Privacy Policy

Last updated: October 28, 2026

Tradexy ("we", "us", "our") operates the website tradexy.app and the Tradexy trading journal application. This policy explains how we collect, use, and protect your personal data.

• Account data: name, email address, password (hashed).
• Profile data: timezone, currency preference.
• Trade data: trades, notes, screenshots, and checklist responses you enter.
• Usage data: login timestamps, storage usage.
• Technical data: IP address, browser type, session data.
• Marketing attribution: how you first reached Tradexy: the Google click id (gclid) and UTM campaign parameters when you arrive from an ad or tracked link, the website that referred you (its domain only, never the full address), and the first page you opened. Recorded only with your consent, starting with the page you give it on: the Google click id needs Advertising consent, and the rest needs Analytics consent. Stored on your account at registration, or on your newsletter subscription record (campaign parameters and click id only) if you subscribe to Weekly Insights without an account.
• Newsletter subscription: email address, optional name, and a consent record (timestamp, IP address, browser / user-agent, and the page the form was submitted from), collected only when someone subscribes to Weekly Insights without a Tradexy account. Browser type is the same technical data described above.

• To provide and operate the Tradexy service.
• To personalise your experience (timezone, currency).
• To send account-related emails (password reset, notifications).
• To understand how Tradexy is used and improve it, through product analytics (see PostHog in section 5).
• To measure which channels and campaigns bring sign-ups, using the marketing attribution described above.

Your data is stored on secure servers in the European Union. The Tradexy application, its database and its file storage are hosted by Railway in Amsterdam, the Netherlands. Trade screenshots are stored in private storage and are only accessible to you. We do not sell or share your personal data with third parties for marketing purposes.

We use a small number of trusted third-party service providers ("sub-processors") to operate Tradexy. Each processes personal data only on our instructions, under a data processing agreement (DPA), and only for the purposes described below.

• Railway — hosting. Runs the Tradexy application and stores its database, cache and files, including your trades and trade screenshots, on servers in Amsterdam, the Netherlands.
• Stripe — payment processing. Receives billing and payment details when you subscribe to Pro. PCI-DSS compliant; we never store full card numbers.
• PostHog — product analytics, hosted in the EU (Frankfurt, Germany). PostHog receives nothing about you unless you consent. Public-site browsing events are sent only after you grant Analytics consent in the cookie banner. In the journal and for your account, it takes a separate choice: Product analytics, in your profile. It is off until you turn it on. We offer it when you register, and ask in the journal until you answer. The cookie banner doesn't turn it on, and while you're signed in, public-site events are sent only with both choices. With Product analytics on, PostHog receives the journal pages you open and the features you use, your account id, role, subscription status, timezone and currency preference, technical details of your browser and device (such as browser, operating system and screen size) and, if you also granted Analytics consent in the cookie banner, the marketing attribution described in section 2. It never receives details of your trades, your notes or numbers, what you search for, or page titles, and the journal sends no automatic click tracking. Only when you have granted Analytics consent, events include your IP address, which PostHog uses to estimate your country and city and then discards without storing it; otherwise no IP address is sent with them. PostHog never receives your name or email address. When you withdraw a consent, sending stops at once, and we ask PostHog to delete the profile it holds for you: turning off Product analytics deletes your account's profile there, with its events and any recordings; withdrawing Analytics in the cookie banner deletes this browser's anonymous profile, with the events and recordings PostHog has linked to it, unless it is linked to your account, which only the Product analytics choice controls. PostHog creates that profile when, after consenting, you open most public-site pages or use a free tool. If you withdraw before then, the events already sent are linked only to a random browser id, which PostHog can't delete them by, so they stay until PostHog's retention period ends, and public-site recordings are deleted after 30 days. When PostHog deletes a profile, it removes the events in a background batch. When your account is permanently deleted, its PostHog data is deleted too. On the public site only, and only with Analytics consent, PostHog also records session replays: how you move through pages, click and scroll. What you type into form fields is hidden, but the results the free calculators show you are recorded. The email forms appear only as an empty box: nothing you enter or see in them is recorded. The contents of network requests and browser console messages are not captured. The journal application is never recorded.
• Google LLC — Google Ads conversion measurement. Receives conversion and click identifiers (such as gclid) only when you grant advertising consent, so we can measure whether ads led to sign-ups or subscriptions. Google may process this data outside the EU/EEA under Standard Contractual Clauses.
• Resend — email delivery. Sends transactional account emails (verification, password reset, security notices) and, only if you opt in, marketing/educational emails (Weekly Insights). This includes subscribers who have no Tradexy account as well as registered users who opt in. Resend may process email data for opt-in marketing as Tradexy's service provider, while Tradexy does not share personal data with independent third parties for their own marketing purposes. Unsubscribes from marketing emails are handled by Resend preference pages and mirrored back to your account or newsletter subscription record.
• OpenAI — AI coaching (Pro, opt-in). Receives minimised trade data, including your own notes but never your name, email or account details, when you request AI analysis. Does not use API data to train its models, and applies limited (approximately 30-day) retention for abuse monitoring only.
• Anthropic — AI coaching fallback (Pro, opt-in). Used only when the primary AI provider is unavailable. Receives the same minimised data on the same terms, and does not use API data to train its models.

OpenAI and Anthropic process data outside the EU/EEA. Where data is transferred internationally, it is protected by appropriate safeguards such as Standard Contractual Clauses.

AI coaching is an optional Pro feature that provides non-advisory feedback on your trading behaviour. It is opt-in — no trade data is sent to any AI provider unless you explicitly enable AI coaching and trigger an analysis.

• We send only minimised data (such as instrument, timeframe, position, outcome, R-multiples, and your own notes). We never send your name, email, account identifiers, or raw account balances.
• Your notes, session notes and strategy descriptions are sent as you wrote them, so leave out anything you don't want an AI provider to see.
• Trade screenshots are excluded from AI coaching payloads.
• Coaching requests are not retained by providers for model training, and each analysis is processed as a stateless, self-contained request.
• AI coaching does not provide financial advice or trade signals, and every AI response includes a clear disclaimer.

We use cookies in the following categories. You can change your choice at any time via the Cookie preferences link in the site footer, which reopens the consent banner. Consent is stored per category (Analytics and Advertising). Rejecting Advertising does not affect Analytics, and vice versa.

• Strictly necessary — the Laravel session cookie (tradexy-session) and the XSRF-TOKEN cookie keep you signed in securely and protect forms from cross-site request forgery. These cannot be disabled. Only with your consent, first-touch marketing attribution (UTM fields, the referring domain and the landing page with Analytics consent; gclid with Advertising consent) is kept in this session until you register, then on your user account, so we can attribute sign-ups to channels and campaigns. Nothing is kept from pages you opened before the one you consent on. After you withdraw consent, it is no longer saved to your account or subscription record, and it is removed from the session on your next page view. Session storage does not set an additional tracking cookie.
• Preference — the cookie_consent_v2 cookie stores your Analytics and Advertising choices for one year so we do not re-prompt you on every visit. When you turn off Product analytics in your profile, your browser's local storage keeps tradexy_account_analytics (your account id, that choice and its time) until you clear your browser's site data, so your other open tabs stop sending too. It is never sent to us or to PostHog.
• Analytics — after you grant Analytics consent, we set ph_distinct_id and PostHog ph_* cookies so we can understand how the public site is used, including the session replays described under PostHog in section 5. These cookies are not set if you reject Analytics or have not yet chosen. Once you're signed in to the journal, PostHog runs, and sets these cookies, only when you turn on Product analytics in your profile (section 5). The journal's sign-in, registration and password-reset pages follow the cookie banner's Analytics choice, as the public site does.
• Advertising — after you grant Advertising consent, Google Ads may set conversion cookies (via the Google tag, conversion ID prefixed AW-) so we can measure whether an ad click led to a trial sign-up or paid subscription. Without Advertising consent, Google Consent Mode keeps ad storage denied and conversion measurement is limited or modelled. You can withdraw Advertising consent at any time via Cookie preferences.

If you are in the EU/EEA, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and all associated data.
• Export your trade data in CSV format.
• Object to or restrict certain processing.

To exercise these rights, contact us at privacy@tradexy.app .

If you subscribed to Weekly Insights without creating an account, you can unsubscribe via the link in any email or Resend’s preference page. To request deletion of your newsletter data, email privacy@tradexy.app from the address you subscribed with — we will delete the local subscription record and the corresponding Resend contact.

We retain your data for as long as your account is active. If you delete your account, all personal data is permanently removed within 30 days.

Unconfirmed newsletter subscriptions (addresses that never completed double opt-in) are deleted automatically after 30 days.

We use industry-standard encryption (TLS/HTTPS) for data in transit and bcrypt hashing for passwords. Access to production systems is restricted to authorised personnel.

We may update this policy from time to time. We will notify registered users of significant changes by email.

Questions about this policy? Email us at privacy@tradexy.app .