Privacy Policy

This explains what TradeYeti collects, why, and who else touches it. The short version: we collect what the journal needs to work, we do not sell it, and you can have it deleted.

1. What we collect

• Account: your email address and login details, handled by our sign-in provider.
• Journal data: trades, notes, tags, ratings, settings and screenshots you enter or upload.
• Broker data, if you connect a broker: orders, fills, positions and account balances read through the broker's official API, and the account identifiers needed to do that.
• Broker credentials: the API key, token or authorization you provide. These are encrypted with AES-256-GCM before they are stored. We do not store your broker password. Where a broker requires a username and password to start a session, the password is used once to obtain a token and is then discarded.
• Billing: your subscription status and a Stripe customer ID. Card details go straight to Stripe; we never see or store your card number.
• Technical logs: standard server logs such as IP address, browser type and request times, kept by our hosting provider for security and debugging.

2. How we use it

To run the journal for you: syncing and importing trades, calculating your statistics, showing charts, billing your subscription, answering support requests, and keeping the service secure. We do not use your trading data for advertising, and we do not use it to trade.

3. What we never do

• We do not sell or rent your data.
• We do not place, change or cancel orders in your brokerage account.
• We do not share your trades with other users.

4. Who processes data for us

We use a small number of service providers, each only for its job:

• Clerk: sign-in and account security.
• Vercel: hosting, server logs and screenshot storage.
• Neon: the database.
• Stripe: payments.
• Your broker: the source of synced trade data, at your request.
• Market-data providers: when you open a price chart we request bars for that symbol and date. No personal information is sent with that request.

We may disclose information if the law requires it.

5. How it is protected

Connections use HTTPS. Broker credentials are encrypted at rest. Each row in the database is tied to your account, and row-level security in the database itself keeps one user's data from being read by another. No system is perfectly secure; if we learn of a breach affecting your data, we will tell you promptly.

6. Keeping and deleting data

We keep your data while your account is open. You can disconnect a broker at any time, which removes the stored credentials. To export or delete your data or close your account, email us and we will do it within 30 days. Billing records may be kept longer where tax or accounting law requires.

7. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information. Email us to use any of them. We will not treat you differently for asking.

8. Cookies

We use only the cookies needed to keep you signed in and remember your theme. No advertising or cross-site tracking cookies.

9. Children

The service is for adults. We do not knowingly collect information from anyone under 18.

10. Changes

If this policy changes in a way that matters, we will email you before the change takes effect.

11. Contact

See the Contact page.