Privacy Policy
The short version
- We store what you put in your journal, and the account details needed to sign you in.
- We do not sell your data. We do not show ads. We do not use your journal to train AI models.
- The AI coach sends your chat message and a compact summary of your trades to an AI provider. You must agree before you use it.
- You can export your data for free and delete your account inside the app.
1. Who we are
TradeZaq is a trading journal and analytics app for Android (com.zaqoa.fxjournal). It is run by TradeZaq (an individual operator), contactable by email at [email protected]. In this policy, “we” means that operator.
We decide why and how your personal data is used. That makes us the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the “controller” under the GDPR.
Contact: [email protected]. Support: [email protected].
2. What we collect and why
You give us most of this data yourself. We collect only what the app needs.
| Category | What exactly | Why |
|---|---|---|
| Account | Email address. Name or display name, username and profile photo, if you add them. If you use Google Sign-In, Google sends us your email, name and profile picture link. | To create your account, sign you in and show your name. |
| Profile answers | Your answers to setup questions: markets you trade, experience, trading style, biggest struggle and goal. | To set up the app for you and to tailor the coach. |
| Journal data | Trading accounts (name, type, currency, starting balance), deposits and withdrawals, trades (symbol, side, prices, size, leverage, stop loss, target, setup, exchange, notes, times), partial closes (exit price, fees, profit and loss), and screenshots you attach. | To store your journal and calculate your statistics. This is the core service. |
| Diary | Diary entries you write. | To store them for you. |
| AI coach data | Your chat messages and the replies. The conversation title (the first part of your first message). A compact summary of your trades that we build for each question (see section 5). Your daily message count. | To answer your questions, keep your chat history and apply daily limits. |
| Subscription | Plan, status, period (trial or paid), store and expiry date. Your RevenueCat customer ID is your TradeZaq account ID. Google Play keeps your payment details. We never see your card. | To unlock paid features and manage your plan. |
| Device and app | App version. The IP address your device uses when it contacts our servers and providers. Google Play may separately give us anonymous crash statistics for the app. | To make the app work, fix bugs and keep the service secure. |
| Consent records | Which document you accepted (terms, privacy, disclaimer, 18+ confirmation, AI processing), the version, a fingerprint (SHA-256) of the text, the time, and your app version. | To prove what you agreed to and when. |
| Sign-in and security logs | Our sign-in system records sign-in events. These include IP address and device type. | To keep accounts secure and investigate abuse. |
| Support emails | Your email address and what you tell us. | To help you and keep a record of how we handled it. |
| Deletion records | If you delete your account: the anonymous account ID, the time and whether you used the app or the web. | To show that your request was carried out. |
What we do not collect
- We do not ask for your location, contacts, microphone or call history.
- We do not ask for your broker password or API keys. TradeZaq does not connect to your broker.
- We do not store your card or bank details. Google Play handles payments.
- TradeZaq has no advertising SDKs and no product-analytics SDKs. Notifications are scheduled on your device. We do not use push notification servers in this version.
Screenshots
You choose which images to attach. The app shrinks each image and saves it as a new JPEG before upload, and it does not request camera metadata (EXIF) from your photo picker. We do not check the uploaded file for other metadata. Anything visible in a screenshot is stored, so crop out account numbers or other details you do not want us to hold.
3. How we use your data
- To run TradeZaq: sign you in, store your journal, calculate statistics, sync your data.
- To answer AI coach questions you ask.
- To manage your subscription and unlock paid features.
- To keep the service safe: rate limits, abuse prevention, security checks.
- To fix crashes and bugs.
- To answer your support and privacy requests.
- To keep records of your consent and to meet legal duties.
We do not sell your data. We do not use it for advertising. We do not profile you in a way that has legal or similarly significant effects on you. We do not use your journal data to train AI models.
4. Sensitive data
TradeZaq does not ask for health, biometric, religious, political or similar special-category data. Your trades are financial information about you. We treat them as private and protect them as described in section 12. Avoid typing sensitive details into free-text fields such as notes, diary or the AI chat.
5. How the AI coach works
The AI coach is optional. You must agree to AI processing before you can use it.
What is sent
When you send a message, our server builds a request and sends it to an AI provider. The request contains:
- your message and the last few messages of that chat (up to 8);
- a compact text summary of your journal for the account you picked, covering up to the last 180 days. It holds statistics such as win rate, profit and loss, drawdown, results by setup, symbol, weekday and session, and trading-behaviour flags. It also lists up to 8 open positions and your 15 most recent closed trades (symbol, side, entry, exit, result, setup name and how long you held);
- the name, type and currency of that trading account;
- instructions that tell the AI how to coach.
What is not sent
- Your email, name, profile photo or account ID.
- Your trade notes and your diary.
- Your screenshots.
- Your subscription or payment information.
Anything you type into the chat itself is sent. Setup names and account names are text you chose, so they are sent too.
Who receives it
Our server sends the request to OpenRouter. OpenRouter passes it to an AI model provider, which runs the model and returns the reply. We choose the models on our server and can change them at any time. OpenRouter chooses which provider runs a request, so we do not fix a list of providers. Section 8 describes this group of providers.
What we ask providers to do
Every request we send sets OpenRouter’s data-collection option to “deny”. This is a setting on the request. It asks OpenRouter to avoid providers that collect prompts. We cannot inspect OpenRouter or the providers, and we do not have a guarantee from every provider that prompts are not stored or used for training. OpenRouter may keep technical metadata about a request, such as time, model and token counts.
What we keep
We keep your chat messages so you can see your history. They are deleted automatically after 180 days. You can delete a chat yourself at any time. We keep a daily message count to apply limits, for 90 days. Our server logs record technical details such as your account ID, the model and provider that answered, token counts and error types. Our code does not write the content of your messages to these logs.
Limits of the coach
The coach gives educational commentary. It is not investment advice and it can be wrong. See the Disclaimer.
Withdrawing consent
You can stop using the coach at any time. To withdraw your consent to AI processing, email [email protected]. The app has no withdrawal setting. Once we record your withdrawal, the coach will stop working for you. Withdrawing does not affect anything already processed.
6. Legal bases (EU and UK GDPR)
| What we do | Legal basis |
|---|---|
| Account, profile, journal, diary, screenshots, subscription status | Contract: we need this to provide the service you asked for. |
| Sending your chat and trade summary to AI providers | Your explicit consent, given before first use. You can withdraw it. It is also part of the service you asked for. |
| Security, abuse prevention, rate limits, crash reports, support records | Our legitimate interests in running a safe, working service. You can object. |
| Consent records, deletion records, accounting and tax records | Legal obligation and our legitimate interest in proving what you agreed to. |
7. India: DPDP Act notice
This section is our notice under the DPDP Act, 2023.
- Data we process and why: as listed in sections 2 and 3.
- Consent: we process your data with your consent, which you give when you accept this policy and the Terms, and separately for AI processing. You can withdraw consent at any time. Withdrawing is as easy as giving it: delete your account in the app or email us. Withdrawal may stop features that need the data. It does not make earlier processing unlawful.
- Your rights: to get a summary of the personal data we process and who we share it with, to correct and complete it, to have it erased, to have your grievance addressed, and to nominate another person to exercise your rights if you die or cannot act.
- Grievance: write to our Grievance Officer (section 18). We acknowledge within 48 hours and resolve within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
- Children: TradeZaq is for adults only (section 14).
8. Who we share data with
We do not sell your personal data. We do not share it for advertising.
We use service providers who process data for us under their terms. Some, such as Google and Binance, also act under their own privacy policies.
| Provider | What it does | What it can see | Where |
|---|---|---|---|
| Supabase | Database, sign-in and file storage (screenshots, profile photos). Also runs our server functions. | Email, name, profile answers, journal data (accounts, trades, notes, diary), screenshots, AI chat history, consent records, subscription status, sign-in logs. | Singapore (AWS ap-southeast-1) |
| OpenRouter | AI coach. Receives the request from our server and routes it to a model provider. | Your chat message, the recent messages in that chat and the compact trade summary. No email, name or account ID. | United States |
| AI model providers that OpenRouter routes to | AI coach. Run the model that writes the reply. | Same as OpenRouter. We choose the models. OpenRouter chooses the provider. | Chosen by OpenRouter for each request |
| RevenueCat | Subscription status and entitlements. | Your account ID, Google Play purchase details (product, dates, purchase token), IP address and basic device information. | United States |
| Google (Google Play Billing and Google Sign-In) | Takes subscription payments. Signs you in if you choose Google. | Payment details stay with Google. For sign-in, Google sends us your email, name and profile picture link. | Global |
| Resend | Sends login code emails. | Your email address and the login code email. | United States (default sending region) |
| Expo (EAS Update) | Delivers app updates over the air. | IP address, app version and platform when the app checks for an update. No account data. | Global |
| Cloudflare | Hosts this website. | IP address and request details of people who visit this website. No app data. | Global |
| Binance | Public market data for the chart in the app. | Your device IP address and the symbol the chart asks for. No account data. | Global |
| NewsData.io | News headlines. Our server fetches them on a schedule. | No user data. Our server asks for headlines. Your device never contacts NewsData.io. | Not applicable |
We may also disclose data if the law or a court requires it, to protect people from harm, or to protect our rights. If we are sold or merge with another business, your data may go to the new owner. We will tell you first and the new owner must follow this policy or tell you about any change.
News headlines in the app link to other websites. Those sites have their own privacy practices.
9. International transfers
Our providers run systems in several countries. Your data may be processed outside the country where you live, including outside India and outside the EU or UK. The storage region of our main database is in the table above.
Where the law requires safeguards for transfers, we only use providers that publish data protection terms for their customers. Some of them process data outside India, for example in Singapore and the United States. Under the DPDP Act, we will not transfer your data to any country the Indian government has restricted.
10. How long we keep data
| Data | How long |
|---|---|
| Account, profile, journal data, diary, screenshots | Until you delete them or your account. |
| AI chat messages | Deleted automatically after 180 days, or earlier if you delete the chat. |
| AI chat titles | Until you delete the chat or your account. |
| Daily AI usage counts | 90 days, or until you delete your account. |
| Subscription record | Until you delete your account. |
| Subscription event log (technical) | 90 days. |
| Consent records | Kept after you delete your account. They hold an anonymous account ID, not your name, email or journal. We do not delete them automatically. |
| Deletion and audit records | Kept after you delete your account, with the anonymous account ID only. The deletion request record is deleted automatically 90 days after the deletion finishes. The audit entry is deleted automatically 400 days after it was created. |
| Accounting and tax records | Only records of payouts from Google Play, if tax law requires them, for as long as it requires. Google Play takes the payment, so we never see card or bank details. They contain no journal data. |
| Support emails | 12 months after your request is closed, then deleted. |
| Server and sign-in logs | Held by our hosting provider on its own schedule. We do not set a retention period for them. |
| Backups | We do not make separate backups of your data. |
| Data cached on your device | The app keeps a cached copy of the data you have viewed, so it opens fast and works with a weak connection. The cache is used for up to 24 hours after it was saved. Signing out wipes it, and so does deleting your account, because that signs you out. Clearing app data or uninstalling removes it too. A data export you create stays in the app’s cache folder until your next export or until you clear app data. |
11. Deleting your data
You can delete your account in the app: Account, Delete account, type DELETE. You can also delete it by email without logging in. You can delete single trades, diary entries, screenshots and AI chats yourself, or ask us to delete only some data.
Your account is locked at once. When you confirm in the app, your data is removed from our live systems in the same request, and an automatic job retries any failed step every 15 minutes. We keep no separate backups, so nothing lingers in a backup copy. A few records stay, as explained on the Delete account page. Deleting your account does not cancel your Google Play subscription.
12. Security
These are measures we have in place:
- Data travels over encrypted connections (HTTPS/TLS). Our database and file storage providers encrypt stored data.
- Every table that holds personal data has row-level security, so the database returns only your own rows to you.
- Screenshots and profile photos are in private storage. Each user can only reach their own folder. The app shows them through links that expire after 15 minutes.
- Secret keys for AI, billing and email providers stay on our server. They are not in the app.
- The AI coach runs on our server with sign-in checks, daily limits and a wait time between messages.
- Subscription updates from RevenueCat are checked with a secret before we accept them.
- Your sign-in session is kept in the secure storage of your phone.
- Access to our production systems is limited to people who need it to run TradeZaq.
No system is perfectly secure. If a breach affects your data, we will tell you and the authorities within the time the law requires.
13. Your rights
You can use these rights for free. Use the in-app tools where they exist. Otherwise email [email protected] from your account address. We may ask you to confirm it is you.
| Where you live | Your rights |
|---|---|
| India (DPDP Act) | Access to a summary of your data. Correction and completion. Erasure. Grievance redressal. Nominate someone to act for you. Withdraw consent. Complain to the Data Protection Board of India after you have used our grievance process. |
| EU and UK (GDPR) | Access. Rectification. Erasure. Restriction. Portability. Objection to processing based on legitimate interests. Withdraw consent. Complain to your data protection authority (in the UK, the Information Commissioner’s Office). We make no solely automated decisions with legal effects. |
| US states (California, Virginia, Colorado and others) | Know and access what we hold. Correct. Delete. Get a portable copy. Appeal a refusal. Opt out of sale, sharing for advertising and profiling. We do none of these, so there is nothing to opt out of. We do not treat you differently for using your rights. You can use an authorised agent. |
| Elsewhere | The rights your local law gives you. Tell us what you need and we will help. |
Easy ways to use your rights
- Export: Account, Export my data in the app. It is free and in a machine-readable format. The JSON file has your profile, accounts, deposits and withdrawals, trades, partial closes, screenshot records, diary entries, AI coach chats and consent records. The CSV file has your trades. The export has the screenshot records, not the image files.
- Correct: edit your profile and journal in the app.
- Delete: see section 11.
We reply within 30 days. For GDPR requests we can extend that by up to two more months if a request is complex, and we will tell you why. We do not charge a fee unless a request is clearly unfounded or excessive.
If you live in the EU or UK, you can contact us at the addresses in section 18 about any privacy matter.
14. Children
TradeZaq is for people aged 18 and over. We do not knowingly collect data from anyone under 18. You confirm that you are 18 or older when you sign up. If you think a child has an account, email [email protected] and we will close it and delete the data.
15. Cookies, tracking and this website
This website does not set cookies. It has no analytics, no advertising and no scripts from other sites. Its hosting provider, Cloudflare, processes visitor IP addresses and request details to deliver and protect the site.
The app does not use cookies for tracking. It stores some data on your device so it works offline and keeps you signed in. We do not use advertising IDs.
16. If you used an earlier version of TradeZaq
TradeZaq 2.0 runs on a new system. If you had an account in the earlier version, we copied your account, trades, diary and screenshots to the new system. The earlier system kept your data in Google Firebase. We plan to delete that old copy 60 days after the switch.
We copied your sign-in email, profile, accounts, trades with their partial closes, diary entries, one screenshot per trade and your profile photo. We did not copy passwords, AI coach chats, consent records, subscription or purchase records, analytics data or push notification tokens. Your deposits and withdrawals were replaced by one balance adjustment per account. The earlier leaderboard is not part of this version. The app asks you to accept the current terms and policy when you first open version 2.0.
17. Changes to this policy
This policy is version 2026-12-01, effective 16 October 2026. When we make a material change, we publish a new version code and the app asks you to accept it before you continue. We keep a fingerprint of each version, and the app records the version you accepted. For small changes, such as fixing a typo, we may update the text without asking you again.
18. Contact and grievance officer
Operator: TradeZaq, contactable by email at [email protected]
General and privacy: [email protected]
Support and requests: [email protected]
Grievance Officer (India)
TradeZaq Support
Email: [email protected]
Address: By email only
We acknowledge your complaint within 48 hours and resolve it within 30 days.