TraderDarl Privacy Policy

Pre-launch draft. Bracketed items must be completed by the developer, and the policy should be reviewed by a qualified lawyer before publication.

Effective: [EFFECTIVE DATE]

Who we are

TraderDarl ("TraderDarl", "we", "us") is a trading journal and personal productivity application provided by [DEVELOPER / LEGAL ENTITY NAME], [POSTAL ADDRESS], which decides how and why your personal data is processed (the "data fiduciary" or "controller"). For any privacy question or request, contact [PRIVACY & SUPPORT EMAIL].

TraderDarl is not a broker, exchange, investment adviser or signal provider. It never places, modifies or receives orders and is not connected to any brokerage account.

The short version

• Your account and everything you record are stored on our servers (so you can use TraderDarl on more than one device and recover it on a new one) and in your browser on each device you use. Screenshots are stored in private, encrypted cloud storage.
• We use a small number of service providers to run TraderDarl (listed below). They process your data only to provide their service to us.
• We do not sell your data, show advertising, or use advertising or analytics trackers.
• Files you import (CSV, Excel, Word, PDF) are read on your device; the original file is not uploaded or kept. Its file name is stored with the imported trades so you can identify or undo that import.
• You can export everything (Settings → Backup & Restore) and delete your account and data (Settings → Delete account) at any time.

Information you provide

• Account details: email address, display name, and optionally a profile picture. Your password is never stored — only a salted PBKDF2-SHA256 hash used to check it when you sign in.
• Trading records you enter or import: trades (instrument, direction, dates and times, prices, quantity, costs, profit and loss, stop-loss, target, risk), strategies, setups, tags, notes, psychology entries, rule adherence, screenshots and their captions, playbook content, backtests, prop-firm challenge settings and balance snapshots, and risk preferences.
• Personal productivity content: tasks, Daily Routine habits and their history, personal notes, goals, and your rules and checklists.
• Preferences: currency, markets you trade, appearance, notification and reminder settings.

Information created automatically

• Session records (when you signed in and when the session expires) and a short security log (for example sign-in, sign-out, password changed, backup exported). The log stores the event type, its time and at most a short detail such as the sign-in method or device platform — never passwords or trade details.
• A device record (a label and platform such as 'web') used for the device list and, when cloud sync is enabled, device limits.
• Calculated results such as analytics, reports and challenge evaluations. These are computed from your own records on your device.
• We do not collect precise location, contacts, advertising identifiers, or crash or usage analytics.

Where your data is stored and processed

On our servers: your account (email address, display name, a salted hash of your password — never the password itself — and, if you use it, your Google account identifier) and all the records you create are stored in our application database so they sync between your devices. Screenshots you attach are stored separately in private object storage, encrypted at rest, and are only reachable through short-lived signed links issued to you. All connections use encryption in transit (HTTPS).

On your devices: a copy of your account profile and records is kept in your browser's storage (IndexedDB and local storage) so the app works offline and quickly. Calculations such as analytics and reports are made on your device. Clearing the browser's site data removes this copy but not your account on our servers.

Technical data: like any website, our hosting provider receives request data (IP address, browser and device type, pages requested, time) to deliver the service and protect it against abuse. Our own systems do not store your IP address: limits that protect against abuse use a one-way hash of it. We keep a session record (sign-in time, expiry and your browser's user-agent text) and a security log of account events (for example sign-in, password change, deletion request).

Public reviews: if you choose to write a review, we store your star rating, your text, the display name you choose, whether you agreed to that name being shown, and the dates it was submitted and moderated. Only reviews approved by a moderator are published, with your chosen name only if you agreed (otherwise as "A TraderDarl user") and never your email address. If you report someone else's review, the report is stored with a one-way hash instead of your account id. You can edit or delete your review at any time, and it is deleted with your account. [LEGAL REVIEW: confirm retention of rejected reviews and of reports.]

Service providers

Each provider processes your data only to provide its service to us, under its own terms and data-protection commitments. [LEGAL REVIEW: confirm the data-processing terms with each provider.]

• Cloudflare, Inc. — delivers the website, runs the application server and hosts its database (your account, records and sync metadata), and forwards email sent to our support address. Its network is global; the database is placed in the Asia-Pacific region. [LEGAL REVIEW: confirm Cloudflare's request-log retention and the transfer terms.]
• Backblaze, Inc. (B2 Cloud Storage) — stores the screenshots and images you attach, privately and encrypted at rest, in the United States (US East region).
• Amazon Web Services (Simple Email Service, Mumbai region, India) — sends account emails such as email confirmation, password reset and security notices. It receives your email address and the message.
• Google — only if you choose 'Continue with Google': Google receives the sign-in request and returns your Google account email and name to us.
• Razorpay (Razorpay Software Private Limited, India) — processes subscription payments by Autopay when paid plans are available. You enter card, UPI or bank details only with Razorpay; we never receive or store them. We keep the subscription identifier, plan, status, amounts and dates.

Why we use your information

• To provide the app: store your records, calculate analytics, reports, position sizes and challenge progress, and show reminders you switch on.
• To keep your account secure: verify your password, manage sessions, and keep the security log.
• To keep your records in sync between your devices and let you recover them on a new device.
• Where a legal basis is required (for example under the GDPR or India's Digital Personal Data Protection Act, 2023), we rely on performing our agreement with you and on your consent for optional features. [LEGAL REVIEW: confirm bases for the jurisdictions where TraderDarl is offered.]

Sharing

We do not sell or rent your information and do not share it with advertisers or data brokers. We disclose information only to the service providers above, when you ask us to, or where the law requires it.

Notifications

Reminders are generated on your device. If you allow notifications in your browser, TraderDarl shows them through your browser or operating system. There is no push server, so reminders appear only while the app is open or running in the background.

Retention and deletion

• Your account and records are kept while your account exists. Sessions expire after 14 days. Sync history used to deliver changes between devices is deleted after 30 days. The security log is kept for one year (at least 180 days, as Indian rules for service providers require).
• Delete your account in the app: Settings → Delete account. This permanently deletes your account and all associated records and images from our servers and image storage, and from the device you use. Deletion on our servers normally completes within minutes. Database backups kept by our hosting provider for disaster recovery expire within 30 days.
• Request deletion without the app: see the "Delete your data" page ([ACCOUNT DELETION REQUEST WEB PAGE URL]) or email [PRIVACY & SUPPORT EMAIL]. We will confirm and complete a request within [NUMBER] days.
• Backup files you export are under your control; delete them yourself if you no longer want them.
• [LEGAL REVIEW: list any data kept after deletion for legal, security or fraud-prevention reasons, and for how long — currently the security log entries (up to one year) and any payment records the law requires us to keep.]

Your choices and rights

• Access and portability: export a complete copy (Settings → Backup & Restore).
• Correction: edit any record in the app.
• Deletion: as described above.
• Withdraw consent for optional features at any time, for example notifications or cloud sync.
• To exercise any right, or to complain, contact [PRIVACY & SUPPORT EMAIL]. You may also contact your local data-protection authority.

Security

We use reasonable measures appropriate to the app: passwords are stored only as salted hashes, sessions expire, sensitive values are never written to logs, all connections use HTTPS, screenshots are encrypted at rest, and each account can only ever reach its own data. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. There is no two-step verification yet.

Children

TraderDarl is intended for adults and is not directed at children under 18. [LEGAL REVIEW: confirm the minimum age for each market.]

International use

Your data is processed in India (email), the Asia-Pacific region (database), the United States (screenshots) and on our hosting provider's global network. [LEGAL REVIEW: describe transfer safeguards and confirm compliance with the DPDP Act's cross-border rules.]

Changes to this policy

We will post any change here with a new effective date and, for material changes, tell you in the app before they take effect.

Contact

[DEVELOPER / LEGAL ENTITY NAME] · [POSTAL ADDRESS] · [PRIVACY & SUPPORT EMAIL]