Privacy

• Your email, your name if you give one, and your password, stored as a bcrypt hash we cannot read.
• What you journal: trades, dates, instruments, sessions, strategies, R results, tags, notes, screenshots.
• Your settings and plan: risk, account size, timezone, colours, budgets, prop-firm purchases, payouts, reminders.
• Teams you join: your role, your sharing switches, messages with your mentor, homework set for you.
• A Discord webhook, only if you paste one in.
• Short-lived counts of failed sign-ins, and single-use reset and confirmation tokens, stored hashed.

No advertising, no analytics, no tracking pixels. We never ask for broker, card or bank details. If anything ever does in our name, it is not us.

Only you. The exception is a team you choose to join, and even then nothing is shared until you switch it on. Journal, dashboard and roadmap each have their own switch, all off to begin with, and only the mentor who owns that team sees what you enable. Switch it off, or leave the team, and it stops.

Neon hosts the database (EU, London). Vercel runs the site and keeps server logs that include IP addresses. Resend sends our three emails (confirm your address, reset your password, and a warning if someone tries to sign up with your address) and sees nothing but the address. GitHub stores the weekly encrypted backup. Discord only if you set up a webhook.

The economic calendar is fetched by our server, so that provider never sees your IP or that you looked.

One, set when you sign in, which keeps you signed in. JavaScript cannot read it, it only travels over HTTPS, and it is not sent when another site links to us. Nothing to accept, because there is nothing else.

Delete your account from your Profile and everything goes with it immediately: trades, journal, screenshots, sets, purchases, payouts, reminders and messages. Encrypted backups are kept 90 days, so a copy can survive there that long before ageing out.

Export everything, or delete everything, from your Profile, with no need to ask and no waiting. You can also correct anything wrong or object to what we do with your data. We hold this because you consented by creating an account; withdrawing that consent is the same action as deleting it.

Under UK GDPR you can complain to the Information Commissioner's Office at ico.org.uk if you think we have handled your data badly.

Passwords are hashed, everything is over HTTPS, sign-ins are rate limited, and every request is checked against who you are signed in as. Resetting your password signs out anyone else who was in your account. No system is perfect. If a breach ever put you at risk we will tell you and the regulator promptly.

Trademaxxer is not for under-16s. If this policy changes in a way that matters we will email account holders rather than quietly editing the page.