Privacy Policy

Effective date: [EFFECTIVE DATE] · Controller: [COMPANY NAME]

1. The short version

• TiltLab runs on your own computer. Your journal, charts and market data stay there unless you choose to sync.
• We collect what we need to run your account: your email, your plan and billing status, and the data you choose to sync or post.
• Stripe handles card payments. We never see or store your full card number.
• We don't sell your personal information, and we don't use advertising trackers.

2. What we collect

Information you give us

• Account: email address, password (stored only as a secure hash by our authentication provider) or sign-in method, and an optional display name.
• Waitlist: the email you submit on this website.
• Billing: your plan, subscription status, billing country and payment history. Card details are collected and stored by Stripe; we receive only limited information such as card brand, last four digits and expiry.
• Synced journal data (only if you turn on sync): trades and fills, notes, tags, plans, prop-account settings, Trader DNA results and MyMentor rules that you choose to store in the cloud, for example to use more than one device.
• Floor and Marketplace content: messages, calls, profile details, scorecards, mentor listings and their alert records. Floor posts and scorecards are visible to other users. Calls can't be edited, and can only be withdrawn in their first 2 minutes (see the Terms).
• Creator payout details: if you sell on the Marketplace, identity, bank and tax information is collected by Stripe for payouts. We receive payout status and limited identifying information.
• AI requests: questions you ask the AI mentor and the context the app sends with them (for example recent chart data, your plan, and Trader DNA summaries).
• Support: anything you send us when you contact us.

Information collected automatically

• Service logs: when the app talks to our servers we log technical data such as IP address, app version, operating system, timestamps, and errors, for security and troubleshooting.
• Crash reports and usage diagnostics: [DESCRIBE IF ADDED; OFF BY DEFAULT].

3. What stays on your computer

By default, your journal, local settings, replay data and live prices from your NinjaTrader feed are stored on your own computer and are not sent to us. Broker credentials you enter for features such as Tradovate sync are stored on your computer and used to connect directly to your broker; we don't receive them. If you pair a phone with the desktop app on your local network, that connection runs between your own devices.

4. How we use data

• To provide the Service: accounts, sync, the Floor, the Marketplace, AI features and support. (Legal basis where applicable: performance of our contract with you.)
• To bill subscriptions and pay Creators. (Contract; legal obligation for tax and accounting records.)
• To keep the Service secure, prevent fraud and abuse, maintain the integrity of scorecards and track records, and enforce our Terms. (Legitimate interests; legal obligation.)
• To send service emails: security, billing, changes to terms. With your consent or where the law allows, occasional product updates, which you can turn off at any time.
• To improve the Service using aggregated or de-identified information.

We don't use your trading data to trade, we don't sell it, and we don't use your synced journal or AI conversations to train AI models. Our AI provider's handling of the data is governed by its commercial terms, under which it may not use API data to train its models.

5. Processors we use

We use these service providers to run the Service. They process personal information on our behalf under contracts that limit how they can use it:

• Supabase (database, authentication, realtime channels): account data, synced journal data, Floor and Marketplace content.
• Stripe (payments, subscriptions and Creator payouts): billing and payout information. Stripe also acts as an independent controller for some data under its own privacy policy.
• Anthropic (AI models): the content of AI mentor requests.
• Render (application hosting): our servers and service logs.
• Cloudflare (website hosting and security): requests to this website, including IP addresses.
• Google Fonts (web fonts on this website): your browser requests font files from Google, which receives your IP address.
• [EMAIL DELIVERY PROVIDER, IF USED.]

6. Sharing

We share personal information only with the processors above; with other users when you post on the Floor or list on the Marketplace (for example your display name, posts, calls and scorecards); with a Creator when you subscribe to their mentor (limited to what's needed, such as your display name; never your email unless you agree); when required by law or to protect rights and safety; and in connection with a merger, acquisition or sale of assets, subject to this policy. We don't sell or "share" personal information for cross-context behavioural advertising as those terms are defined in California law.

7. Cookies and this website

This website doesn't use analytics, advertising or tracking cookies. The waitlist form sends only the email you type. The desktop app and web apps use strictly necessary storage, such as a login session and device pairing cookie, to keep you signed in and secure. [IF ANALYTICS ARE ADDED LATER, DESCRIBE THEM HERE AND ADD A CONSENT CHOICE WHERE REQUIRED.]

8. Retention

• Account and synced data: for as long as your account is active. When you delete your account we delete or de-identify it within [30] days, apart from backups, which expire within [90] days.
• Floor calls and Marketplace ledger records: kept while your account exists so scorecards and track records stay intact. On account deletion they are removed or de-identified, except where we must keep them for legal reasons or to resolve disputes.
• Billing and tax records: as long as the law requires (typically up to [7] years).
• Waitlist emails: until launch plus [12] months, or until you ask us to remove yours.
• Service logs: up to [30] days, longer if needed to investigate a security incident.

9. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, to withdraw consent, and to appeal our decision on a request. California residents have rights under the CCPA/CPRA, including to know, delete, correct and opt out of sale or sharing (we don't sell or share). People in the EEA and UK have rights under the GDPR and may complain to their local data protection authority. We won't discriminate against you for exercising your rights.

To make a request, email [email protected] from the address on your account. We may need to verify your identity. You can also turn off sync and delete local data from within the app at any time.

10. Security

We use encryption in transit, access controls, row-level security on our database, and signed records for Marketplace ledgers. No system is perfectly secure. Keep your password and computer secure. If we learn of a breach affecting your personal information, we'll notify you as the law requires.

11. International transfers

We are based in the United States and our processors may store data in the United States and other countries. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for transfers from the EEA, UK or Switzerland.

12. Children

The Service is for adults 18 and over. We don't knowingly collect personal information from anyone under 18. If you believe a minor has given us information, contact us and we'll delete it.

13. Changes and contact

We'll post changes to this policy here and update the effective date. For material changes we'll notify you by email or in the app. Questions or requests: [COMPANY NAME], [email protected]. [POSTAL ADDRESS.] [EU/UK REPRESENTATIVE, IF REQUIRED.]