Privacy Policy

1. Introduction

1.1 This Privacy Policy explains how Harrison Weaver (ABN 56 118 164 232), a sole trader carrying on business as The Trading Terminal (we, us, our), collects, uses, stores, discloses and protects personal information when you use the website and application at thetradingterminal.com (the Platform).

1.2 The Trading Terminal is a trading journal and analytics tool. We hold detailed records of how you trade. We treat that as sensitive commercial information belonging to you, and this policy sets out exactly what we do with it.

1.3 We handle personal information in accordance with the Australian Privacy Principles (APPs) set out in the Privacy Act 1988 (Cth), as a matter of policy and as a commitment to our users.

1.4 This policy forms part of our Terms and Conditions. Capitalised terms not defined here have the meaning given in those Terms.

1.5 This policy is published at thetradingterminal.com/privacypolicy and applies from the effective date at the top of this document.

1.6 Our Cookie Policy, published at thetradingterminal.com/cookiepolicy, forms part of this policy. It lists every cookie, local storage key and similar technology we use, and it prevails over this policy on those details.

2. Who This Policy Applies To

2.1 This policy applies to everyone who visits the Platform, creates an account, subscribes to a paid plan, submits a support ticket, or participates in our affiliate programme.

2.2 The Platform is not available to anyone under 18 years of age. See clause 12.

2.3 We do not sell personal information, and we do not share it for cross-context behavioural advertising, except that where you consent to Marketing cookies the Meta Pixel receives the limited event data described in clause 7.1 and in the Cookie Policy.

2.4 Anonymity. You may browse the public pages of the Platform and contact us with a general question without identifying yourself. You cannot hold an account, subscribe, or participate in the affiliate programme anonymously, because we need your identity and age to provide those services lawfully.

3. Information We Collect

3.1 Information you give us when you register

3.1a Passkeys 3.1a.1 You may register one or more passkeys as a passwordless way to sign in, and manage them at any time from Settings → Account Security. For each passkey we store: the passkey's public key; its credential identifier; a signature counter used to detect cloned authenticators; the date it was created; and the account it belongs to. We also store a device name you can label it with, and the date it was last used to sign in. 3.1a.2 Only the public key is ever stored. The matching private key is created on, and never leaves, your own device, password manager or security key. It is never transmitted to us and we never see it. Any biometric (such as a fingerprint or face scan) you use to unlock a passkey is checked by your device and is never sent to us. 3.1a.3 You can add or remove a passkey at any time. Removing a passkey deletes its stored record. All passkey records are deleted when your account is deleted.

3.2 Information in your profile and settings Once your account exists, we hold: your user ID; account creation date; subscription tier, status and billing period; Stripe customer and subscription identifiers; trial status and expiry; complimentary access status and expiry; your cookie and analytics consent choices and their timestamps; the version of each Legal Document you accepted and when; timezone preference; favourite trading pairs; your custom playbook lists (setups, confluences, entry signals and mistake tags); quick links configuration; dashboard and analytics layout preferences; auto-group and auto-merge sync preferences; your webhook API key; your registered passkeys (see clause 3.1a); affiliate referral source; your last sign-in date; a record of the in-app notifications we send you, with their type, expiry date and whether you have read or dismissed them; and internal administrative flags including administrator status, account freeze status and any notes we record about your account.

3.3 Trading account records For each trading account you create in the Platform: account name; broker name; account type (live, evaluation, prop or backtest); currency; starting balance; profit goal; maximum drawdown; your risk desk configuration, including trailing drawdown type, daily loss limit and lock settings; your cash adjustment ledger of deposits and withdrawals, with dates and notes; and any notes you add.

3.4 Trade records For each trade you log or import: symbol; direction; entry and exit dates and prices; stop loss and take profit levels; risk percentage; risk-to-reward ratio; gross profit or loss, fees and net result; outcome; your own grade; setup, confluence and mistake tags; emotion and discipline ratings; free-text notes; trade session, timeframe, bias, market conditions, news impact, order type, and stop and target management notes; the source of the record (manual entry, CSV import, cTrader sync or MetaTrader Expert Advisor); the provider trade identifier for synced trades; the sync timestamp; and the storage path of any screenshots you upload. Screenshots you upload are stored in private storage with per-user folder isolation and are not publicly accessible.

3.4.1 CSV files you import are read in order to create trade records in your account. The CSV file itself is parsed in your browser and is never uploaded to or stored on our servers — only the trade records you confirm are saved.

3.5 Broker connection data If you connect a cTrader account: the OAuth provider; your provider user identifier and account identifier; your broker account number and broker name; the OAuth access token and refresh token; the token expiry; sync status and any error messages; the cluster your account sits on (live or demo); and the Trading Terminal account it is linked to. OAuth tokens are encrypted at rest using AES-256-GCM. They permit read-only retrieval of your closed trade history. They do not permit us to trade, transfer funds, or alter your broker account.

3.6 Support tickets When you submit a support ticket we collect: the ticket number and category; your first and last name; your email address; your phone number if you choose to provide it (optional); the content of your message; any screenshots you attach; ticket status and timestamps; and the full reply thread, including replies you send by email. If you reply to a ticket notification email, your reply is ingested through a Gmail mailbox we operate and added to the ticket. Emails sent to us outside a ticket thread are received in that mailbox and retained as ordinary correspondence.

3.7 Affiliate data If you participate in the affiliate programme we collect: your affiliate code; your name and email address; your referral source or channel; the version of the affiliate agreement you accepted and the date you accepted it; your commission rate and duration; commission records including amounts and invoice references; your ABN and tax status where you provide them; and payout records including the bank account details you supply for payment. Bank account details are used only to pay you, are accessible only to the operator, and are deleted or de-identified when no longer needed for payment or record-keeping under clause 11.

3.8 Payment data Payments are processed by Stripe. Card numbers, security codes and bank details are collected directly by Stripe and are never received or stored by us. From Stripe we receive and store your Stripe customer and subscription identifiers, your subscription status and plan, billing period and renewal dates, and payment success and failure events. Your Trading Terminal user identifier is passed to Stripe as metadata so that payments can be matched to your account.

3.9 Information collected automatically When you use the Platform we automatically collect: your IP address, which is visible to us through Cloudflare in the CF-Connecting-IP header and is used for security, rate limiting and abuse prevention; standard request data such as browser type, operating system, device type and referring page; and application error logs and diagnostic data.

3.9.1 Error monitoring. If a JavaScript error occurs in your browser, an error report is sent to Sentry (see clause 7.1). A report contains the error message, a stack trace, the page address where the error occurred, your browser and operating system, and technical state recorded at the moment of the error. Your user identifier and email address are not attached to Sentry reports. IP address collection is enabled in our Sentry settings — we do not have “Prevent Storing of IP Addresses” turned on. Session replay is not enabled. Error monitoring is treated as strictly necessary for the security and reliability of the Platform and runs without cookie consent, in the same way as Cloudflare. Where you have consented to analytics or marketing cookies, we also collect the data described in clause 5 and the Cookie Policy. Where you have not consented, no analytics or marketing data is collected.

3.10 Information we do not collect We do not collect sensitive information as defined in the Privacy Act — we do not ask for information about your health, race, ethnicity, political opinions, religious beliefs, sexual orientation, criminal record or union membership. We do not collect government identifiers such as tax file numbers, passport numbers or driver licence numbers. We do not verify your identity against documents, and we do not perform credit checks. Please do not include information of this kind in trade notes, support tickets or screenshots.

3.11 Testimonial consents If you agree to let us use a Testimonial under clause 11.6 of the Terms, we keep a record of the request, the content and attribution you approved, the channels covered, the date of your consent, and the date of any withdrawal.

3.12 Unsolicited information If we receive personal information we did not ask for (for example, another person's details in a screenshot or support ticket), we will decide whether we could lawfully have collected it. If not, we will destroy or de-identify it as soon as practicable where it is lawful and reasonable to do so.

3.13 What the operator can see about you The Platform has an administrator console, used by the operator (and any administrator the operator has authorised) to give support, manage subscriptions and keep the Platform secure. When the console opens your account it shows:

• Account details: your email address, full name, the date you joined, your last sign-in date, your country, your date of birth and calculated age, and the date and time you confirmed you are 18 or over;
• Plan and billing: your plan, subscription status and billing period (monthly or annual), whether you are on a trial, have used your trial or have complimentary access, your Stripe customer identifier, and whether you were referred by an affiliate and by which one;
• Communications: whether you opted in to marketing emails, and the in-app notifications we have sent you;
• Usage summary: the number of trades you have logged, your win rate and your net profit or loss, and your trading accounts (name, broker, currency and starting balance); and
• Internal notes: any note the operator has recorded about your account.

3.13.1 The console loads your profile record (clause 3.2). It can also open the trade and trading account records you have entered (clauses 3.3 and 3.4), including your notes and tags, where that is needed to fix a fault or answer your support request. It does not display your webhook API key (it can only tell whether you have created one) or the security codes used to confirm an email-address change. It cannot show your password, which Supabase Auth stores only as a hash; your card number or bank details, which Stripe holds and we never receive; or the private keys of your passkeys, which never leave your device.

3.13.2 From the console the operator can: change your plan; grant or end a trial or complimentary access; re-synchronise your subscription with Stripe; cancel your subscription; freeze or unfreeze your account; sign you out of all your devices; generate a password-reset link; change your email address; send you an email or in-app notification; switch Showcase Mode on or off for your account (a display mode, granted by the operator for demonstrations, that shows sample data on your screen instead of your own records; it does not copy, change or publish your data); prepare a copy of your data when you ask for one; and close your account and delete its data. We use these actions to provide support you ask for, to administer billing and the Terms, for security, and to comply with the law. We generate a password-reset link or change an email address only when you ask us to, or to resolve a security problem with your account.

3.13.3 Each time the operator opens your account or takes one of these actions, the console records who did it, what they did and when, in the administrative audit log described in clauses 10 and 11. The operator does not use the console to read your trade data for any other purpose, and what it shows is never shared with affiliates (clause 7.5) or with other users.

3.14 Product usage events. While you are signed in, the Platform records a small number of usage events against your account in our own database (Supabase, see clause 7.1). They are not sent to any third party, and they do not use cookies or browser storage for tracking. The events are: opening the app (at most once a day), reaching a plan limit (trades or Trading Accounts), clicking an upgrade button, viewing the plan picker, choosing a plan, and starting checkout. Each record holds the event name, the date and time, and a short label (the type of limit, the plan, or where the click came from). They are not recorded in the demo. We use them to see how plans and limits are used and to improve the sign-up and upgrade steps. They are separate from the anonymous funnel measurement in clause 5.8, and they are not affected by your cookie choices. They are deleted when you delete your account. We have recorded these usage events since 19 October 2026 (viewing the plan picker, choosing a plan and starting checkout are recorded only once the Basic plan is available); this section applies from 20 October 2026, ahead of the rest of this version.

4. Cookies, Local Storage and Session Storage

4.1 We use a small number of cookies, together with browser local storage, session storage and requests to third-party services. The full list, including each item's purpose, lifetime and consent category, is in our Cookie Policy.

4.2 In summary: strictly necessary items (sign-in, security and error monitoring) are always active; Analytics items (PostHog product analytics, Google Analytics and country detection) are active only if you consent to Analytics; and Marketing items (the Meta Pixel) are active only if you consent to Marketing. Separately, an anonymous funnel measurement that uses no cookies or browser storage runs without a consent choice (clause 5.8).

4.3 You can clear cookies, local storage and session storage through your browser at any time. Doing so will sign you out and reset your preferences, including any unsaved trade draft.

5. Analytics, Marketing Measurement and Your Consent

5.1 Analytics and marketing measurement are opt-in. Nothing in the Analytics or Marketing categories loads, sets a cookie, or collects anything until you actively consent to that category on our consent banner or in cookie preferences. Declining costs you no functionality. The anonymous funnel measurement in clause 5.8 is not part of those categories: it uses no cookies or browser storage.

5.2 The banner presents "Accept" and "Reject" with equal prominence. Closing or ignoring it is treated as a rejection. The banner's buttons are labelled “Accept All” and “Reject All”, and Analytics and Marketing can be turned on or off separately in the “Manage Preferences” panel.

5.3 The consent-based PostHog analytics described in this clause (separate from the anonymous funnel measurement in clause 5.8) is configured to identify known users only, with automatic pageview capture and autocapture disabled. It does not record your screen, keystrokes or trade data. The events we send to PostHog are limited to signup completion, including your email address and whether you opted in to marketing, and the user properties are your user identifier, email address and subscription tier.

5.4 Google Analytics 4 measures how the Platform is used, for example which pages are visited and how visitors arrive. It does not receive your trade data. The Cookie Policy lists what Google Analytics collects. GA4 Enhanced Measurement is enabled, so GA4 also automatically records scrolls, outbound link clicks, site search, video engagement and file downloads. We do not send GA4 any user ID, email address or other directly identifying information, and Google signals and ads personalisation are disabled.

5.5 The Meta Pixel, used only if you consent to Marketing, measures whether our advertising leads to account creation and subscription purchases. It receives browser and device identifiers and those events (with plan and amount), but not your name, email address or trade data.

5.6 Your consent decision is recorded on your profile with a timestamp, so that it persists across devices and sessions.

5.7 You can withdraw consent at any time from within the Platform or from the cookie preferences link in the footer. Withdrawal stops all future collection in that category and removes the related cookies and storage keys we can control from your browser. Data already sent before withdrawal is held by the relevant provider under its own retention arrangements; contact us if you want us to request its deletion.

5.8 Anonymous funnel measurement. Separately from the Analytics category above, our public pages and the sign-up and upgrade steps of the Platform send a small number of anonymous events to PostHog, Inc. (United States) so that we can count visits and see where people drop out of sign-up. The events are: a page view, use of a free tool, starting and completing sign-up, logging a first trade, reaching the Free plan trade limit, clicking an upgrade button, and starting an Elite trial. This runs without a consent banner choice because it sets no cookie and stores nothing in your browser (no local storage, session storage or IndexedDB). It is not sent from the demo, and it is not sent if your browser sends a Do Not Track or Global Privacy Control signal.

5.8.1 What each event contains. The page address without its query string; the site that referred you, if it is a different site; any campaign (UTM) tags in the link you arrived on; your browser's user-agent string and timezone; the event name; and, for some events, a short label naming the tool, plan or source. It does not contain your user ID, email address, name, trade data or any other information from your account, and it is not linked to your account.

5.8.2 IP address and identifiers. As with any website request, your IP address and user agent reach PostHog with each event. In the cookieless mode we use, PostHog combines them with the site address and a random value that changes every day to calculate a one-way identifier for that day, so that events from the same browser on the same day can be counted together. PostHog's documentation states that the IP address is removed before the event is stored and that the daily value is deleted once that day's events have been processed. Because the daily value changes, we cannot recognise you from one day to the next, and one person can be counted more than once. We rely on PostHog's description of how it handles the IP address. The user-agent string and timezone are stored with the event and are not anonymous in every case: in combination with other information they can sometimes help distinguish a device, which is why we do not combine these events with account data or try to identify anyone from them.

5.8.3 Your choices. Withdrawing Analytics consent does not stop this measurement, because it is separate from that category. You can stop it by turning on Do Not Track or Global Privacy Control in your browser, by blocking requests to us.i.posthog.com, or by contacting us (clause 16). Data already sent is held by PostHog under its own retention arrangements, and we cannot link it to you in order to delete it.

6. How We Use Your Information

6.1 We do not use your trade data for advertising, we do not sell it, and we do not use it to train machine-learning or artificial-intelligence models. There are currently no artificial-intelligence features in the Platform. If we introduce one, we will update this policy and name the provider before the feature becomes available to you.

6.2 We may create aggregated, de-identified statistics from Platform usage. Aggregated statistics do not identify you and cannot reasonably be re-identified.

6.3 Automated decisions. Some decisions on the Platform are made automatically by software: whether you are eligible for the Elite trial; whether a login or request is rate-limited or locked out; whether an account exceeds its Plan limits and becomes read-only; and whether a referral is blocked as a self-referral. None of these decisions uses your trade data. If you think an automated decision about you is wrong, contact us and the operator will review it personally.

7. Who We Share Your Information With

7.1 We disclose personal information only to the service providers listed below, who process it on our behalf and under contract, and only to the extent needed for the purpose stated.

7.2 Affiliate links The Platform contains outbound affiliate links to TradingView, FundingPips, FTMO, Alpha Futures and similar providers. Clicking one takes you to that provider's own website, where their privacy policy applies. We do not send them your personal information. We may receive a commission if you sign up, and we disclose that on the pages where those links appear.

7.3 We may also disclose personal information where we are required or permitted to do so by law, by a court order or a valid request from a regulator or law enforcement agency; where it is reasonably necessary to investigate suspected unlawful activity or a serious threat to a person's life, health or safety; to establish, exercise or defend a legal claim; or to our professional advisers under a duty of confidence.

7.3.1 Where we receive a subpoena, warrant or similar request for your information, we will check that it is valid, disclose only what it lawfully requires, and tell you about it before disclosing where we are legally permitted to do so, so that you have an opportunity to object.

7.3.2 To respond to a chargeback or payment dispute you raise, we may give Stripe and your card issuer records of your acceptance of the Terms and your use of the Platform during the disputed period.

7.4 If our business is sold or transferred, personal information may be transferred as part of that transaction. We would notify you and require the acquirer to be bound by obligations no less protective than those in this policy. Before completion, we would disclose to a prospective acquirer only aggregated or de-identified information, or personal information under a confidentiality agreement limited to evaluating the transaction.

7.5 Affiliates who referred you can see that a referral converted and the commission earned. They cannot see your name, email address, trade data or any other information about your account.

8. Overseas Disclosure

8.1 Your account and trade data is stored in Australia, in Supabase's Sydney region (ap-southeast-2).

8.2 Some of the providers in clause 7 are located, or process data, outside Australia — principally in the United States, the European Union and through global content delivery networks. By using the Platform you acknowledge that your information may be disclosed to those providers in those locations.

8.3 Before engaging a provider we take reasonable steps to satisfy ourselves that it has appropriate security and privacy practices. However, overseas providers are subject to the laws of the countries in which they operate, and those laws may differ from Australian privacy law. Where we disclose information overseas, we may not be able to control or ensure that the recipient will not breach the Australian Privacy Principles, and you may not be able to seek redress under the Privacy Act in respect of that provider.

9. Marketing Communications

9.1 We send marketing email only where you have opted in. Opting in is never a condition of using the Platform.

9.2 Every marketing message identifies us and includes a functional unsubscribe facility. Unsubscribe requests are actioned within 5 business days, in accordance with the Spam Act 2003 (Cth).

9.3 Unsubscribing from marketing does not stop transactional and service messages, such as verification codes, receipts, trial reminders, security notices and support replies. Those are necessary to operate your account and cannot be switched off while you hold one.

9.4 You can change your marketing preference at any time in the Platform or by contacting us.

10. How We Protect Your Information

The security measures we apply include:

• all traffic encrypted in transit over HTTPS, with HTTP Strict Transport Security enabled (two-year max-age, preload);
• row-level security enforced at the database on every table, so a user can only ever read or write their own records;
• privileged profile fields — subscription tier, administrator status and Stripe identifiers — protected by database triggers so they cannot be altered by a client request;
• cTrader OAuth tokens encrypted at rest using AES-256-GCM;
• passwords hashed by Supabase Auth using bcrypt; we never see or store them in plain text;
• optional passkey sign-in using the WebAuthn standard, which is resistant to phishing and password reuse because the private key never leaves your device and we store only the public key;
• cross-site request forgery protection on authorisation flows, using a state parameter and an HttpOnly cookie;
• rate limiting on all API endpoints, and account lockout after repeated failed logins;
• administrative elevation protected by a separate password, with a full audit log of every administrative action;
• security headers including X-Frame-Options, X-Content-Type-Options, a strict referrer policy, a content security policy, and a permissions policy that disables camera, microphone and geolocation access;
• private storage buckets with per-user folder isolation for uploaded screenshots;
• automated error monitoring so that faults are detected and fixed promptly; and
• no card data held on our systems at any time.

10.1 Access to production data is limited to the operator and any administrator the operator has authorised, on a need-to-know basis, for support, fault diagnosis, security investigation and legal compliance. That access is logged. Clause 3.13 lists what the administrator console shows about each user.

10.2 No system is completely secure. While we take the measures above, we cannot guarantee absolute security, and you are responsible for keeping your own password, passkey devices and webhook API key secure.

11. How Long We Keep Your Information

11.1 What happens when you delete your account

11.1.1 You can delete your account from within the Platform. Deletion cancels any Stripe subscription and then deletes your trades, trading accounts, uploaded screenshots, broker connections, passkeys, saved layouts, playbook lists, profile record and authentication record.

11.1.2 Deletion is permanent and cannot be reversed. Export your trade journal to CSV before deleting anything you want to keep (a No-Plan Account asks us for a copy first: clause 6.14.4 of the Terms).

11.1.3 The following is not deleted at the same time, for the reasons given:

• database backup snapshots, for up to 7 days, before they are overwritten in the ordinary rotation;
• payment and transaction records, which we are legally required to retain for 5 years;
• Terms acceptance and consent records, kept as evidence for the periods in the table above;
• your customer record held by Stripe, which Stripe retains under its own policy after we cancel the subscription; that record is outside our control;
• support tickets, which are immediately de-identified and then deleted 12 months after resolution;
• error reports already held by Sentry, until they expire under the retention period above; and
• analytics and marketing data already sent to PostHog, Google or Meta, if you consented; that data is held by those providers and we can request but not guarantee its deletion.

11.1.4 If you want deletion actioned on your behalf rather than through the Platform, contact us and we will process it within 30 days.

11.2 When we no longer need personal information for any purpose permitted by this policy, we take reasonable steps to destroy it or de-identify it.

12. Children

12.1 The Platform is not directed at, and must not be used by, anyone under 18. We require a date of birth and an age confirmation at registration.

12.2 We do not knowingly collect personal information from a person under 18. If we become aware that we have, we will close the account and delete the information promptly.

12.3 If you believe a person under 18 has provided us with personal information, contact us immediately at support.thetradingterminal@gmail.com.

13. Your Rights and Choices

13.1 We do not charge for access or correction requests. We may ask you to verify your identity before we act on a request, to make sure we are not disclosing your information to someone else.

13.2 In limited circumstances we may decline a request — for example, where giving access would unreasonably affect another person's privacy, where the request is frivolous or vexatious, or where we are required by law to retain the information. If we decline, we will tell you why in writing and explain how to complain.

13.3 Residents outside Australia. If you live in a country whose privacy law gives you rights over your personal information (such as the right to access, correct, delete or restrict the use of it, or to object to it, or the right to opt out of its sale or sharing), you can exercise those rights by contacting us. We do not sell your personal information or share it for cross-context behavioural advertising. We will respond within the time your local law requires, or within 30 days if none applies.

14. Data Breaches

14.1 We maintain a process for identifying, containing and assessing suspected data breaches.

14.2 If a breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as soon as practicable, in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). Our notification will describe what happened, what information was involved, and what you should do in response.

14.3 Where a breach originates with one of our service providers, we will act on the information they give us and pass on what is relevant to you.

14.4 Where we suspect a breach, we will complete a reasonable and expeditious assessment within 30 days of becoming aware of the suspicion, consistent with the Notifiable Data Breaches scheme, and keep a record of every suspected breach and our assessment of it, whether or not notification is required.

15. Changes to This Policy

15.1 We may update this policy as the Platform changes. The version number and effective date at the top of this document always identify the current version.

15.2 Where a change materially affects how we handle your personal information, we will notify you by email or in-app notification at least 14 days before it takes effect. Minor changes and clarifications take effect on publication.

15.3 We will always update this policy before introducing a new category of processing, a new service provider that receives your personal information, or any artificial-intelligence feature.

16. Contact Us and How to Complain

16.1 For any privacy question, access or correction request, or complaint, contact us:

16.2 We will acknowledge a privacy complaint within 5 business days and give you a written response within 30 days. If we need longer, we will tell you why and when to expect an answer.

16.3 If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

End of Privacy Policy — Version 1.3, effective 20 November 2026.