Privacy Policy

What we store

TradingMC stores the following data to provide its journal and dashboard functionality:

• Your email address and display name (used for authentication)
• Trade journal entries including instrument, result, R:R, session, notes, and execution details
• Pre-market analyses including bias, thesis, and chart notes
• Funded account records including firm name, account size, and payout history
• Connected broker account snapshots and imported trade details, including account, instrument, execution times, quantity, costs, and P&L where available
• Encrypted, revocable Tradovate OAuth tokens needed to refresh a connection
• Daily self-improvement data including journal entries, mental state scores, and sleep data
• Habit completion data
• Chart screenshots uploaded to trade journal and analysis entries

Broker connections and imports

Tradovate connections use OAuth access configured for reading accounts, orders, and fills. We do not store broker passwords or trading-capable API keys. Broker tokens are stored encrypted on the server and are never returned to your browser. Disconnecting a broker removes its stored tokens and connected account history.

CSV exports are parsed in your browser. We receive only the trade records you select for import, not the original file. You can review imported records before adding them to your journal.

Screenshots

Screenshots you upload are stored in a private, access-controlled storage bucket. They are only accessible to your account and cannot be viewed by other users. Screenshots may contain sensitive trading information such as account balances and chart patterns: they are stored solely to support your personal trading journal and are never shared with third parties.

Data isolation

User-facing data is protected with Row Level Security (RLS). Broker credentials are accessible only to authenticated server routes, which check your identity and filter records by your user ID. Other users cannot read, write, or delete your records through the app.

Third-party services

TradingMC uses Supabase (hosted PostgreSQL and file storage) to store your data. Supabase is a SOC 2 compliant platform. Your data resides in the EU region. We do not sell or share your data with advertisers or analytics providers.

Data deletion

You can request full deletion of your account and all associated data by emailing info@cddegroot.nl. We will process your request within 30 days. We do not claim full legal compliance (GDPR, CCPA) at this stage of development: deletion requests are handled manually.

Contact

Questions about your data? info@cddegroot.nl