1. Information we collect
Account data. Username, email address, optional first/last name and phone number, a one-way hash of your password, and a machine-generated API key used to authenticate your sessions. Email is verified via a 6-digit one-time code.
Brokerage and import data (optional). If you connect a supported broker or import a file, we process the credentials or authorization tokens needed for that connection and the account, balance, position, order, fill, fee, and trade-history data you direct us to retrieve or import.
Journal and preferences. Notes you write, watchlist tickers you add, notification preferences, timezone, theme, and any trading goals you set.
Billing data. If you subscribe, a Stripe customer ID, subscription ID, price/plan, status, and renewal date. Stripe collects and stores your payment method directly; we never see or store full card numbers.
Advertising measurement. Google Ads may receive conversion events when an ad visitor verifies an account or completes subscription checkout, together with standard browser and ad-click identifiers. We do not send Google your trading journal, brokerage positions, trade history, password, or payment-card details.
Operational logs. Standard web-server logs (IP, user-agent, request path, timestamps), rate-limit counters, and signup attempts. These are retained for up to 90 days for security and abuse prevention.
2. How we use it
- Provide the journal, analytics, AI review, market calendar, and broker synchronization or import features you request.
- Authenticate you, issue sessions, and protect the service from abuse (rate limiting, anomaly detection).
- Send transactional email (verification, password reset, billing receipts, service notices).
- Process payments through Stripe when you subscribe.
- Measure whether Google Ads lead to verified accounts or subscriptions.
- Debug problems you report and improve the product.
We do not sell your personal information. We use Google Ads measurement to attribute conversions and improve campaign performance.
3. Legal bases for processing
Where applicable law requires a legal basis, we process information to perform our contract with you (account, synchronization, analytics, support, and billing), for legitimate interests such as securing and improving the service, to comply with legal obligations, and with consent where required for advertising measurement or similar optional technologies. You may withdraw consent at any time without affecting processing that occurred before withdrawal.
4. Sharing, processors & international transfers
- Supported brokers and import providers — only when you request a connection or import.
- Stripe — for subscription billing. See Stripe’s privacy policy at stripe.com/privacy.
- Google Ads — for advertising attribution and conversion measurement.
- Email provider — for transactional and support email delivery.
- Hosting, database, security, and performance providers — to operate, protect, and monitor the service.
- AI model providers — when you choose an AI feature, the relevant prompt and trading context are sent to the configured model provider to produce the response.
- Market data provider — anonymous server-side fetches for public stock quotes shown on your watchlist.
Some providers process information in countries other than your own. Where required, we rely on approved transfer mechanisms or other lawful safeguards. We may also disclose information when required by law, to protect rights or safety, or as part of a merger, financing, acquisition, or sale of assets, subject to appropriate protections.
5. Security
Passwords are stored using bcrypt hashing. Sessions are issued as httpOnly cookies with the Secure and SameSite attributes set in production. We enforce rate limiting on authentication endpoints and perform server-side HTML sanitization on journal content. No system is perfectly secure; if you suspect a vulnerability, email us at support@mytradelens.com.
6. Retention & deletion
We retain account data while your account is active. You can delete your account from the Profile page, which triggers a purge of your rows across all MyTradeLens tables including Schwab tokens and cached brokerage data. Stripe retains its own records for regulatory/accounting purposes even after account deletion. We may retain limited records when reasonably necessary for security, fraud prevention, dispute resolution, accounting, or legal compliance. Operational logs and rate-limit counters generally roll off within 90 days.
7. Your privacy rights
Depending on where you live and applicable law, you may have rights to access, correct, delete, restrict or object to processing, obtain a portable copy, withdraw consent, and appeal a denied request. You may also complain to your local data-protection authority. Submit a request to support@mytradelens.com. We may verify your identity and will respond within the period required by applicable law. We do not discriminate against users for exercising privacy rights, and we do not sell personal information.
9. Children
MyTradeLens is not directed to children and is available only to people who can legally form a binding contract. We do not knowingly collect personal information from children under 13. Contact us if you believe a child provided information to us.
10. Changes to this policy
We may update this policy from time to time. Material changes will be announced in-app or by email at least 14 days before they take effect.
11. Contact
MyTradeLens is the controller of the personal information described in this policy. Privacy questions, data requests, and security disclosures: support@mytradelens.com. For general help, visit our Support page.