Privacy Policy

• Account data: email address, name (nickname), password hash, interface preferences (language, theme, colours).
• Security data: two-factor authentication secrets and recovery codes (encrypted), a security event log (sign-ins, password changes, etc.) with IP addresses.
• Exchange API keys: stored encrypted (AES-256-GCM, with a separate encryption key derived for every user).
• Trading data: trade history synced from connected exchanges (tickers, prices, sizes, commissions, PnL), account balances.
• Your content: screenshots, a profile image (if you upload one), notes, diary entries, trading plans, tags, comments, backtests, habits.
• Payment data: subscription plan, period, status, identifier and the transaction data passed by the payment provider (WhitePay). We do not receive your wallet or card credentials.
• AI analysis history: if the AI advisor is enabled, the generated requests and responses are stored in your account.
• Referral data: your referral code and its association with the users you invited.
• Access-request and contact-form data: email address, name (if provided), message text, IP address and browser details.
• Technical data: server logs needed for diagnostics and security.

There are no advertising trackers. Google Analytics (anonymised usage statistics) is on by default — you can switch it off at any time in the cookie settings, see the Cookie Policy.

• Providing the features of the Service: journal, dashboard, statistics, analytics.
• Syncing trade history from connected exchanges.
• Sending transactional emails: address verification, password reset, notifications.
• Protecting accounts and preventing abuse.
• User support and improving the Service.

We do not sell or rent your personal data.

• Used solely to read trade history, balances and market data.
• Never used for trading or withdrawing funds.
• Never shared with third parties.
• Encrypted at rest (AES-256-GCM).
• Deleted together with the key or the account.

We recommend creating keys with read-only permissions.

• pnltrack_refresh — an httpOnly cookie with the session refresh token; required for signing in.
• pnltrack_locale — the selected interface language; kept for up to 1 year.
• Browser local storage (localStorage) — the access token and interface preferences (dashboard layout, chart settings, etc.).

The session tokens are technically necessary for the Service to work; the interface language and appearance preferences are functional records you can decline in the cookie settings. There are no advertising cookies.

The full list, categories and consent controls are described in the Cookie Policy.

• Hosting: Hetzner Online GmbH (Germany, EU) — the servers where the Service’s data is stored.
• Email: Brevo — delivery of transactional emails (address and name are transferred).
• Payments: a payment provider (WhitePay) — processing of subscription payments.
• Exchanges: the Service calls exchange APIs on your behalf using your keys.
• AI analysis: if the AI-advisor feature is enabled (controlled by the platform administration), trading data without your contact details may be sent to a language-model provider to generate the analysis.
• Spam protection: the contact form may use Google reCAPTCHA — Google processes technical browser data under its own privacy policy.
• Analytics: Google Analytics — unless you have switched analytics off in the cookie settings; Google processes technical browser data under its own privacy policy.

We may disclose data where required by law — strictly following the procedure the law prescribes.

If you connect with a mentor, they see your trading statistics in relative terms (percentages, ratios), as well as tickers, direction and duration of trades, trading plans, comments and ratings. The mentor’s cabinet does not display absolute monetary amounts: PnL in currency, position sizes, commissions or balances.

A mentor also sees your email address, last sign-in date and subscription status.

To end a mentorship, contact your mentor or support.

By creating a public link (to a set of trades, a trading plan or a trading day) you make the corresponding data available to anyone who has the link.

For a set of trades, monetary amounts can be hidden when the link is created; when amounts are hidden, the “% of deposit” metric does not reveal the deposit size. A trading-day page displays the day’s result, including monetary values.

A link to a set of trades or to a trading plan can be revoked at any time; a trading-day link stays active once created.

• Passwords are stored only as hashes (bcrypt).
• API keys and 2FA secrets are encrypted with AES-256-GCM.
• Data in transit is protected by HTTPS.
• Server access is restricted.

Data is kept for as long as your account exists. After account deletion we retain minimal service records (the security event log, a deletion record and the feedback you left), which may contain your email address — for security and abuse prevention.

Database backups are retained for a limited period (as a rule, no longer than 30 days) and are used only for disaster recovery.

• Access and rectification: most data can be viewed and changed in the account settings.
• Export: the trade journal can be downloaded as an Excel file.
• Deletion: you can delete your account yourself in the settings (with email confirmation) or by writing to hello@pnltrack.trade; residual copies disappear as backups rotate.
• Objection or restriction of processing: contact the same address.

If you are located in the European Economic Area, you also have the rights provided by the GDPR, including the right to lodge a complaint with a supervisory authority.

The Service is intended for persons who are at least 18 years old. We do not knowingly collect data from children.

We may update this Policy. The current revision is published on this page together with its date. We will additionally announce material changes by email or an in-app notification.

For questions about personal data contact hello@pnltrack.trade or use the contact form.