Privacy policy

This draft describes how Simple Trading Journal (“we”, “us”) processes personal data when you visit the website or use the app. It is written for an EU/Belgian sole proprietorship (eenmanszaak) offering software as a service. It is not legal advice.

Controller: [TODO: legal name of the eenmanszaak], [TODO: registered address in Belgium], [TODO: KBO/BCE number], [TODO: VAT number if applicable]. Contact: [TODO: privacy contact email].

What this service does

Simple Trading Journal is a trading journal for logging trades, tracking prop firm accounts and reviewing performance. We process the data you submit so we can provide that service.

What data we collect

Account and authentication (Supabase)

When you create an account we store authentication data via our processor Supabase, typically including email address, password hash (we never see your plaintext password), display name, and a unique user ID. Session cookies are used to keep you signed in. See also the Cookies page.

App content you enter

Depending on how you use the product, this can include trades, notes, strategies, tags, screenshots you upload, funding and payout records, accountability entries, backtesting data, and similar journal content. This is data you choose to store in the app.

Technical and billing-related data

• Basic technical logs needed to run and secure the service (for example IP address in server logs, [TODO: confirm log retention with host]).
• If you later subscribe to a paid plan, payment is handled by Stripe. We may store Stripe customer and subscription identifiers on your profile. Card details are processed by Stripe, not stored on our servers.
• We use Vercel Analytics for aggregated page performance and traffic. It is designed not to use tracking cookies. See the Cookies page.

Legal bases (GDPR)

• Contract (Art. 6(1)(b) GDPR): creating an account and providing the journal service.
• Legitimate interests (Art. 6(1)(f)): securing the service, preventing abuse, and understanding aggregated usage of the website.
• Legal obligation (Art. 6(1)(c)): where we must keep records for tax or accounting (for example paid invoices, if applicable).

Processors and hosting

• Vercel hosts the website and app. [TODO: confirm Vercel region / data location.]
• Supabase provides authentication and the database. [TODO: confirm Supabase project region.]
• Stripe processes payments if you upgrade (only after you start checkout).
• Email delivery for transactional messages (if enabled): [TODO: name the email provider, currently Resend in the codebase — confirm it is in production].

Some processors may be located outside the EEA. Where that happens we rely on appropriate safeguards such as Standard Contractual Clauses, [TODO: confirm transfer tools in each vendor’s DPA].

Retention

Account and journal data are kept while your account is active. If you delete your account (or ask us to delete it), we will delete or anonymise personal data unless we must keep it longer (for example invoices). [TODO: exact deletion timeline, e.g. within 30 days, and backup expiry.]

Your rights

If you are in the EEA/UK you may request:

• access to your personal data
• correction of inaccurate data
• erasure (“right to be forgotten”)
• restriction of, or objection to, certain processing
• data portability of data you provided

To exercise these rights, email [TODO: privacy contact email]. You can also delete data from inside the app where those tools exist (for example account deletion in settings).

You have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données): gegevensbeschermingsautoriteit.be. [TODO: add postal address / contact details you want listed.]

Children

The service is not directed at children. [TODO: minimum age, e.g. 18.]

Changes

We may update this policy. The “Last updated” date at the top will change. [TODO: how users are notified of material changes.]