This Privacy Policy explains how MRT Trading Journal collects, uses, stores, and protects your personal data. We comply with the EU General Data Protection Regulation (GDPR) and applicable data protection laws.
§ 1 — Data Controller
The data controller responsible for your personal data is Mickael Ramy, the individual operating MRT Trading Journal, contactable at:
- Email: privacy@mrtjournal.com
- Website: mrtjournal.com
§ 2 — Data We Collect
2.1 Account Data
- Name (display name you provide at registration)
- Email address
- Encrypted password (stored as a secure hash — we never see your actual password)
- Account creation date
2.2 Trading Data (User Content)
- Trade logs: dates, instruments, direction, P&L, grades, session, model, notes
- Confluence selections and strategy definitions
- Chart screenshots you choose to upload
- Onboarding preferences (experience level, trading style, sessions, goals)
- Custom confluence lists and pre-trade checklists
2.3 Usage Data
- Pages visited and features used within the app (anonymised)
- Session timestamps and approximate session duration
- Error logs and performance data for service improvement
2.4 Payment Data (when paid plans are introduced)
- Billing name and last 4 digits of payment card
- Payment history and subscription status
Full card data is processed exclusively by Stripe and is never transmitted to or stored by us.
2.5 AI Coach Interactions
Messages sent to the AI Coach feature are transmitted to Anthropic's API to generate responses. These messages include contextual data from your trade history to enable personalised responses. Anthropic processes this data in accordance with their privacy policy. We do not store your AI conversation history beyond your active session.
§ 3 — How We Use Your Data
We process your personal data for the following purposes:
- To provide, maintain, and improve the Service.
- To authenticate you and keep your Account secure.
- To process payments and manage your subscription (when applicable).
- To send you transactional emails (account confirmation, password reset, billing).
- To send you product updates and feature announcements (you may opt out at any time).
- To analyse anonymised usage patterns to improve the Service.
- To comply with applicable legal obligations.
§ 4 — Legal Basis for Processing (GDPR)
Where GDPR applies, our legal bases for processing are:
- Contract performance — to provide the Service you signed up for (Art. 6(1)(b)).
- Legitimate interests — anonymised analytics, fraud prevention, and security (Art. 6(1)(f)).
- Consent — marketing emails, which you may withdraw at any time (Art. 6(1)(a)).
- Legal obligation — where required by applicable law (Art. 6(1)(c)).
§ 5 — Data Sharing
We do not sell, rent, or trade your personal data. We share data only with the following trusted service providers, solely to operate the Service:
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database & authentication | EU / US |
| Stripe | Payment processing | US (EU adequacy) |
| Anthropic | AI Coach API | US (EU adequacy) |
| Vercel | Hosting & CDN | Global |
We also disclose data to law enforcement or regulatory authorities when required by applicable law.
§ 6 — Data Retention
- We retain your Account data and User Content for as long as your Account remains active.
- If you close your Account, all personal data is permanently deleted within 30 days.
- Anonymised analytical data (with no personal identifiers) may be retained indefinitely.
- Backup copies may be retained for up to 90 days following deletion for disaster recovery purposes, after which they are permanently destroyed.
§ 7 — Your Rights
Under GDPR and applicable data protection laws, you have the following rights:
- Right of access — request a copy of all personal data we hold about you.
- Right to rectification — correct any inaccurate data via your Account settings.
- Right to erasure — delete your Account and all associated data via Settings → Account → Delete Account.
- Right to data portability — download your trade data as a structured file via Settings → Export.
- Right to object — opt out of marketing communications at any time.
- Right to restrict processing — in certain circumstances, request that we limit how we use your data.
- Right to lodge a complaint — you may file a complaint with your national data protection authority, or with Poland's UODO — Prezes Urzędu Ochrony Danych Osobowych (uodo.gov.pl).
To exercise any of these rights, contact us at: privacy@mrtjournal.com
We will respond within 30 days.
§ 8 — Cookies and Local Storage
We use the following browser storage mechanisms:
- Session cookies — to keep you authenticated (essential, cannot be disabled).
- Local storage — to save your app preferences, confluence settings, and checklist locally on your device.
We do not use advertising cookies, third-party tracking cookies, or analytics cookies that identify you personally.
§ 9 — Security
We take appropriate technical and organisational measures to protect your personal data, including:
- TLS encryption for all data in transit.
- At-rest encryption of database contents.
- Passwords stored as bcrypt hashes — we cannot retrieve your plaintext password.
- Screenshots stored in encrypted object storage with access controls.
- Row-level security policies ensuring users can only access their own data.
- Regular security reviews of our infrastructure.
§ 10 — Children
The Service is not intended for individuals under the age of 18. We do not knowingly collect data from minors. If you believe a minor has registered, please contact us immediately at privacy@mrtjournal.com and we will delete the account promptly.
§ 11 — Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email and via an in-app notification at least 30 days before the changes take effect. Continued use of the Service after notification constitutes acceptance.
§ 12 — Contact
This Privacy Policy was last updated in September 2026.