Privacy Policy

1. Who is responsible for your data

The data controller for the Service is the operator of TradeMirror (an independent developer). For privacy requests, contact us at privacy@trade-mirror.app or via the in-app Feedback form at /en/feedback.

2. Data we collect

We collect the following categories of information when you use the Service:

• Account data: email address, authentication identifiers (via Supabase Auth), optional profile settings (persona, timezone, locale, account size for rule calculations, subscription plan).
• Trading data you upload: CSV files and parsed trade records (e.g. dates, symbols, P&L, optional side/quantity, notes, computed violation flags). We do not connect to your brokerage or store brokerage passwords.
• Generated content: AI weekly reports, habit acknowledgements, optional public share tokens for reports you choose to share.
• Usage data: monthly usage counters (e.g. trade/report limits), import history metadata (filename, row counts).
• Waitlist and marketing: email, locale, optional "interested in Pro" flag if you join the waitlist on the marketing site.
• Feedback: message content, category, optional email, page path, and your user ID if you are signed in.
• Technical data: session cookies required for login, server logs from our hosting provider (IP address, user agent, timestamps), and error diagnostics. We do not intentionally collect government ID numbers or payment card data in the current Beta (billing is not live).

3. How we use your data

We use personal data only to operate and improve the Service, including to:

• Create and secure your account (magic link or Google sign-in).
• Import, store, and display your trades; evaluate prop-style rules; generate weekly analytics reports.
• Send transactional email (sign-in links, optional weekly digest if enabled).
• Enforce plan limits, prevent abuse, and respond to support or feedback.
• Comply with law and protect the security of the Service.
• We do not sell your personal data. We do not use your trade data to provide investment recommendations or signals.

4. Legal bases (EEA/UK users)

If you are in the European Economic Area or United Kingdom, we process personal data on the following bases:

• Contract: to provide the Service you request (account, import, reports).
• Legitimate interests: security, fraud prevention, product improvement, and limited analytics, balanced against your rights.
• Consent: where required (e.g. optional waitlist marketing interest, optional report sharing links you enable).
• Legal obligation: where we must retain or disclose data under applicable law.

5. Service providers (sub-processors)

We use trusted third parties to run the Service. They process data on our instructions and under appropriate agreements:

We may add or change providers as the product evolves; we will update this policy when materially relevant.

• Supabase — authentication, database, and file metadata storage (region depends on your project; typically United States or European Union).
• Vercel — application hosting and edge delivery.
• Resend — transactional email delivery (e.g. magic links, weekly digest).
• DeepSeek — AI inference to generate weekly report text from aggregated trade statistics you already stored (API calls are made server-side; we do not send your brokerage credentials).
• Google — optional OAuth sign-in (subject to Google's privacy policy when you choose "Continue with Google").

6. International data transfers

The Service is hosted and data is primarily stored on infrastructure located outside your country (commonly the United States). If you access the Service from China, the EEA, the UK, or other regions with cross-border transfer rules, you acknowledge that your data may be transferred to and processed in those locations.

Where required, we rely on appropriate safeguards such as standard contractual clauses or equivalent mechanisms offered by our providers. You may contact us for more information about transfers relevant to your region.

7. Data retention

We retain data only as long as necessary for the purposes described:

• Account and trading data: kept while your account is active.
• Deletion: you may request account deletion in Settings. After confirmation, access is revoked immediately; associated data is scheduled for permanent deletion after a 30-day grace period (unless we must retain certain records for legal compliance).
• Waitlist and feedback: retained as long as needed for the purpose collected, or until you ask us to delete applicable entries.
• Server logs: retained for a limited period per our hosting provider's defaults, then rotated or deleted.

8. When we disclose data

We may disclose personal data only:

• To service providers listed above, under contract.
• If you enable a report share link — report content (without your email) may be viewed by anyone with the link.
• When required by law, court order, or to protect rights, safety, and security.
• In connection with a merger, acquisition, or asset sale, with notice where required by law.

9. Your rights and choices

Depending on your location, you may have the right to access, correct, delete, export, or restrict processing of your personal data, withdraw consent where applicable, or lodge a complaint with a supervisory authority (EEA/UK).

To exercise rights, email privacy@trade-mirror.app from your account email or use in-app account deletion. We may verify your identity before fulfilling requests.

10. Cookies and similar technologies

We use essential cookies for authentication and session management (Supabase). These are necessary for the Service to function. We do not use advertising cookies in the current Beta. If we add privacy-friendly analytics (e.g. Plausible), we will update this section and, where required, obtain consent.

11. Security

We implement technical and organizational measures appropriate to the risk, including HTTPS, row-level database access controls, server-side storage of sensitive API keys, and access restrictions on administrative operations. No method of transmission or storage is 100% secure; you use the Service at your own risk.

12. Children

The Service is not directed to anyone under 18. We do not knowingly collect personal data from children. Contact us if you believe a child has provided data and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page with an updated "Last updated" date. Material changes may be notified via email or in-app notice where appropriate. Continued use after changes constitutes acceptance where permitted by law.

14. Contact

Privacy inquiries: privacy@trade-mirror.app

General support: /en/feedback