Privacy Policy

Who is responsible

[entity] operates UnifyTrade and is the controller of the personal data described here. For anything in this policy, including a request about your own data, write to [contactEmail].

[entity], [address].

What is collected

Your account. Your name, your email address, and a password verifier. Your password itself is never stored: what is kept is a scrypt hash with a random per-user salt, which cannot be turned back into your password.

Your sessions. A session is stored as a hash of its token, with the time it was created, the time it was last used, when it expires, and the browser's user-agent string. You can see and revoke your active sessions in Settings.

Your preferences. Your language, your theme and your display currency.

Your trading data. The executions, transfers and balances read from the venues you connect or the files you import, and everything derived from them.

What you write. Trade reviews, notes, psychology tags and portfolio names are yours and are stored as you wrote them.

Your credentials for a venue. An exchange API key you add is encrypted at rest with a key held by the server, and is never returned to a browser — not to you, and not to an administrator, who sees only whether a connection is configured.

Billing. If you subscribe, Stripe processes the payment. Card details go to Stripe and never reach this server; what is stored here is the subscription's status and identifiers.

What is never collected

A seed phrase, a recovery phrase or a private key. The service does not ask for one, has nowhere to put one, and a wallet you add is a public address only.

There is no advertising, no tracking pixel, no analytics product and no third-party script that profiles you. Nothing about you is sold, and nothing about you is shared for anyone else's marketing.

Cookies

Three, and none of them is for advertising.

• __Host-spotlog_session — keeps you signed in. Essential: without it there is no way to stay signed in.
• unifytrade_lang — remembers the language you chose. Preference.
• unifytrade_ref — records which partner link brought you, if you arrived through one. Optional, and only set if you followed such a link.

Who else sees it

Only the services the operator has switched on, and only for the purpose beside each one.

• Stripe — your email address and subscription details, and only if you subscribe. Stripe is the payment processor; your card details go to Stripe and never to this server.
• An email provider (Resend, Postmark, SendGrid or your own SMTP server) — your email address and the contents of the message, and only when the service has to email you.
• Object storage (any S3-compatible provider) — encrypted backups of the whole installation, and only if off-host backup has been configured.
• The venues you connect — the API request that reads your own history, sent to that venue when a sync runs. It is read-only.
• CoinGecko — asset identifiers, to price your holdings. Nothing that identifies you is sent.
• An economic-calendar provider — nothing about you at all.
• Google Fonts — your browser fetches the page font from Google, which means Google receives your IP address on every page load.

Your data is not sold, rented or given to anyone for their own purposes.

How long it is kept

Your data is kept while your account exists.

When you delete your account, its data is **set aside rather than destroyed immediately** — it is moved where the running service can no longer read it, so that an accidental deletion can be undone. Ask at [contactEmail] if you need it destroyed outright, and say so.

Backups are kept on a rolling schedule and a deletion reaches them when the backup containing it ages out.

Your rights

You can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, ask for it in a portable form, ask us to restrict or stop a particular use, and withdraw consent where a use rests on it. You can export your data from the product at any time, and delete your account from Settings.

Write to [contactEmail] to exercise any of these. If you are in the UK or the EU and you think your data has been handled wrongly, you may also complain to your national data protection authority.

How it is protected

Passwords are hashed with scrypt. Venue credentials are encrypted at rest. Every user's data is stored under their own tenant and a request is served only within the caller's tenant. Administrator accounts can require a second factor. Sensitive writes are atomic, so a crash cannot leave a half-written file. The service is served over HTTPS and its session cookie is host-locked, HTTP-only and same-site.

No system is perfectly secure, and this policy does not claim otherwise.

Changes

If this policy changes, the date at the top of this page changes with it, and material changes are notified before they take effect.