Privacy policy

1. Who controls your data

TrX Journal is the controller of the personal data described here. Contact us at [email protected].

2. What we collect

We deliberately collect very little.

• Your email address. Received from Whop when you buy, so we can create your account and send your credentials.
• Your account record. A generated username, a bcrypt hash of your password (never the password itself once you have changed it), your tier, your account status, and your access expiry date.
• Your journal. The trades, notes, tags, rules, and settings you create or import, stored as a single record against your account.
• Your payment identifiers. The Whop membership and user identifiers, so we can match a refund or cancellation to your account.
• Minimal server logs. IP address and request metadata, kept briefly for security and abuse prevention.

We never see or store your card details. Payment is handled entirely by Whop. We do not use advertising trackers, and we do not sell or share your data with anyone for marketing.

3. Your CSV file and broker connections

When you import a CSV, the file is parsed in your browser. The file itself is never uploaded to us. Only the trades that result from the import — and that you choose to save — are stored against your account so you can reach your journal from another device.

If you connect a broker, we hold what that connection needs and nothing more. For a direct connection that is the read-only API key you add, stored AES-256-GCM encrypted and used only to read your executed fills. For a Feed API connection we store a hash of its token, never the token. The fills a connection brings in are stored against your account so your browser can pair them into trades. We never use a connection to place an order or move money, and nothing in the software can. Remove a connection and its key and fills are deleted at once; the trades already in your journal stay until you delete them.

4. Why we are allowed to hold it

We process your email address and account record to perform our contract with you — we cannot deliver the software without them. We process minimal server logs on the basis of our legitimate interest in keeping the service secure.

5. Who we share it with

We use three processors, and no others:

• Whop — processes your payment and passes us the email address you used at checkout so we can fulfil your order. Whop handles your payment details under its own privacy policy; we never receive them.
• Resend — sends your credential email and any password-reset email. It receives your email address and the message content.
• Our hosting and CDN providers — operate the server and the network in front of it.

We do not sell your data, and we do not share it for anyone else’s marketing.

6. How long we keep it

• Your account and journal — for 3 years of access plus a short grace period, or until you delete your account, whichever comes first.
• Your initial generated password — held encrypted for at most 7 days and destroyed the moment it is revealed to you, whichever is sooner.
• Server logs — a short rolling window, then discarded.
• Records we must keep by law — such as transaction records for tax, for as long as the law requires.

7. Your rights

You can ask us to give you a copy of your data, correct it, delete it, or restrict how we use it. Two of these you can do yourself, immediately, from Settings:

• Export — download your entire journal as CSV or JSON at any time, including after your access term ends.
• Delete — permanently erase your account and journal. This is a real deletion, not a hidden flag, and it cannot be undone.

For anything else, email [email protected]. If you are in the UK or EU and think we have handled your data badly, you may also complain to your local data protection authority.

8. Security

Passwords are hashed with bcrypt and never stored in plain text. Sessions are held in an encrypted, http-only cookie. The database is not reachable from the public internet, and all traffic to the site is encrypted in transit.

9. Children

TrX Journal is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.

10. Changes

If we change this policy in a way that materially affects you, we will email the address on your account.