1. Who we are & data controller

Tradex Journal ("Tradex", "we", "us", or "our") operates the Tradex Journal platform — a trading journal and performance analytics tool accessible at tradexj.com and its associated mobile applications.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and applicable data protection laws, Tradex Journal is the data controller of personal information collected through this platform.

2. Data we collect

Identifiers

When you create an account we collect:

• Name and email address
• Password (stored as a hashed, salted value — we never see your plaintext password)
• IP address (used for security; not retained beyond 90 days)
• Account ID and session tokens

Trading & financial data

• Trade records you enter manually or import
• Journal entries, notes, and chart screenshots
• Playbook setups and performance scores
• Prop firm challenge details
• Broker API credentials (encrypted at rest; never read by staff)

Commercial information

• Subscription plan and billing history
• Payment method details — processed exclusively by Stripe

3. Lawful basis for processing

Under Article 6 of the UK/EU GDPR, we process your data based on: Performance of a contract (providing the service), Legitimate interests (analytics, security, fraud detection), Legal obligation (tax and financial records), and Consent (marketing emails, analytics cookies, broker API connections).

4. How we use your data

• Providing the service — calculating P&L, generating reports, delivering AI Insights
• Service improvement — understanding how features are used
• Security and fraud prevention — detecting unusual account activity
• Communications — transactional emails and, with consent, product news
• Legal compliance — responding to lawful requests, tax obligations

5. Data sharing & third parties

We do not sell, rent, or trade your personal information or trading data to any third party.

We share data only with service providers bound by Data Processing Agreements:

• Stripe — payment processing
• Amazon Web Services — cloud infrastructure and database hosting
• Postmark — transactional email delivery
• Sentry — application error monitoring (scrubbed of trading data)

6. Data security

• All data in transit is encrypted using TLS 1.3
• All data at rest is encrypted using AES-256
• Passwords are hashed with bcrypt before storage
• Broker API credentials are stored in an isolated, encrypted secrets vault
• Access to production systems requires MFA and VPN
• We conduct regular security reviews and periodic third-party penetration tests

If you discover a security vulnerability, please disclose it responsibly to security@tradexj.com.

7. Data retention

• Account and trading data — retained for the life of your account plus 30 days after deletion
• Payment records — retained for 7 years (tax compliance)
• IP address logs — retained for 90 days then deleted

8. Your privacy rights

Under UK/EU GDPR you have the right to: access your data, correct inaccuracies, erasure ("right to be forgotten"), restrict processing, data portability, and object to processing. To exercise any right, email privacy@tradexj.com. We respond within one calendar month.

9. Cookies & tracking

We use strictly necessary cookies (session authentication, CSRF protection) and, with your consent, analytics cookies. We do not use advertising, retargeting, or third-party behavioural cookies.

10. Children's privacy

Tradex Journal is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, contact privacy@tradexj.com.

11. Contact