Privacy policy

2. Data we process

• Account: name, email address, password (stored only as a secure hash); with Google sign-in the identifier provided by Google.
• Trading data you import or enter: executions (fills), trades calculated from them, fees, notes, tags, setups, planned risk, screenshots and monthly recaps.
• Broker connection (optional): Tradovate credentials or access tokens – stored only encrypted (AES-256-GCM) and used server-side solely to fetch your executions.
• Subscription (Pro only): status, term and a customer ID of our payment provider. We never receive or store card details.
• Settings: time zone, language, break-even range, prop-firm rules, profile-sharing settings.
• Technical data: when you visit the site, our hosting provider processes technically necessary data (e.g. IP address, time, requested page) in server logs.

3. Purposes and legal bases

• Providing Tradebell (account, import, metrics, journal, recaps, sharing): performance of contract, Art. 6(1)(b) GDPR.
• Payments and invoices: performance of contract and legal obligations, Art. 6(1)(b) and (c) GDPR.
• Security, abuse and error detection (server logs): legitimate interest, Art. 6(1)(f) GDPR.
• Account emails (e.g. password reset) and – if enabled – monthly recaps: performance of contract; you can turn recap emails off in Settings.

We don't sell data, don't use it for advertising and don't use tracking or analytics tools.

4. Recipients and processors

We use the following providers, who process data only on our behalf and according to our instructions:

• Vercel Inc. (USA) – hosting of the website and application.
• Supabase Inc. (USA) – database and screenshot storage; servers currently in the USA.
• Stripe Payments Europe Ltd. (Ireland) – payment processing for Pro subscriptions.
• Resend Inc. (USA) – sending system emails (once enabled).
• Google Ireland Ltd. – only if you sign in with Google.
• Tradovate / NinjaTrader – only if you connect your broker account; your data is fetched at your request.

5. Transfers to third countries

Some providers are based in or process data in the USA. Transfers rely on the EU-US Data Privacy Framework (adequacy decision) or the EU Standard Contractual Clauses agreed with the providers.

6. Retention

• Account and trading data are kept until you delete your account. Deletion is immediate and complete, including screenshots.
• Invoice and payment records are kept as long as required by law (in Austria generally 7 years, § 132 BAO).
• Server logs are deleted automatically by the hosting provider after a short time.

7. Cookies

We only use strictly necessary cookies: for sign-in (session), your language, the account selected in the menu and the last dashboard period. There are no advertising, tracking or analytics cookies, so no consent is required.

8. Shared profile

If you enable “Share profile” in Settings, anyone with the secret link can see the metrics you chose. You decide what's visible (e.g. whether amounts are shown) and can disable or renew the link at any time.

9. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection. You can export or delete your data yourself anytime under Settings → Data and account; for anything else, email the address above.

If you believe the processing of your data violates data protection law, you can lodge a complaint with the Austrian Data Protection Authority (www.dsb.gv.at).

10. Security

All connections are TLS-encrypted. Passwords are stored only as hashes, broker credentials are additionally encrypted. Screenshots are kept in private storage and are only accessible via short-lived signed links.