Privacy Policy

• To provide the Service — run replay sessions, persist your trades and journal, and compute your analytics and coaching feedback (performance of a contract with you).
• To operate plans and billing — enforce Free-plan limits, manage Pro subscriptions, and (in future) process payments through a payment processor.
• To keep the Service secure — authentication, rate limiting, abuse and fraud prevention, debugging, and monitoring (our legitimate interest in running a safe service).
• To communicate with you — transactional email such as welcome messages, session reports, subscription notices, and password-change alerts. These are service messages, not marketing; if we ever send marketing email it will be opt-in with a working unsubscribe.
• To comply with law — tax, accounting, and lawful requests.

We do not sell your personal information, and we do not use your journal or trading data to advise, rank, or profile other users.

• Application data is stored in a PostgreSQL database managed by Supabase; the application is hosted on Vercel. Data is hosted in Singapore (Supabase PostgreSQL) and the application is served from Vercel's Singapore (sin1) region.
• Data is encrypted in transit (TLS) and at rest by our hosting providers. Access to production data is restricted and authenticated.
• Some data is also cached in your own browser (market-data chunks and workspace state in IndexedDB/localStorage) for performance — see the Cookie Policy. It stays on your device and you can clear it through your browser at any time.
• No method of transmission or storage is 100% secure; we cannot guarantee absolute security, but we notify affected users of breaches as required by law.

• Account and practice data: kept while your account exists so your history, analytics, and coaching remain available to you.
• On account deletion: your account row and all practice data (sessions, trades, reports, journal, labels, progress) are deleted immediately via cascading deletion, and we also delete the authentication user. Residual copies may temporarily remain in backups maintained by our infrastructure providers until those backups are overwritten or expire in accordance with the providers’ retention policies.
• Logs and error reports: retained for a short operational window and then aged out.
• Billing records (when payments launch): retained as required by tax and accounting law.

We share personal data only with processors that help us run the Service, under their own contractual and legal safeguards:

• Supabase — authentication and database hosting.
• Vercel — application hosting and edge network (sees request metadata such as IP addresses).
• Resend — transactional email delivery (sees your email address and message content).
• Sentry — error monitoring (sees error context and request metadata).
• Stripe / Razorpay (future) — payment processing once paid subscriptions are enabled. The processor handles your payment details under its own privacy policy; this Policy will be updated when payments go live.

We currently run no third-party advertising or behavioral analytics on the Service. If we add a product-analytics tool, we will update this Policy and the Cookie Policy first, and request consent where required. We may also disclose information if required by law, or in connection with a merger or acquisition (with notice to you).

Built into the product, no email required:

• Access & export: download a complete export of your account data and trade history from Settings at any time.
• Correction: edit your profile, journal entries, tags, and labels directly in the app.
• Deletion: permanently delete your account and all associated data from Settings. This is immediate and irreversible.

The Service is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has created an account, contact us (see the Contact section) and we will delete it.

The Service is operated from and hosted in the regions listed in Section 3. By using the Service you understand that your information is processed in those regions, which may have different data-protection laws than your own. We apply the protections in this Policy to all users regardless of location.

We may update this Policy as the Service evolves. Each version carries a version number and effective date at the top of this page. For material changes we will notify you and require re-acceptance before you continue using the Service.

Privacy questions and rights requests: tradeforge.replay@gmail.com.