Last updated: 18 October 2026
1.1 This Cookie Policy explains how Harrison Weaver (ABN 56 118 164 232), a sole trader carrying on business as The Trading Terminal (we, us, our), uses cookies, browser storage and similar technologies on thetradingterminal.com, the application and the affiliate signup page (together, the Platform).
1.2 This policy forms part of our Privacy Policy and is incorporated into our Terms and Conditions. Capitalised terms not defined here have the meaning given in those documents. On the detail of cookies and similar technologies, this policy prevails over the Privacy Policy.
1.3 This policy lists every cookie, storage key and third-party request we are aware of at the date above. We will update it before introducing any new one that falls outside the Strictly Necessary category (clause 9.2).
2.1 Cookies are small text files that a website stores in your browser. First-party cookies are set on our own domain. Some first-party cookies are set by code supplied by a third party (for example, Google Analytics), and the information in them is sent to that third party.
2.2 Local storage and session storage are areas of your browser where a website can keep data. Local storage persists until it is cleared; session storage is cleared when the browser tab closes. They are not cookies, but they store data on your device, so we disclose them in full.
2.3 Third-party requests happen when a page loads a file (such as a font or a code library) from another provider's server. Your browser sends that provider standard request data, including your IP address and user agent, even though no cookie is set.
| Category | What it covers | Default | Can you turn it off? |
|---|---|---|---|
| Strictly Necessary | Sign-in, security, fraud and abuse prevention, error monitoring, remembering your consent choice and core preferences. | Always on | No — the Platform cannot work without it. You can still clear it in your browser (clause 8). |
| Analytics | PostHog product analytics, Google Analytics 4 and country detection for affiliate link routing. | Off | Yes |
| Marketing | The Meta Pixel, which measures whether our advertising leads to sign-ups and purchases. | Off | Yes |
3.1 Strictly Necessary items are used without consent because they are needed to provide the service you have asked for, to keep it secure, or to keep it working. We treat Sentry error monitoring as Strictly Necessary on the same footing as Cloudflare, because detecting faults is part of keeping the Platform secure and reliable. Sentry is never used for marketing or behavioural analytics.
3.2 The preferences panel lets you choose Analytics and Marketing separately.
3.3 Anonymous funnel measurement. Separately from the categories above, our public pages and the sign-up and upgrade steps of the Platform send a small number of anonymous events to PostHog, Inc. (United States) to count visits and the steps people take. This uses no cookie, local storage, session storage or IndexedDB, and nothing is read from or written to your browser, so it runs without a consent choice. It carries no user ID, email address, name or trade data, and it is not sent if your browser sends a Do Not Track or Global Privacy Control signal. Each event contains the page address without its query string, the referring site, any campaign (UTM) tags in the link you arrived on, your browser's user-agent string and timezone, the event name and, for some events, a tool, plan or source label. Your IP address and user agent reach PostHog as part of the request; PostHog's cookieless mode uses them with a daily-changing value to calculate a one-way identifier for that day, and PostHog's documentation states that the IP address is removed before the event is stored. We rely on PostHog's description of how it handles the IP address. The identifier changes every day, so it cannot follow you from one day to the next. Withdrawing Analytics consent does not stop it. See Privacy Policy clause 5.8 for what it contains and how to stop it.
4.1 On your first visit, a consent banner appears on the marketing site, in the application and on the affiliate signup page. Nothing in the Analytics or Marketing categories loads, sets a cookie, sends a request, or collects anything until you consent to that category.
4.2 The banner presents “Accept All” and “Reject All” with equal prominence. Closing or ignoring the banner is treated as a rejection. Declining costs you no functionality.
4.3 You can choose categories individually in the cookie preferences panel, available from the banner and from the "Cookie preferences" link in the footer of every page.
4.4 If you are signed in, your choice is recorded on your profile with a timestamp so that it applies across your devices. If you are not signed in, it is recorded in your browser's local storage.
4.5 You can withdraw or change your consent at any time from the preferences panel or from within the Platform. When you withdraw consent to a category, we stop all future collection in that category, delete from your browser every cookie and storage key in that category that our code can remove, and record the withdrawal. Some providers set cookies that our code cannot remove; clause 8 explains how to clear them.
4.6 Data sent to a provider before you withdraw consent is held by that provider under its own retention arrangements (see Privacy Policy clause 11). Contact us if you want us to ask the provider to delete it.
4.7 Google Analytics is loaded only after Analytics consent. We do not use Google Consent Mode to send cookieless measurement pings before consent.
5.1 Cookies
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
| tt_ctrader_state | The Trading Terminal | Cross-site request forgery protection during the cTrader authorisation flow. HttpOnly, Secure, SameSite=Lax. Set only when you start a cTrader connection. | 10 minutes |
| __cf_bm and other Cloudflare security cookies | Cloudflare | Distinguishes people from automated bots and protects the Platform from abuse. | Up to 30 minutes (__cf_bm) |
| Stripe cookies (for example __stripe_mid, __stripe_sid) | Stripe | Fraud prevention during payment. | Up to 1 year / 30 minutes |
5.2 Local storage We store: your authentication session token; a session-only authentication flag (in session storage); display preferences (currency format, date format, theme and timezone); your remembered email address if you selected "remember me"; any referral code you arrived with; the last page you viewed; an auto-saved draft of any unsaved trade; cached application data for performance; your dashboard and analytics layout selections; your journal filter state; banner dismissal flags; your cookie consent choice if you are not signed in; and login lockout counters used for security.
5.3 Requests made on every page, without cookies
| Provider | Why the request is made | What the provider receives |
|---|---|---|
| Cloudflare, Inc. | Hosting, content delivery, TLS and denial-of-service protection. | All HTTP traffic, including IP address and request metadata. |
| Functional Software, Inc. (Sentry) | Error monitoring and diagnostics. The Sentry script loads on every page; a report is sent only when an error occurs. | Error messages, stack traces, page address, browser and operating system information, and technical state at the time of the error. See Privacy Policy clause 3.9.1. |
| Cloudflare (cdnjs) and jsDelivr | Delivery of the charting library and database client library. | Standard request data including IP address and user agent. |
| Google LLC (Fonts) | Delivery of the web fonts used by the interface. | Standard request data including IP address and user agent. |
6.1 Cookies
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
| ph_ prefix (for example ph_<project-key>_posthog) | PostHog, Inc. | Identifies your session for product analytics. | Up to 12 months |
| _ga | Google LLC (Google Analytics) | Distinguishes one browser from another using a random identifier. | 2 years by default, and your browser may shorten it (Chrome caps cookie lifetimes at 400 days; Safari may delete it after 7 days without a return visit) |
| _ga_<container-id> | Google LLC (Google Analytics) | Keeps the state of your current visit (session). | 2 years by default, subject to the same browser limits |
6.2 Local and session storage. If you consent to Analytics, PostHog also stores keys in local storage and session data in session storage. They are removed when you withdraw consent.
6.3 What Google Analytics collects. Google Analytics receives the random identifiers in the cookies above; the pages you view and the page you came from; approximate location derived from your IP address (Google states that GA4 does not log or store IP addresses); device, browser and operating system information; and the following events: page views, scrolls, outbound link clicks, site search, video engagement and file downloads (GA4 Enhanced Measurement is on). Google Analytics never receives your trade data, notes or screenshots. No user ID, email address or other directly identifying information is sent to Google Analytics, and Google signals and ads personalisation are off.
6.4 Country detection. If you consent to Analytics, your IP address is sent to ipapi.co to identify your country, so that affiliate links can send you to the right regional page of a provider. No cookie is set.
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
| _fbp | Meta Platforms, Inc. | Stores a random browser identifier so Meta can measure whether our advertising leads to account creation or a subscription purchase. | 90 days, renewed on each visit |
| _fbc | Meta Platforms, Inc. | Set only if you arrive by clicking one of our ads on Facebook or Instagram; records that click for attribution. | 90 days |
7.1 The Meta Pixel sends Meta the identifiers above, your IP address and browser information, and two events — account creation and subscription purchase (plan and amount). It does not send your name, email address or trade data. Meta “Automatic Advanced Matching” is switched off in Events Manager, so the Pixel does not send hashed contact details.
7.2 Meta may also read cookies it has set on its own domains (such as facebook.com) if you are logged in to Facebook or Instagram. Those cookies are governed by Meta's own policies and our code cannot remove them.
8.1 You can block or delete cookies, local storage and session storage in your browser settings at any time. Clearing them will sign you out and reset your preferences, including any unsaved trade draft. Blocking Strictly Necessary items will stop the Platform from working.
8.2 Google offers a browser add-on that blocks Google Analytics on all websites, and Meta lets you manage ad preferences in your Facebook and Instagram settings.
8.3 Do Not Track and Global Privacy Control. The anonymous funnel measurement in clause 3.3 is not sent when your browser sends a Do Not Track or Global Privacy Control signal. Otherwise we do not change our behaviour in response to Do Not Track signals, because no common standard exists for them. If your browser sends a Global Privacy Control (GPC) signal and you have not yet made a cookie choice, we treat that signal as a rejection of Analytics and Marketing. You can still change this at any time from the cookie preferences panel.
9.1 We may update this policy. The version number and effective date at the top of this document identify the current version.
9.2 We will update this policy before we introduce any cookie, storage key or third-party request outside the Strictly Necessary category, and we will ask for your consent again before it is used. The anonymous funnel measurement in clause 3.3 uses no cookie or storage key.
9.3 Where a change materially affects how your information is handled, we will notify you by email or in-app notification at least 14 days before it takes effect, consistent with Privacy Policy clause 15.2.
9.4 Our obligations under this policy are subject to clause 21.6 (force majeure) of the Terms.
10.1 If you have a question or complaint about this policy, raise a support ticket in the Platform or email support.thetradingterminal@gmail.com. We will acknowledge within 5 business days and will try in good faith to resolve it within 30 days, consistent with clause 20.3 of the Terms and clause 16.2 of the Privacy Policy.
10.2 If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (see Privacy Policy clause 16.3).
10.3 This policy is governed by the laws of South Australia, Australia, and clause 20 of the Terms applies to any dispute about it.
The Trading Terminal Harrison Weaver, sole trader — ABN 56 118 164 232 Adelaide, South Australia, Australia Support tickets: available in the Platform under Profile → Support Email: support.thetradingterminal@gmail.com Web: thetradingterminal.com
End of Cookie Policy — Version 1.0, effective 29 September 2026.