, because they are your record, until you delete them or the account.
• On account deletion: journal records, credentials, keys and screenshots are removed immediately, and database backups age out within 30 days.
• Purchase records: kept after deletion, because accounting law requires a record that a payment happened. It carries the payment facts, not your journal.
• Affiliate ledgers of paid rewards: kept as part of the same accounting record.
• Server logs: up to 30 days, rolling.
• Support correspondence: for the life of the issue and a reasonable record after it.

11. Your rights, all of them

• Access and portability. Your trades and skips export as CSV from the Trades tab and your notes from the Notes tab, at any time, without asking us. Chart screenshots are files rather than rows, so they are not in the CSV; download them from the trade itself. For a copy of anything else we hold about you, write to us.
• Rectification. Your journal is editable in the app. For anything you cannot edit yourself, write to us.
• Erasure. Delete your account from settings; it is permanent, immediate, and we do not keep a shadow copy beyond the accounting record the law requires.
• Restriction and objection. You can ask us to restrict or stop a particular processing; because we do no marketing and no profiling, in practice this applies to edge cases, and we will honour it where the law provides it.
• No automated decisions. We make no automated decisions about you with legal or similarly significant effect. The statistics the app computes are shown to you, about your trading, and drive nothing else.
• Requests to support@tradelunar.io are actioned within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk), or your own supervisory authority in the EU.

12. Cookies and local storage

• Session cookie. One, to keep you signed in: httpOnly, secure, sameSite. Deleted on logout.
• Local storage. Small conveniences that never leave your machine: which account lens you selected, your last instrument, whether you have seen the tour, and similar. Clearing your browser storage resets them and loses nothing that matters.
• Stripe. During checkout, Stripe sets its own cookies for fraud prevention under its own policy.
• Google Analytics cookies, only after you consent: see the next section. Off by default.
• Nothing else. No advertising cookies, and nothing beyond what this section names.

13. Analytics

Measuring which pages get used is split in two. Vercel and Plausible count page views without setting a cookie and without storing anything on your device, so they run for everyone and there is nothing to agree to. Google Analytics does set cookies, so it is off until you say yes: we ask on your first visit, refusing takes one click, and nothing is loaded from Google before you answer. Saying no is remembered and we do not ask again.

You can change your mind at any time, and turning it off expires the cookies rather than only stopping new ones. The control is right here:

14. Children

TradeLunar is for adults. You must be 18 or older to create an account, and we do not knowingly hold data about anyone younger. If you believe we do, write to us and it will be deleted.

15. Changes

If this document changes in a way that affects you, we email the address on your account before it takes effect rather than quietly updating a date at the top. The current version always lives at this address.

16. Contact

support@tradelunar.io. The postal address is available on request from the same inbox.