Privacy Policy

TraderBuddy is run by Timon Huč, Slovenia. That is who decides what happens to your data and who answers for it.

Any question about your data, and any request below, goes to traderbuddyco@gmail.com.

Your account: the email address you signed up with, or the account you signed in with if you used Apple or Google. Passwords are handled by our authentication provider and are stored only as a hash, so nobody here can read yours.

Your profile: your display name, your photo if you add one, and what you said you came here for when you signed up.

Your trader type and track, which the questionnaire works out. The answers themselves are not kept — they produce the type as you go and are gone when the quiz ends, and it is the type that matching reads.

Your trading record: the plan you commit each day, the grade you give yourself, your notes, the trades you journal, the numbers on them, and any chart screenshots you upload.

How you were feeling, if you fill it in: the sleep, stress and focus you rate yourself on before a session. It is optional and never required to finish a day. The Coach reads it, which is the point of asking — telling you that your stressed mornings cost you money is a thing it can only do if you have told it.

Your progress: roadmap levels, quiz passes, saved confluences, and the rules you commit to.

Your partnership: who you are matched with, the requests between you, anyone you passed on, the goals you share, your daily check-ins and when you were last active, any inactivity report, any report of abuse, the messages and photos you send each other, the reactions you give them, and how far through the conversation you have read.

Your subscription: whether it is active, which plan, and when it renews. Card details never reach us. Apple takes the payment through the App Store and tells us, through RevenueCat, only whether you are entitled.

Your device, for notifications: if you allow notifications, the address Apple gives this app for your phone, so we can tell you when your buddy writes, when someone sends you a request, and when an economic release in a currency you follow is coming. Deleted when you sign out, or when you switch off both buddy notifications and news alerts.

Your notification settings: whether buddy notifications and news alerts are on, which currencies you follow, and your phone's time zone, so that the Sunday summary of the week arrives at six in the evening where you are, and for nothing else. We record which news alerts were sent to you, so that none is sent twice.

How the app is used. The app records that certain things happened — it was opened, a step of sign-up was reached, a check-in or journal entry was completed, the paywall was shown or a plan chosen, a message was sent — with the app version and, once you are signed in, your account. It records that a message was sent and roughly how long it was, never what it said; how many trades a day had, never the trades themselves; and nothing of your notes or journal. This goes to PostHog, and it is how we learn which parts of the app work.

Breakage. When something in the app fails, it tells us: what failed, the error message, your app version, and whether you are on the phone or the web. It is tagged with your account so that one person having a bad ten minutes can be told apart from something broken for everyone. It carries none of your trading — no trades, notes, journal entries, plans or messages travel with it. If you are not signed in when it happens, it carries no account either.

Anything you write in a bug report, exactly as you typed it, with the same version and device details attached so you do not have to describe them.

Connection logs kept by Supabase and Cloudflare, for security and delivery. We do not add anything of our own to them.

No connection to your broker, and no access to any real trading account. Every number in the app is one you typed in yourself.

Nothing about your reminders. They are scheduled on your phone and fire from it, so switching them on tells us nothing and we keep no record of them.

No advertising, no ad trackers, and nothing that follows you across other companies' apps or websites. We do not sell or rent anything about you to anybody.

No location. A photo from your camera is re-saved on your phone before it leaves it, which strips the place and time the camera wrote into it.

The app is for people aged 16 and over, and we do not knowingly collect anything from anyone younger.

To run the thing you signed up for — your account, your journal, your roadmap, your buddy and your subscription. That is performing our contract with you, and without this data there is no product.

Your sleep, stress and focus ratings, only because you choose to enter them. That is your consent, and you withdraw it by leaving them blank from then on and deleting the ones you gave.

To keep the service secure, to stop abuse between members, and to find and fix what breaks. That is our legitimate interest in running a safe app that works.

To learn which parts of the app help people and which do not, from the usage records above. That is our legitimate interest too, and you can object to it: write to us and we stop recording your account and delete what was recorded.

To send the notifications you allow. You choose these in Settings, then Notifications, and you can switch each one off.

To keep records the law requires, such as those behind a payment.

Your display name, photo and trader type, whether you checked in and when, when you were last active, your streak, the goals you chose to share, and your discipline score day by day — not just the latest one, but the whole run of it for as long as you have been paired, charted next to theirs.

For the goals you share, the day-by-day facts they are judged on: whether you made a plan, graded yourself, sat out or journalled, how many trades you took, whether one of them was logged as a revenge entry, and the grades you gave yourself for sticking to your loss limit and your setups.

They never see the trades themselves — symbols, results, profit and loss — nor your journal entries, your notes, your sleep, stress and focus ratings, or your chart uploads.

Messages and photos between you are visible to the two of you while you are paired, and so are your reactions to them. Your buddy also sees when you have read their latest message (it says Seen under it), and that you are typing while you write to them — never what, until you send it. Ending the partnership ends their access. Messages and names are checked against a short list of slurs and abusive phrases before they are sent, and one that matches is not sent.

If you report and block a buddy, the report and the conversation it is about are kept so we can review it, and the two of you are never paired or put in touch again. We are emailed the moment a report is made, so that someone looks at it within a day. The email carries when it was made and the reason you gave, as you wrote it — not the conversation, and not who either of you is.

Before you are paired, anyone looking for a buddy can be shown your display name, photo and trader type, and so can anyone you send a request to. That is what they choose by.

Someone you pass on is never told. A pass only stops you being offered them again.

Supabase provides our database, sign-in and file storage, and Cloudflare sits in front of it for delivery and security. Stored data is encrypted at rest, and everything travels encrypted between your phone and them.

PostHog receives the usage records described above, on its servers in the European Union, and the app asks it which features are switched on.

RevenueCat manages subscriptions between the App Store and us. It receives your account identifier and your purchase history from Apple — which plan, when, and in which store.

Apple takes payments through the App Store, delivers notifications to your phone, and, if you sign in with Apple, tells us who you are. A notification about a new message shows the sender's name and the start of the message, up to 160 characters, and passes through Apple to reach your phone.

If you sign in with Google, Google is told you are signing in to TraderBuddy. Signing up with an email address instead avoids that.

Resend sends the emails that come from us: the code that confirms your address when you sign up or reset your password, which means it receives your email address, and the alert that tells us a report was made, described above.

Roadmap lessons are videos hosted on YouTube. Nothing about them is embedded in the app — the thumbnails you see on the path ship inside the app itself, so opening the roadmap does not call out to Google. Tapping a lesson opens YouTube, and from that point Google sees the visit under its own policy, the same as if you had gone there yourself.

The news list under the journal comes from financecalendar.com, fetched by our own server. Your phone never contacts them, and they learn nothing about you.

The full economic calendar, behind the news list, is TradingView's. Opening it loads it from TradingView, which sees that visit — your device's internet address and the like — under its own policy, the same as visiting its website. Nothing of your account or your trading goes with it.

The app's fonts ship inside it, so reading it calls out to nobody. These web pages load theirs from Google Fonts, which means Google sees the request your browser makes for them.

Uploaded images are private. Your chart screenshots are readable by you and by nobody else, ever. Your profile photo is readable by other signed-in members, because a photo is what a buddy and a potential match see. Nothing is readable from the open web: the app fetches an image through a link it creates at the moment of showing it to you, and that link stops working about an hour later.

Some of these providers process data outside the EEA and the UK — RevenueCat and Resend in the United States, and possibly others for parts of their service — under the standard contractual protections they publish.

Your account data stays while your account exists.

Deleting your account, from Settings, then Delete my account, erases it from our database and file storage straight away, and cannot be undone. It takes the buddy conversation with it, on their side as well as yours, because the thread belongs to the pairing.

The same step asks PostHog to delete the usage records it holds about you and RevenueCat to delete your purchase history, and, if you signed in with Apple, withdraws TraderBuddy's access to your Apple ID — Apple asks you to confirm it is you before that. If one of them cannot be reached at that moment, your account is deleted anyway, and we keep a note of which step is left, under your account's random identifier and nothing else, and finish it by hand within a month.

Bug reports and error reports are kept for up to twelve months, without your account attached once it is deleted.

Records we are required to keep, such as payment records, are kept for as long as the law requires.

Provider logs roll off on their own schedule, usually days to weeks.

You can ask for a copy of what we hold, in a form you can take elsewhere; ask us to correct it; or ask us to delete it. You can object to how we use it, ask us to restrict it, or withdraw a consent you gave.

Most of it you can do yourself: your name and photo in Settings, then Account; your notifications in Settings, then Notifications; and deletion in Settings, then Delete my account.

For anything else, write to traderbuddyco@gmail.com. We answer within one month.

If you think we have handled your data badly, you can complain to your national data protection authority. In Slovenia that is the Information Commissioner (Informacijski pooblaščenec).

Your trader type, your roadmap, your discipline score and your insights are educational. They describe your own behavior back to you. None of it is investment, financial or trading advice, and none of it is a recommendation to buy or sell anything.

If this policy changes, the date at the top of this page changes with it, and we will tell you in the app if the change is significant.