Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your email address and, optionally, a display name. If you sign in with Google or Discord, we receive your email address and basic profile information from those services. We do not store your Google or Discord passwords.

Trading Session Data

The core of EnsoTrader is your trading journal. When you use the app, we store:

• Pre-session check-in responses (readiness scores, mental/emotional state ratings)
• Journal entries (rich text content, tags, emotions, images you upload)
• Session metadata (start/end times, discipline scores, tilt readings)
• Performance snapshots (P&L figures, goal adherence scores)
• Mindfulness session records (duration, type)

Trade Import Data

If you import trade data from your brokerage (via CSV upload), we store the execution details (symbol, side, quantity, price, time) and aggregated trade/day-level statistics. We store the file name of your import for reference but do not retain the original CSV file after processing.

Uploaded Images

You may attach images to journal entries (e.g., chart screenshots). These are stored in a secure, private storage bucket. Each user is limited to 500 MB of image storage. Images are accessible only via time-limited signed URLs that expire after one hour.

Preferences & Settings

We store your app preferences including theme setting, timezone, notification preferences, bell sound choice, trading goals, trading plans, and email communication preferences.

Usage & Error Data

We collect anonymous error reports and performance metrics through Sentry (see Third-Party Services) to identify and fix bugs. This may include browser type, operating system, and anonymized interaction data. Sentry's Session Replay feature may capture a recording of user interactions when an error occurs, to help us debug the issue. We do not use this data for advertising or user profiling.

2. How We Use Your Information

We use your information to:

• Provide and maintain the EnsoTrader service
• Display your trading journal, analytics, streaks, and performance data
• Calculate discipline scores, readiness assessments, and goal tracking
• Send you emails you have opted into (weekly digest, trial reminders, payment alerts)
• Process subscription payments through Stripe
• Diagnose technical issues and improve app stability

We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes. Period.

3. Data Storage & Security

Your data is stored on Supabase, which runs on Amazon Web Services (AWS) infrastructure. Data is encrypted at rest using AES-256 encryption and encrypted in transit using TLS 1.2+.

All database access is governed by Row Level Security (RLS) policies, which means your data is isolated at the database level — queries can only return rows that belong to your authenticated user account. Even in the event of an application-level bug, the database itself enforces access boundaries.

While we take reasonable measures to protect your information, no method of electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to following industry best practices.

4. Third-Party Services

We use the following third-party services to operate EnsoTrader. Each service has access only to the minimum data required for its function:

Each of these services has their own privacy policy. We encourage you to review them if you have questions about how they handle data.

5. Cookies & Tracking

EnsoTrader uses only essential cookies required for authentication. Specifically, we use Supabase session cookies to keep you logged in and to securely refresh your session.

We do not use:

• Third-party tracking cookies
• Advertising or remarketing pixels
• Analytics cookies (such as Google Analytics)
• Social media tracking scripts

There is no cookie banner because there are no optional cookies to consent to. The only cookies we set are strictly necessary for the service to function.

6. Email Communications

We may send you the following types of emails:

• Weekly digest — a summary of your trading week (opt-in, configurable in Settings)
• Trial reminders — notifications about your free trial status (opt-in, configurable in Settings)
• Payment alerts — notifications about subscription billing events (opt-in, configurable in Settings)

All email categories can be individually enabled or disabled in your Settings > Email preferences. We respect your choices — if you turn off a category, you will not receive those emails.

We will also send essential account-related emails (such as password reset requests or critical security notifications) regardless of your email preferences, as these are necessary for account security.

7. Your Rights

You have the right to:

• Access your data — all of your data is visible within the app (journal entries, trades, analytics, settings)
• Correct your data — you can edit your journal entries, trading sessions, settings, and profile information at any time
• Delete your data — you can request full account deletion from Settings (see Account Deletion)
• Control communications — you can opt out of any email category in Settings
• Cancel your subscription — you can cancel at any time through the Stripe billing portal, accessible from Settings

If you need help exercising any of these rights, contact us at the email address listed below.

8. Account Deletion

You can request deletion of your account from Settings > Account. When you request deletion:

1. Your account enters a 30-day grace period. During this time, you can log in and cancel the deletion if you change your mind.
2. After the 30-day period, your account and all associated data are permanently deleted. This includes journal entries, trading sessions, imported trade data, uploaded images, check-in responses, goals, preferences, streaks, badges, and any other data tied to your account.
3. If you have an active Stripe subscription, you should cancel it before requesting account deletion. We will not automatically cancel your subscription — you are responsible for managing your billing through the Stripe portal.

Permanent deletion is irreversible. Once the 30-day window passes and your data is purged, it cannot be recovered.

9. Data Retention

Active accounts: Your data is retained for as long as your account is active. We do not delete or archive your data due to inactivity.

Deleted accounts: After you request account deletion, your data is retained for a 30-day grace period (to allow cancellation), then permanently purged from all systems. This includes database records, stored images, and any associated metadata.

Error logs: Anonymized error and performance data collected by Sentry is retained according to Sentry's own data retention policies (typically 90 days).

Email logs: Records of sent emails (type, timestamp, delivery ID) are retained for operational purposes and deleted along with your account if you request deletion.

10. Children's Privacy

EnsoTrader is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will take steps to delete that information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the “Last updated” date at the top of this page
• Notify you via email (to the address associated with your account)

We encourage you to review this page periodically. Continued use of EnsoTrader after changes are posted constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy, your data, or your rights, you can reach us at:

Email: support@ensotrader.com