How TraderBalance handles your data

TraderBalance is run by TraderBalance Ltd, a company registered in England and Wales (company number 17349969), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are the controller of the personal data described in this notice.

For anything about your data, email support@traderbalance.com.

Details you give us when you sign up or edit your profile:

• Your first, middle (optional) and last name, a username, your email address and your mobile number.
• Optionally, a billing address and country, and a profile photo.
• Your password, which is stored only in scrambled (hashed) form. We never see it.
• If you sign in with Google instead, the name and email address Google shares with us.
• A record that you agreed to our terms of service and read this notice: which version, and when.
• Whether you chose to get product news and offers by email, and a record of each time you said yes or no: the exact wording you were shown, when, and where (sign-up, first-time setup or Settings).

What you record in TraderBalance: your trading and prop-firm accounts, balances and balance updates, payouts and withdrawals, expenses and subscriptions, goals, reminders, trades and the notes you write on them, and your settings (currency, notification preferences).

Messages you send us through Help & support, the contact form or by email, and our replies.

Affiliate programme: if you apply, the details on your application (platforms, channel link, audience size, your message and the code you ask for). If you open someone's referral link, we record a click against that affiliate with a random browser ID, not your name or IP address (see Cookies).

Technical information: when you last used the app, and the short-lived technical logs our hosting provider keeps (such as IP address and browser type) for security and troubleshooting.

Sign-in records: each time you sign in, we note the browser (by the random ID in the tb_dev cookie, stored only in scrambled form), its type (for example “Chrome on Windows”) and your approximate location (town and country), which our hosting provider works out from your IP address. We do not store the IP address itself. We use this only to warn you by email about a sign-in from a device and place we haven't seen before.

Two-step sign-in, if you turn it on: our sign-in provider (Supabase) holds the secret your authenticator app uses to make codes, and we keep your backup codes only in scrambled form, with which ones have been used.

Marketing email activity: if you opted in to product news and offers, whether you opened each of those emails and which links you clicked. Opens are detected with a tiny image in the email, so they are approximate. We do not track opens or clicks on any other email we send.

• To run your account and show you your figures: necessary to provide the service you signed up for (contract).
• To reply to support requests and send service messages: sign-up and password-reset codes, a welcome email, confirmations when you contact us, and the reminders and notices in your in-app inbox: contract, and our legitimate interest in running the service properly.
• To email you reminders (payout alerts, expense reminders, your own account reminders and the weekly goal digest): our legitimate interest in helping you use the service. Each kind has its own switch in Settings → Notifications, and every reminder email has a one-click link to stop that kind.
• To keep TraderBalance and your account secure: preventing fraud, abuse and duplicate accounts, signing out inactive sessions, emailing you about new-device sign-ins and changes to your password or sign-in email, and stopping affiliates referring themselves: our legitimate interests. Security emails can't be switched off, so a break-in can't be hidden from you.
• To send product news and offers, and to see whether those emails are opened and which links are clicked so we can improve them: your consent, which is optional and never assumed. You can withdraw it at any time with the unsubscribe link in any of those emails or in Settings → Notifications.
• To meet legal obligations, for example keeping financial records once paid plans exist, or responding to lawful requests: legal obligation.

We do not sell your data, show you adverts, or use analytics or advertising trackers on the website or in the app. We only send marketing emails to people who asked for them. TraderBalance calculates figures from what you enter. It does not make automated decisions about you that have legal or similarly significant effects.

Only with the service providers that run TraderBalance for us, each bound by a contract to use it only on our instructions:

• Supabase: our database, sign-in and file storage, hosted in London, UK.
• Vercel: hosts the website and runs its server code, in London, UK.
• Resend: delivers our emails. If you opted in to product news and offers, Resend also holds your name and email address on our marketing list and records whether you opened those emails and which links you clicked. You are taken off that list as soon as you opt out, unsubscribe or ask us to delete your account.
• Google: hosts our support@ mailbox (Google Workspace), so emails and contact-form messages you send us are stored there; and signs you in, if you choose to sign in with Google.
• Cloudflare Turnstile: checks that sign-in, sign-up, password-reset and contact-form requests come from a person and not a bot. It sees your IP address and technical details about your browser while you use those pages, sets no cookies, and never sees what you type into the form.
• logo.dev: shows prop-firm and broker logos. Your browser loads each logo directly from logo.dev, which therefore sees your IP address and which firm's logo was requested, but nothing from your account.

The TraderBalance support team can view your account when needed to help you or to keep the service secure. We may also disclose data where the law requires it, or to a buyer if the business is ever sold, under this same notice.

Your data is stored in the UK. Vercel, Resend, Google, Cloudflare and logo.dev are based in the United States, so some data may be accessed from there. Where that happens we rely on the UK's approved safeguards: the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Addendum to standard contractual clauses.

• Your account data: for as long as your account is open.
• When you ask us to delete your account, it is locked straight away and permanently deleted 30 days later. You can restore it by signing in before then. After that, your data, including your profile photo and support messages, is removed from our live systems.
• Backups: we keep encrypted backups of our database for up to 30 days, so your data can remain in them until they expire. We never use a backup to restore a deleted account.
• Payment records: kept for 6 years after the payment, because UK tax law requires it. Our payment provider keeps its own records under its terms.
• Hosting logs: kept for a short period by our hosting provider, then deleted automatically.
• Sign-in records and your marketing choices: for as long as your account is open, and deleted with it.
• Two-step sign-in and backup codes: until you turn two-step off or delete your account.
• Our marketing list at Resend: you are removed as soon as you opt out or unsubscribe, and as soon as you ask us to delete your account.
• Affiliate click records hold no personal details about you, only a random browser ID. They are kept while the affiliate's account exists.

Under UK data protection law you can ask us to:

• give you a copy of your data (you can also use Settings → Download my data);
• correct anything that is wrong (most details are editable in Settings; for your name or mobile number, which are locked after sign-up, email us);
• delete your data (you can also use Settings → Delete my account);
• restrict or object to how we use it, or move it to another service.
• stop marketing emails at any time (the unsubscribe link in any of them, or Settings → Notifications).

Email support@traderbalance.com. We reply within one month. It is free unless a request is clearly unfounded or excessive.

TraderBalance uses no advertising or analytics cookies. The first 7 below are strictly necessary. The two affiliate cookies are set only if you click Accept on our cookie banner. If you reject them, an affiliate link you opened still counts, but its code is not remembered.

You can change your choice at any time with Cookie settings (also in the footer of every public page). Choosing Reject deletes the affiliate cookies straight away.

The app also remembers a few display preferences in your browser's local storage. These never leave your device.

Marketing emails (only if you opted in) contain a tiny image that tells us when an email is opened, and their links pass through Resend so clicks can be counted. Our other emails contain neither.

Everything travels over encrypted connections. Each account's records are protected by database access rules so no other user can read them. Passwords are hashed, and credentials for any connected services are stored encrypted.

Some features are built but switched off, including wearable health connections (a daily Readiness score) and broker imports. None of them collects anything while switched off. Health data is special-category data under UK law. Before a health connection is offered, this notice will be updated to explain exactly what is collected, and we will ask for your explicit consent on the connection screen.

If we change how we use your data, we will update this page and its date, and tell you in the app or by email before a significant change takes effect.

Please contact us first at support@traderbalance.com. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

See also our terms of service.