Privacy policy
Who is responsible
Stratmetrica is operated by [OPERATOR NAME, ORGANISATION NUMBER], Norway ("we"). We are the data controller for the personal data described here. Contact: [CONTACT EMAIL].
What we store, and where
- Account: your email address and sign-in records (Supabase).
- Journal: trades you log or import, notes, tags, your playbook, daily plans, prop firm account settings and AI reviews (Supabase).
- Chart frames and screenshots: only the still images you choose to save. Screen recordings are played on your own device and are never uploaded.
- Strategies, versions and test runs: the rules of a strategy you save, a summary of its results, the dataset and engine version it was tested on, and the plan used to follow it (Supabase, when you are signed in). Without an account, saved strategies stay in your browser's local storage on your device and never reach us.
- The text you write to describe a strategy: read in your browser by a fixed set of rules. It is not sent to us unless you press "Ask AI for a second reading" (see below). We do not store it with a saved version.
- Shared report links: if you create one, we store the report snapshot you chose to share and a fingerprint (hash) of the link. The link itself is shown once and cannot be recovered. A snapshot contains no name or email, and no rules or money amounts unless you tick them.
- Plan and payments: your plan, its status and renewal date, and the payment provider's customer and subscription identifiers. We never see or store card numbers.
- Usage and errors: a daily count of AI calls per account, and technical error messages from the app, so we can enforce limits and fix problems.
- Pilot list: your email address and which form you used, if you join the pilot list.
Why, and on what basis
To provide the service you asked for: storing your journal and strategies, running the tests and reviews you request, following your saved strategies, taking payment, and enforcing plan limits (performance of a contract, GDPR art. 6(1)(b)). Error logs and abuse limits keep the service working and safe (legitimate interest, art. 6(1)(f)). The pilot list and any email about it rest on your consent (art. 6(1)(a)); you can withdraw it any time. We do not sell your data and do not use it for advertising.
We do not train AI models on your strategies, journal or results, and we do not publish them. Providers we use may keep inputs for a limited time under their own terms. See the list below. [TO CONFIRM against each provider's current terms and settings before launch.]
Anonymous statistics (only if you turn it on)
In Account you can choose to share anonymous statistics. It is off until you turn it on, and you can turn it off at any time; from then on your trades are no longer included. When it is on, these fields from your journal trades are included in combined statistics: setup name, level, your CLC read, orderflow tags, gamma tags, instrument, side, entry time rounded to a 30-minute window, and the result in R and win or loss. Never included: your name, email, account, notes, screenshots, frames, dates, prices or reviews. Statistics are only shown as totals for groups with trades from at least 10 different traders (20 by default). Legal basis: your consent. We keep a record of when you gave or withdrew it.
AI
When you run an AI review, build a plan, or press "Ask AI for a second reading", the relevant text (and for journal reviews the selected images) is sent from our server to Anthropic's Claude API, and the answer is returned to you. For a second reading only the description text you typed is sent. You are interacting with AI there: the answer is shown as the AI's reading and is checked against our fixed rule library before you see it. All numbers in test reports are calculated by our own engine, not by an AI model.
Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | EU (Stockholm, Sweden), project region eu-north-1 |
| Vercel | Hosting of the website (processes visitors' IP addresses in server logs) | Global edge network, including the United States [TO CONFIRM] |
| Anthropic | AI reviews and second readings | United States [TO CONFIRM] |
| Stripe | Payments and subscriptions (test mode until paid plans launch) | [TO CONFIRM] |
| [EMAIL PROVIDER] | Sign-in links and pilot emails | [TO CONFIRM] |
Fonts are served from our own site, so visiting does not send your address to a font provider. Some providers may process data outside the EU/EEA. Where that happens we rely on the provider's EU Standard Contractual Clauses or an adequacy decision. [TO CONFIRM: data processing agreements are in place with each provider.]
Market data (CME Globex trades via Databento) is not personal data and is not linked to you.
Cookies and local storage
We do not use tracking, analytics or advertising cookies or similar technologies. The app stores your sign-in session and, if you save strategies without an account, those strategies in your browser's local storage. That storage is strictly necessary for what you asked the service to do. Clearing site data removes it.
How long we keep it
Until you delete it or delete your account. Shared links stop working at their expiry (7, 30 or 90 days, your choice) or when you revoke them. Deleting your account removes your journal, frames, strategies, versions, test runs, shared links, plan record and login. Copies in the providers' backups expire on their normal backup cycle. [TO CONFIRM: backup retention per provider.] Payment records may be kept as long as accounting law requires.
Your rights
You can see, correct, export and delete your data. Account has "Export my data" (JSON) and "Delete my account". You can also write to [CONTACT EMAIL]. If you think we handle your data unlawfully, you can complain to Datatilsynet (the Norwegian Data Protection Authority).
If something goes wrong
If personal data is breached in a way that requires it, we will notify Datatilsynet within 72 hours of learning of it, and tell affected users where the law requires.