Privacy Policy

The Service is intended only for individuals who are at least 18 years old. We do not knowingly collect data from anyone under 18.

• Account information — your email address and authentication data needed to create and secure your account.
• Trade data — trades you import via CSV or that are synced (read-only) from a connected brokerage, including symbols, dates/times, prices, quantities, and P&L.
• Uploaded trade photos — screenshots/images you attach to your trades.
• Journal content — notes, tags, strategies, and rule checklists you create.
• Usage & technical data — basic information generated as you use the Service (e.g., pages used, and standard server logs).
• Billing data — subscription status and identifiers. Card payments are handled by Stripe; we do not store your full card numbers.

We use your data to provide and operate the Service: authenticate you, import/sync and display your trades, compute your journal analytics, store your photos and notes, process subscriptions and the free trial, send necessary account and transactional emails, secure the Service, and comply with law. We do not sell your personal data.

We use a small set of trusted sub-processors strictly to run the Service:

• Stripe — subscription billing and payment processing.
• SnapTrade & Alpaca — read-only brokerage trade/activity data, with your authorization. We never receive or store your broker passwords.
• Supabase — our Postgres database and file storage (including your uploaded trade photos).
• Resend — sending transactional email.
• Vercel — application hosting.
• Cloudflare — DNS for our domain.

These providers process data on our behalf under their own security and privacy commitments.

When you connect a brokerage through SnapTrade (OAuth aggregation) or Alpaca, access is read-only and authorized by you. Any stored connection credentials/secrets are encrypted at rest with AES-256-GCM and are never returned in our API responses. You can disconnect a connection at any time.

We use a single httpOnly session cookie to keep you logged in. We do not use advertising or third-party tracking cookies.

You may request to access, export, or delete your personal data by emailing nexttradeops@gmail.com. You can also delete individual trades, photos, and broker connections from within the app. Depending on your location you may have additional rights under applicable privacy laws.

We retain your account and trade data for as long as your account is active or as needed to provide the Service. When you delete data (or your account), we remove it from our active systems, subject to reasonable backup cycles and any retention required by law (e.g., billing records).

We protect your data with measures including encrypted transport (HTTPS), an httpOnly session cookie, and AES-256-GCM encryption of sensitive stored credentials. No method of transmission or storage is 100% secure, but we work to protect your information and limit access to it.

Our providers may process and store data in countries other than yours. Where data is transferred internationally, we rely on our providers’ safeguards for such transfers.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the effective date above and, where appropriate, by notice.

Questions or privacy requests? Email nexttradeops@gmail.com or use our contact page.