In short: we collect your account details and the trading data you choose to give us so we can show you analytics about your own performance. We don't sell your data, we don't trade on it, and we only share your individual trading data with the service providers who help us run Fractals and with anyone you choose to share it with, such as a trading mentor.
This policy explains how Fractals Trading Technology (company number [COMPANY_NUMBER], registered in England and Wales) ("Fractals", "we", "us") collects, uses, shares and protects your personal data when you use the Fractals website at fractalsjournal.xyz and the Fractals trading-performance platform (together, the "Service").
Fractals Trading Technology is the controller of your personal data. We process it in line with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 ("PECR"). Where you are in the European Economic Area (EEA), we also follow the EU General Data Protection Regulation. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO_NUMBER].
1. Information we collect
Information you give us
- Account details: name, email address, password (stored only as a secure hash), your profile picture choice, and the settings you choose, such as time zone and display currency.
- Trading data: trade history, orders, positions, instruments, prices, fees, P&L, account balances, and any tags, notes, ratings, screenshots or journal entries you add, whether uploaded by CSV, added by hand or synced from a connected platform.
- Platform connection details: when you connect a supported platform, we receive access tokens, API keys or read-only/investor credentials and your account identifiers on that platform. We use these only to import your trading data.
- Billing details: your plan, free trial dates, billing history and billing address. Card details are collected and stored by our payment processor, Stripe; we see only the card type, last four digits and expiry. To make sure each person gets one free trial, Stripe gives us a card "fingerprint", a code that identifies a card without revealing its number.
- Communications: support requests (with the ticket ID we give you), feedback and feature requests, survey responses, and whether you've asked to receive product emails.
- Sharing and mentor details: if you share your journal with a mentor or coach, their email address and the feedback they leave for you.
Information collected automatically
- Usage data: pages and features used, clicks, session times and settings.
- Device and log data: IP address, browser type, operating system, device identifiers, referring URL, and error logs.
- Cookies and similar technologies: see our Cookie Policy.
Information from third parties
- Trading data from platforms you connect.
- Payment and subscription status from Stripe.
- If you sign in with Google or Apple, your name and email from that provider. If you choose Apple's "Hide my email", we receive a private relay address instead.
We don't intentionally collect special category data (such as health, religion or ethnicity). Please don't include it in notes or journal entries.
2. How we use your information and our lawful bases
| Purpose | Information used | Lawful basis |
|---|---|---|
| Create and manage your account | Account details | Contract |
| Import, store and analyse your trades; build your dashboards and reports; sync your journal across your devices | Trading data, connection details | Contract |
| Run your free trial and subscription, take payments, and stop the same card being used for repeat free trials | Billing details, card fingerprint | Contract; legitimate interests (preventing abuse of free trials) |
| Keep tax and accounting records | Billing details | Legal obligation |
| Show your chosen mentor the parts of your journal you share, and show you their feedback | Trading data, sharing details | Contract |
| Answer support requests and send service messages (receipts, security alerts, sync errors, trial and billing reminders) | Account details, communications | Contract |
| Keep the Service secure, prevent fraud and abuse, and fix bugs | Usage, device and log data | Legitimate interests |
| Improve and develop the Service using aggregated or de-identified data, and learn from your feedback | Usage data; de-identified trading data; feedback | Legitimate interests |
| Send product news, tips and offers | Account details | Consent (you can withdraw it any time) |
| Comply with law and enforce our Terms | Any relevant data | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details of that assessment.
Aggregated or de-identified data cannot reasonably identify you. We may use it to understand how Fractals is used, and may publish general statistics (for example, "the average user tags 40 trades a week"). We will never publish or sell your individual trading data.
We do not use your data to place trades, give financial advice, or make solely automated decisions that have legal or similarly significant effects on you.
3. How we share your information
We share personal data only with:
- Service providers who process it on our behalf under contract and confidentiality obligations (processors): hosting, database and sign-in (Supabase and our website host), payments (Stripe), email (Klaviyo and our email delivery provider), analytics (Google Analytics and Klaviyo), and customer support tools. A current list is available on request from privacy@fractalsjournal.xyz.
- Mentors and coaches you invite: they can view the parts of your journal described on the sharing screen. They can't change anything, and you can stop sharing at any time.
- Connected platforms: when you connect a trading platform, we send it the authentication requests needed to retrieve your data.
- Professional advisers such as lawyers and accountants, where needed.
- Authorities where required by law, or to protect the rights, safety or property of you, us or others.
- A buyer or successor if Fractals Trading Technology is involved in a merger, acquisition or sale of assets. We'll tell you before your information becomes subject to a different privacy policy.
- Anyone else with your consent.
We do not sell or rent your personal data, and we do not share it for third-party advertising.
4. International transfers
Fractals Trading Technology is based in the United Kingdom. Some of our service providers store or process data outside the UK, including in [HOSTING_REGION]. When personal data leaves the UK we make sure it is protected by one of the safeguards the UK GDPR allows: a UK adequacy regulation for the destination country, the UK International Data Transfer Agreement or Addendum to the EU standard contractual clauses, or another approved mechanism. You can ask privacy@fractalsjournal.xyz for a copy of the relevant safeguards.
5. How long we keep your information
- Account and trading data: for as long as your account is active. If you delete your account, we delete it from our live systems straight away; copies in backups are overwritten within 30 days.
- Platform tokens and credentials: deleted immediately when you disconnect the platform or delete your account.
- Billing records: 6 years from the end of the financial year they relate to, as required by UK tax law.
- Card fingerprints used for free trials: for as long as we keep the related billing records, so a card can't be reused for repeat trials.
- Support requests and feedback: up to 2 years after the conversation ends.
- Logs: up to 12 months.
6. How we protect your information
We use industry-standard measures including encryption in transit (TLS) and at rest, encrypted storage of platform tokens and credentials, hashed passwords, row-level access controls so each account (and any mentor you invite) can only reach the data it's allowed to, limited staff access, and regular backups. We recommend using read-only or investor credentials when connecting a platform, and turning on two-factor authentication in Settings.
No system is completely secure. If a personal data breach occurs, we will report it to the ICO within 72 hours where the law requires, and tell you without undue delay if it is likely to put your rights and freedoms at high risk.
7. Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you.
- Rectify data that is inaccurate or incomplete.
- Erase your data. You can delete your account and data from Settings → Your data → Delete account, or by emailing us.
- Data portability: export your data at any time from Settings → Your data → Download my data.
- Restrict or object to our processing, including processing based on legitimate interests.
- Object to direct marketing at any time. Use the unsubscribe link in any email, or change your choice in Settings.
- Withdraw consent where we rely on it, without affecting processing before you withdrew.
To make a request, email privacy@fractalsjournal.xyz. We'll respond within one month (we may extend this by two further months for complex requests and will tell you if we do). There's no fee in most cases. We may need to verify your identity first.
8. Children
The Service is for people aged 18 and over. We don't knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
9. Changes to this policy
We may update this policy from time to time. We'll post the new version here with a new "Last updated" date and, for material changes, email you at least 14 days before they take effect.
10. Contact and complaints
You can reach us about privacy at privacy@fractalsjournal.xyz or by post at Fractals Trading Technology, [ADDRESS].
If you're unhappy with how we've handled your data, please contact us first so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113). If you are in the EEA, you can complain to your local data protection authority.