Privacy Policy

Last updated: 2026-10-15

This policy describes what data TradeYar collects, where it goes, and how you can control or delete it. Every statement reflects what the code actually does.

What we store (server-side)

The following data is stored in Supabase (hosted PostgreSQL):

  • Your trades and their contents — including free-text notes, reviews, tagged emotions, behaviours, and any images you attach.
  • Trading account configuration — name, broker, platform, currency, balance, and rules you write.
  • Billing status — subscription tier and current period end.
  • AI Coach Memory — the free-text context you write in Settings to describe your trading style. Stored verbatim.
  • Saved AI Coach conversations — the questions you ask the Coach and the Coach’s answers, plus the scope used for each answer (the accounts and symbols filter) and the time of each message. Stored so you can revisit them. You can view, rename and delete conversations in the AI Coach page at any time.
  • Saved Coach memory notes — short notes (at most 300 characters each, and at most 20 notes) that you choose to save in the AI Coach page. Stored verbatim, except that line breaks and repeated spaces are collapsed into single spaces. These notes are separate from the AI Coach Memory text in Settings. You can view, edit and delete memory notes in the AI Coach page at any time.
  • Notebook entries — when you are signed in, the entries you write in the Notebook (date, title, mood, market, content and plan) are stored in our database.
  • Playbook strategies — when you are signed in, the strategies you write in the Playbook, including their rules and notes, are stored in our database.
  • Saved Full AI analysis — the AI-generated analysis text for a trade you analyse, stored per trade so you can view it again; it is deleted when you delete that trade.
  • Broker sync keys — if you create a key for the MT4, MT5, cTrader or NinjaTrader programs: its name, a short public prefix used to find it, a one-way hash of the key (never the key itself), the TradeYar account it is bound to, the platform, the account number and server name your platform reports, and when it last synced.
  • cTrader connection — if you connect a cTrader ID: the access and refresh tokens, stored encrypted (AES-256-GCM) with a key that is held only on our server; the list of cTrader accounts you granted, the TradeYar account each one is linked to, and the sync progress. The access we ask for is view-only: it can read account information and trade history and cannot place or change orders.
  • Synced trades — what the sync programs or the cTrader connection send (symbol, side, size, prices, times, profit, commission, swap and the broker’s position id) is stored as your trades, like an import. We never receive your broker password.
  • Messages to the support team — only if you send one from the support chat (see “Support chat” below).
  • Usage events — records of which features you use and when (for example, completing an import or viewing a page), tied to your user ID. Used only to improve the product. No third-party tool receives this data. (This is separate from the optional visit statistics described below.)

What stays on your device

Settings, chart drawings, cached price bars, and cached AI responses are stored in your browser (localStorage and IndexedDB). They are not uploaded to our servers. When you are signed in, Notebook entries and Playbook strategies are stored in our database (see above); a copy may also be kept in your browser.

Authentication and e-mail

Login sessions are held in HTTP cookies managed by Supabase. When you sign up, sign in with a link or reset your password, your e-mail address and the message are handled by Supabase and sent through Resend, our e-mail delivery provider.

Broker sync (optional)

If you use the sync programs (an Expert Advisor for MT4 or MT5, a cBot for cTrader, an AddOn for NinjaTrader), they run on your own computer, read your closed trades and send them to our server over HTTPS with the key you created. They never trade. You can revoke a key in Settings at any time; it stops working immediately.

If you connect a cTrader ID instead, we use your stored token to ask cTrader’s servers for your trade history, when you press a button in Settings and, for plans that include it, automatically about every three hours. Disconnect in Settings deletes the stored tokens here; trades that were already imported stay in your journal. To also remove our access on cTrader’s side, revoke it in your cTrader ID settings. None of this data is sent to anyone else.

Support chat

The support chat on the site answers from our help articles. Your question is sent from our server to OpenRouter (an AI provider) after we remove e-mail addresses, keys, tokens and card-like numbers from it; no account identifier is sent. The conversation itself is not stored on our servers.

To limit abuse we count messages per visitor: for signed-out visitors with a salted one-way hash of the IP address (we do not store the IP address itself for this), for signed-in users with the user ID. These counters are cleaned up automatically after a short time. Our hosting provider keeps its own standard request logs.

If you choose to send a message to the team, we store your e-mail address, your message, up to the last twelve chat messages (cleaned the same way), the page you were on, and your user ID if you were signed in, so that we can reply. These messages are kept until we delete them; they are not part of the automatic 30-day account deletion, so email [email protected] if you want yours removed.

Service providers

These companies process data on our behalf:

  • Supabase — database and sign-in (hosted in Germany).
  • Vercel — hosting, the server code of the site, and cookie-free page-view counts (see “Optional visit statistics”).
  • OpenRouter — AI processing (see below), the Assistant and the support chat.
  • Paddle — payments, as Merchant of Record.
  • Resend — sending sign-up, sign-in and password-reset e-mails.
  • Groq — transcription of voice input.
  • Tavily — web search in the Assistant, when you switch it on.
  • Google Analytics — visit statistics, only if you press Accept in the banner.
  • Market data providers — only a symbol and timeframe (see below).
  • cTrader (Spotware) — only if you connect a cTrader ID: we call their service with your token.

Optional visit statistics

When you first visit, a small banner asks whether TradeYar may use Google Analytics 4 to count visits, traffic sources and sign-ups. If you press Accept, Google’s script is loaded, it sets cookies in your browser (for example one named _ga), and it sends page views and sign-up and login events to Google. If you press Decline, or do not answer, the script is not loaded and none of these cookies is set. Your choice is stored only in your browser, and declining changes nothing in the product.

Accept also lets TradeYarkeep the campaign tags of the link that first brought you here (utm_source, utm_medium, utm_campaign, utm_content and utm_term, for example “youtube” and the name of a video) in your browser, plus that page’s path and the time of the visit. When that first visit came from another website, such as a search engine, only that website’s domain is kept (for example “google.com”), never the address of the page you were on or what you searched for. If you then create an account, these details are saved once with your new account and removed from your browser, so we can count which posts, videos and searches bring sign-ups. An account that already existed is never tagged. No browsing history or other page is recorded. If you decline, nothing is kept. These details are deleted together with your account.

to see the banner again.

Separately, TradeYarcounts page views with Vercel Web Analytics, which sets no cookies and stores nothing in your browser. For each page view it receives the page address (without anything after a “?”), the referring website, and your country, browser, operating system and device type. Vercel tells visitors apart only by a value derived from the request that resets every day, so a visitor cannot be followed across days or across websites. We see only totals, never an individual visit.

Apart from these two statistics tools, TradeYar uses no third-party trackers.

AI processing

When you use the AI Coach or AI trade review, aggregated trading statistics and, for AI trade review, per-trade details of the reviewed trade that you entered or imported (such as symbol, prices, times and result) are sent from our server to OpenRouter, which routes them to a model provider. No account identifier is included — no email address, no user ID, no account name, and no broker name reaches the AI provider.

One caveat: free text you write can be appended to the prompt. When the AI Coach answers a question about your trading, the prompt can include your question, the free-text AI Coach Memory you write in Settings, your Playbook strategy names with their rules and notes, and your Notebook entries (date, title, mood, market, content and plan). When you use AI trade review, the prompt can include that trade’s notes, review, strategy and tags, and the name and rules of the Playbook strategy linked to it. The Full AI analysis of a trade is told from facts the journal itself computed (the trade, the trades around it, your own statistics) together with the sentences from your Notebook and Playbook that the journal found relevant to that trade, quoted next to its numbers; it does not receive your Notebook or Playbook as raw text. If you include personal details in that text, they will be sent.

Notebook and Playbook reading: so that the AI Coach can show what you wrote next to a trade’s real numbers (for example a daily trade limit you set), the text of your Notebook entries and Playbook rules is sent from our server to OpenRouter and the model provider behind it, to find those sentences. Only text that is new or has changed since the last time is sent, with no e-mail address, name, user ID or account name. This is on by default and you can turn it off at any time in Settings → Notebook & Playbook reading; nothing more is sent after that. What was already found stays in your own analysis document, which only you can read, until you reject it.

Every request to OpenRouter asks to be routed only to providers that do not collect or train on prompts, and our OpenRouter account is set to exclude endpoints that train on or publish prompts. A provider may still keep a request for a limited time for security or abuse monitoring under its own terms, so we cannot promise that no provider ever holds a copy while it answers.

Saved Coach conversations and saved Coach memory notes are not currently sent to the AI provider: earlier messages in a conversation and your memory notes are not included when the Coach answers a new question.

The providers reached through OpenRouter for the AI Coach and AI trade review are configured not to use this data for training or make it public. The Assistant and voice input described next use other providers with their own terms.

AI Assistant and voice input

The Assistant (general market questions) and voice input are separate from the AI Coach. They do not receive your trades, accounts, notes, AI Coach Memory or any account identifier such as your e-mail address or user ID.

  • Assistant — when you send a message, our server sends the last few messages of that conversation (at most twelve) and anything you attach to the newest one (up to three images and three text files) to OpenRouter, which passes them to the AI model provider that answers. Please do not attach images or files that show personal information you do not want to share.
  • Web search in the Assistant — if you switch it on, the first 300 characters of your newest message are sent to Tavily, a web search service, and the titles, addresses and short excerpts it returns are added to the prompt.
  • Voice input — the recording you make with the microphone button is sent from our server to Groq for transcription. The text comes back into the chat box for you to check before sending; the recording is not stored by us.

A PDF you attach is turned into text on our server (the PDF itself is not stored) and that text is then sent like any other attached file. These features are part of paid plans. We do not store Assistant conversations or recordings on our servers: the Assistant’s conversation history stays in your browser only, and images are not kept at all.

Market data

Price lookups send only a symbol and a timeframe to market data providers (Yahoo Finance, TwelveData, Dukascopy). No user data is included in these requests.

Payments

All payment processing is handled by Paddle, which acts as Merchant of Record. TradeYar never sees or stores your card details. Paddle’s own privacy policy governs information you provide during checkout.

Deletion

You can delete individual trades and trading accounts from within the app. All trades can be deleted at once from Settings.

Saved Coach conversations and Coach memory notes are deleted from our servers when you delete them in the AI Coach page.

Full account deletion is self-service: Settings → Delete Account. When you confirm:

  • Your active subscription is cancelled (takes effect at the end of the current billing period; no mid-period refund).
  • Your profile, trades, accounts, and AI Coach Memory are marked for permanent deletion from our servers in 30 days.
  • Your saved Coach conversations and Coach memory notes are deleted with your account, in the same 30-day deletion process as the rest of your data.
  • Your sync keys stop working and your cTrader connection (including the stored tokens and the account links) is deleted as soon as you confirm account deletion; the sync key records themselves are erased in the same 30-day process as the rest of your data.
  • Your Notebook entries, Playbook strategies, saved Full AI analyses and usage events are deleted with your account, in the same 30-day deletion process as the rest of your data.
  • Your device data (settings, chart drawings, cached price bars, cached AI responses) is cleared from your browser immediately.
  • Your login session is revoked.

Data is permanently removed from our servers 30 days after you request deletion. To cancel the deletion within that window, sign in again and choose “Cancel deletion”; your journal comes back, but your subscription is not restored and sync keys and broker connections must be set up again. After 30 days the deletion is irreversible.

Export

Your trades can be exported to CSV or XLSX from the app at any time. This export covers trade records; it does not include screenshots, chart drawings, or AI Coach Memory.

Neither the trade export nor the JSON backup in Settings includes saved Coach conversations or Coach memory notes.

Legal basis (GDPR)

Where the General Data Protection Regulation applies, TradeYar relies on the following lawful bases:

  • Performance of a contract — processing your trades, accounts, and billing status is necessary to provide the service.
  • Legitimate interests — protecting the security and integrity of the service and preventing fraud.
  • Legal obligation — where applicable law requires retention or disclosure of data.
  • Consent — the AI Coach Memory feature and the optional Google Analytics statistics rely on your freely given consent; you can delete the memory at any time in Settings and change your statistics choice at any time on this page.
  • Legitimate interests also cover the per-visitor message counters of the support chat (preventing abuse).
  • Vital interests — not generally relied upon; noted for completeness.

Retention

Your data is kept for as long as your account exists. When you request account deletion, your personal data is permanently removed from our servers within 30 days. Some data may be retained briefly by Paddle for billing and tax compliance.

Your rights (EEA and UK)

If you are located in the EEA or the UK you have the right to:

  • Access the personal data we hold about you.
  • Correction of inaccurate or incomplete data.
  • Deletion of your data.
  • Portability — receive a copy of your data in a machine-readable format.
  • Objection to processing based on legitimate interests.
  • Restriction of processing in certain circumstances.
  • Withdrawal of consent where processing is based on consent.

To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with your national supervisory authority.

International transfers

The database (Supabase) is hosted in Germany within the EEA. OpenRouter and Paddle operate outside the EEA; transfers to them rely on Standard Contractual Clauses as the applicable transfer mechanism. If you press Accept in the statistics banner, Google also processes the visit statistics outside the EEA, under the transfer mechanisms in Google’s own terms. Vercel (hosting), Resend (e-mail), Groq and Tavily may process data outside the EEA under their own data-processing terms.

US state privacy rights

Residents of California and other US states with applicable privacy laws have the right to access, delete, and correct their personal information. TradeYar does not sell personal information and does not share it for targeting or profiling purposes. To exercise these rights, email [email protected].

Privacy questions and deletion requests: [email protected]