Privacy Policy

• Account: your email address and password (stored only as a secure hash by our authentication provider), or your basic Google profile if you sign in with Google, plus your settings and time zone.
• Your journal and plans: trades, executions, notes, emotions, checklists, trading plans and rules, daily notes, accounts and prop-firm limits, prop-firm costs, watchlists, backtests and practice trades, lessons progress and screenshots you upload.
• Connections: broker API keys, tokens and links you give us (encrypted, used only by our servers), and the fills, positions and balances we sync from them; alerts sent from TradingView or our NinjaTrader and MetaTrader add-ons.
• Public profile (only if you compete publicly): handle, picture, banner, bio, chosen cosmetics, season scores, linked prop firms, posts, reactions, follows, rivals and reports you make.
• Payments: handled by Paddle. We receive your plan, its status, renewal dates and amounts — never your full card number.
• AI features: messages you send the coach, the data used for weekly reviews and screenshots you submit as proof.
• Technical and safety data: IP address and device information at sign-up and when you use the Service, error logs, push-notification subscriptions, and a random visitor ID kept in your browser to count profile views once a day (it is not linked to your identity).
• Moderation records: the result of automated and manual checks on content you publish, reports, strikes and restrictions.

• To provide the Service: your journal, statistics, rules and locks, syncs, reminders, AI features, backtesting and support.
• To run the leaderboard, public profiles and the trade feed, for people who choose to compete.
• To keep the Service safe: moderating content, verifying results, preventing fraud, abuse, multiple accounts and attacks.
• To process payments, prevent payment fraud and keep required records.
• To improve the Service using aggregated or de-identified information.
• To send you service messages (for example security, billing or changes to our terms) and, if you turn them on, reminders.
• To comply with the law and enforce our Terms of Service.

We do not use your personal data for advertising, and we do not make decisions with legal or similarly significant effects about you solely by automated means. Automated moderation can hide content or pause posting; you can ask a person to review any decision.

• Contract: to provide the Service you signed up for.
• Legitimate interests: safety, fraud prevention, moderation, improving the Service and keeping it secure — balanced against your rights.
• Consent: competing publicly, push reminders and optional features; you can withdraw consent at any time in Settings.
• Legal obligation: tax, accounting and responding to lawful requests.

We never sell or rent personal data, and we don't share it for cross-context behavioural advertising. We share it only with:

• Service providers that process it on our behalf under contract: hosting and edge delivery (Lovable and its infrastructure providers, including Cloudflare), database, authentication and file storage (Supabase), AI models used through Lovable's AI gateway (including OpenAI), payments (Paddle) and Google sign-in.
• Services you connect, at your direction: your broker or platform (Tradovate, TopstepX, Alpaca, Interactive Brokers and others), TradingView and your AI assistant.
• Other users and the public, only for what you choose to make public by competing or posting.
• Authorities or others when required by law, or when necessary to protect the rights, safety or property of our users, the public or us.
• A buyer or successor if we are involved in a merger, acquisition or sale of assets, under this policy.

Some pages load fonts from Google Fonts, which receives your IP address to deliver them. Market prices for crypto replays come from Coinbase without any personal data.

Our providers may process data in the United States and other countries. Where required, transfers are protected by appropriate safeguards such as the European Commission's standard contractual clauses or equivalent mechanisms.

• Your account data and journal: for as long as you keep your account.
• When you delete your account, we delete your account and journal data right away; copies in backups are overwritten within 30 days.
• Sign-up safety records (such as the IP address used to sign up): up to 24 months, including after you delete your account, so removed accounts can't simply sign up again.
• Moderation records: for as long as you keep your account, up to 24 months.
• Billing records: kept by Paddle and by us as tax and accounting laws require (often up to 7 years).
• Logs: typically under 30 days.

We protect data with encryption in transit (HTTPS with strict transport security), encryption of broker credentials at rest, row-level access rules so each account can read only its own data, rate limits, signed webhooks and least-privilege access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the authorities as the law requires.

• Export all your data as CSV or JSON from Settings → Data, on every plan.
• Delete your account and data yourself from Settings → Data.
• Correct your data in the app, or ask us to.
• Go private at any time by turning off competing; your profile and posts disappear from public view.
• Turn off reminders and push notifications in Settings or your device.

Depending on where you live, you may also have the right to access, port, restrict or object to processing, to withdraw consent, and to complain to your data protection authority. California residents have the right to know, delete and correct personal information and not to be discriminated against for exercising these rights; we do not sell or share personal information as those terms are defined under California law. Email privacy@jointradecompass.com to exercise any right; we may need to verify your identity, and we will respond within the time the law requires.

We use only what the Service needs: your sign-in session, preferences such as theme and currency, read notifications, referral codes and the random view-counting ID. We don't use advertising or third-party tracking cookies, so there is nothing to opt out of.

The Service is for adults 18 and over. We do not knowingly collect data from anyone under 18; if you believe a minor has an account, tell us and we will delete it.

We may update this policy. If a change is material, we will tell you in the Service or by email before it takes effect. The "last updated" date above shows when it last changed.

Privacy questions and requests: privacy@jointradecompass.com. Everything else: support@jointradecompass.com.