Privacy Policy

We collect only what’s needed to run your journal:

• Account details — your email, name (optional), password (stored only as a salted hash), timezone and display-currency preferences.
• Trading telemetry from your EA — account metrics (balance, equity, margin, leverage, currency, broker time offset), open positions, and executions/closed trades with prices, volume, profit, commission and swap.
• Journaling content you create — tags, notes, ratings and attachments.
• Basic technical data — IP address and device/browser information for security, plus product-analytics events to improve the service.

We never collect your broker password — investor or master. No broker credential is ever entered into or stored by TAP; the EA authenticates to your TAP account with its own reporting-only token. We do not sell your personal data, and we do not use your trading data to trade.

To provide and secure the service: build your analytics, journal and reports; run discipline and prop-firm guardrail features; power AI reviews you request; process payments; send account and (optional) product emails; and detect abuse. Where required, our legal bases are performance of our contract with you, our legitimate interests in operating and securing the service, and your consent where applicable.

We share data only with the providers needed to run TAP:

• Stripe — payment processing, when paid billing is enabled. Stripe handles your card details; we don’t store them.
• Our hosting/infrastructure provider — to store and serve the application and its database.
• Email and error/analytics tooling — to send account email and monitor reliability.

A current subprocessor list will be maintained here before launch.

We keep your trading history for as long as your account is active so your journal stays complete; on the free plan, dashboards window history to the most recent 3 months, but we don’t discard stored history for a lapse or downgrade. When you delete your account, we delete your personal data and trading records within a reasonable period, except where we must retain limited records (e.g. payment records) to meet legal obligations.

Subject to your jurisdiction (including GDPR/UK-GDPR where applicable), you can access, correct, export or delete your data, object to or restrict certain processing, and withdraw consent. You can export or delete from your account settings or by emailing us; we’ll respond within the timeframe the law requires.

Passwords are hashed, EA tokens are stored hashed, the API enforces authentication on every request, and traffic is encrypted in transit. No system is perfectly secure, but we work to protect your data and will notify you of a breach as required by law.

Your data may be processed in countries other than your own; we rely on appropriate safeguards where required. TAP is not directed to children. We may update this policy; material changes will be posted here with a new effective date.