Privacy Policy

1. Information We Collect

• Account information: your name and email address on registration, or the account identifiers provided by Google if you elect to sign in with Google.
• Content you provide: the trades, notes, screenshots, and proprietary-account rule configurations you enter or import, which remain your data.
• Broker connection data: where you connect a broker or platform — Tradovate or NinjaTrader via the provider's OAuth authorization, or Rithmic or CQG via credentials issued to you by your broker or firm — we receive read-only access to your own orders, fills, positions, and account balances, processed solely to build your journal. We cannot place, route, modify, or cancel orders or move funds. Associated tokens and credentials are encrypted at rest using AES-256-GCM in a server-only store, and disconnecting revokes access.
• Payment information: processed entirely by Stripe, Inc. We do not receive or store your full payment card number; we retain only a subscription reference.
• Technical and log data: standard server logs, error reports, and IP addresses, processed for security, fraud prevention, and service operation.
• Advertising measurement: where our marketing pixels (Meta, TikTok) are active, those platforms may set cookies and receive page-view events from our public marketing pages for advertising measurement. Such pixels are not loaded within the authenticated Service and may be blocked with standard tracker-blocking tools.

2. Legal Bases for Processing (GDPR)

Where the GDPR applies, we process personal information on the following legal bases: performance of our contract with you (to provide the Service); your consent (for example, connecting an optional broker account or non-essential cookies); our legitimate interests (securing and improving the Service, and measuring our own advertising on public pages); and compliance with legal obligations (such as retention of billing records).

3. How We Use Personal Information

We use personal information solely to provide and operate the Service — to record your trades, compute your statistics, monitor your configured rules, process your subscription, provide support, secure the Service, and, on public marketing pages only, measure our own advertising. We do not sell your personal information, and the only activity that could constitute 'sharing' under the CPRA is advertising-measurement pixels on the public marketing site; your trading data is never used for advertising.

4. Disclosure of Personal Information; Subprocessors

• Supabase — database, authentication, and file storage (United States).
• Stripe, Inc. — subscription payment processing (PCI-DSS Level 1).
• Vercel, Inc. — application hosting and content-delivery network.
• Google LLC — only where you elect to sign in with Google.
• Meta Platforms, Inc. and TikTok — advertising-measurement pixels on public marketing pages only, where enabled.
• Yahoo Finance — provider of delayed market quotes; no personal information is transmitted to it.
• Your broker or platform — only where you elect to connect one, and solely to read your own trading data with your authorization.
• Legal and safety disclosures — we may disclose information where required by law, legal process, or to protect the rights, property, or safety of Mirrored, our users, or the public.

5. Your Rights (GDPR / CCPA / CPRA)

• Rights of access, correction, portability, and deletion of your personal information, exercisable at any time (Email david@mirrored.online or via the in-app data controls); we respond within the period required by applicable law (generally within thirty (30) to forty-five (45) days).
• Right to opt out of the sale or sharing of personal information: we do not sell personal information; to opt out of advertising-pixel sharing, use a tracker-blocking tool or contact us and we will honor your request.
• Right to non-discrimination for exercising your privacy rights.
• Right to lodge a complaint with your competent supervisory or data-protection authority.

6. Retention and Deletion

We retain personal information for as long as your account remains active. Upon deletion of your account (by you or at your request), your trades, notes, screenshots, and broker tokens are permanently removed from the live database, and encrypted backups age out on a rolling basis. We retain billing records for the period required by applicable tax and accounting law.

7. Cookies; Do Not Track; Global Privacy Control

The authenticated areas of the Service use only strictly-necessary cookies to maintain your session. Public marketing pages may set advertising-measurement cookies where the pixels described above are enabled. Because there is no uniform industry standard for 'Do Not Track' signals, we do not respond to them; however, we honor Global Privacy Control (GPC) opt-out preference signals where required by applicable law.

8. Children's Privacy

The Service is intended for adults trading futures. It is not directed to, and we do not knowingly collect personal information from, any individual under eighteen (18) years of age. If we learn that we have collected such information, we will delete it; please contact us if you believe this has occurred.

9. International Data Transfers

Personal information is processed in the United States by the subprocessors identified above. Where you access the Service from the European Economic Area or the United Kingdom, cross-border transfers rely on our processors' Standard Contractual Clauses and equivalent safeguards.

10. Breach Notification

In the event of a data breach affecting your personal information, we will notify you at your account email address without undue delay, describing the nature of the incident, the information affected, and the measures taken, and we will notify the relevant regulatory authorities where required by law.

11. Changes to This Policy

We may update this Privacy Policy from time to time; we will revise the effective date above and provide in-app or email notice of material changes. Questions regarding this Policy may be directed to us at david@mirrored.online.