Privacy Policy

1. Scope and who we are#

This Privacy Policy applies when you visit our websites, create an account, use the trading journal, Market Monitor, AI, community or developer API, or communicate with us (collectively, the "Service"). For purposes of applicable data protection law, the operator of TheProfitPath ("TheProfitPath," "we," "us," or "our"), identified in full at the end of this policy and in the Legal Notice, is the controller of the personal information described here unless we say otherwise. Where an organization uses the Service with its members' data we act as its processor under the Data Processing Addendum.

This policy is a notice about our practices, not a request for consent. Where consent is required we ask for it separately and you can withdraw it at any time. If you use the Service on behalf of an organization or share information about another person, you are responsible for having the authority to do so.

2. Information you provide#

Depending on how you use the Service, you may provide:

• Account and profile information: name, email address, username, password (stored only as a hash), avatar, biography, time zone, public-profile setting, theme and interface preferences, email-verification status, and the date and version of the Terms and this policy you accepted.
• Security and developer information: two-factor settings, recovery-code hashes, active sessions, organization memberships, and API-key names, prefixes, scopes, last-use times and request records. We store API-key hashes, never the full key.
• Trading and journal information: trades, positions, symbols, prices, quantities, profit and loss, account names and balances, cash-flow records, targets, risk rules, prop-firm phases, strategies, playbooks, backtests, goals, tags, notes, checklists, screenshots, emotions, confidence ratings, mistakes, lessons, reports and other content you choose to record.
• Integration and import information: CSV files and filenames; Notion workspace details, selected pages, imported text, images and encrypted connection tokens; and any other connection information you choose to provide. Do not provide credentials unless a feature specifically requests them.
• AI information: Intelligence prompts, messages, attachments, message ratings and feedback notes, selected journal or trade context, projects, chat searches, @ mentions, conversation history, generated responses, automatic period reports and scores, derived memories, insights and learning signals, and AI-turn metadata such as task, response mode, model, provider, tools used, failures, evidence summary and latency. For research-backed turns we may retain source URLs, hostnames, titles, bounded excerpts, query hashes, dates, authority indicators and relevance scores.
• Voice information: when you start a live voice call, audio captured from your microphone for the duration of the call, the transcript produced from it, the spoken reply generated for you and your voice settings. Your browser asks for microphone permission first and audio is captured only while a call is active.
• Market Monitor and indicator information: the instruments, timeframes, layouts, alerts, screeners and preferences saved to your account, the market reports generated for the instruments you view, and the indicators you build, publish or install.
• Community and collaboration information: profile content, posts, comments, likes, saves, follows, blocks, stories and story views, shared trades, achievements and share cards with the fields you reveal, direct messages including images, video and GIFs, mentor connections and content shared with mentors or students.
• Support, legal and feedback information: your name, email, messages and attachments, the page you contacted us from, satisfaction responses, bug reports, feature requests, content reports, privacy requests, cancellation requests, appeal statements and product-tour activity. Visitors without an account can use guest support and the public forms.
• Billing information: subscription tier, billing status, Stripe customer and subscription identifiers, AI credit balance and purchases, auto-reload settings and consents, coupon and referral activity, and transaction records. Stripe processes payment-card details; we never store full card numbers.
• Notification choices: email, in-app and push notification preferences, delivery state and interactions with notifications.
• Safety, enforcement and appeal information: reports and safety signals, case summaries, content or activity preserved as evidence (encrypted), integrity metadata, risk and severity assessments, AI and human decision records, warnings or restrictions, enforcement history, appeal statements and outcomes, legal holds, administrator notes and chain-of-custody and audit records.

3. Information we collect automatically#

When you use the Service we and our providers automatically collect technical and activity information such as IP address, approximate location derived from IP (country and region), browser and device type, operating system, language, requested pages and API routes, referring URL, dates and times, session activity, feature interactions, error records, security events and rate-limit or abuse signals. Safety and audit records may include the relevant account or content identifier, actor, action, reason, request or session identifier, time, hashes, prior and resulting access state and related metadata. New general operation and audit records exclude raw IP addresses and user agents; active authentication sessions and dedicated security systems have separate security records.

Cookieless web analytics and campaign attribution. We use self-hosted Umami for aggregate pageviews and completed signups. Pageviews contain coarse route labels, without URL queries, dynamic identifiers, titles, or referrer URLs. Signup events contain campaign labels, without account IDs, email addresses, or trading data. We do not forward client IPs with server-side signup events. Umami processes network metadata for short-lived, cookieless aggregation; we do not enable persistent visitor identification or session replay. Do Not Track and Global Privacy Control block these events. Landing-link campaign labels (ref, utm_source, utm_medium, utm_campaign) are separately kept in local storage until site data is cleared; their first values are saved with a newly created account and its signup event.

Optional product analytics. This is off by default. If you explicitly allow it in Settings → Data & privacy, we collect page sections, control types, interaction types, a random per-tab session identifier, timestamps and timing for product improvement and support. We exclude typed values, visible labels and text, clipboard contents, error messages, destination URLs, query strings and browser fingerprints. Authorized administrators can review these records; other users cannot. You can withdraw consent using the same settings control without losing access. Withdrawal stops collection and deletes existing optional activity records. Browser Global Privacy Control and Do Not Track signals also block this collection. Records otherwise expire after 90 days under the scheduled retention job. Historical records collected under an earlier notice may remain until their original retention period ends; earlier records are not relabelled as consented records.

Necessary operation and evidence records. We separately record server-observed operations to provide and secure the Service, reconcile billing and referrals, investigate incidents and account for sensitive actions. Records contain a server-generated request identifier, an account identifier when authenticated, a route template or action, category, outcome, HTTP status, duration and timestamp. We exclude request and response bodies, URL queries, passwords, authentication tokens, private conversations, journal text, card details and other unnecessary content. Selected account, session, privacy, referral, billing, export, deletion and administrator events enter a hash-linked audit ledger. Optional analytics choices have separate timestamped, versioned records. Each time you accept or confirm you have read one of our legal documents (at sign-up, or after a document changes) we record which document, the exact version, a fingerprint of its text, the time and how you did it, in a record that cannot be edited or deleted, and we keep an encrypted copy of every version we publish. Accepting the Terms does not grant optional analytics consent. Evidence may be queued before it enters the ledger. These records document observed events; a log alone does not establish wrongdoing or guarantee legal proof.

Security and abuse records. When a request is refused (for example by a rate limit, a missing sign-in, a failed security-token check or a disabled feature) the operation record also contains the server's reason code. Refused requests and failed sign-in, password-reset and two-factor attempts additionally carry a network fingerprint: a keyed, truncated hash of the connection's IP address that changes every calendar month and cannot be turned back into the address. A failed sign-in is linked to the account it was aimed at when that account exists; we never record the typed email address, password or code. We use these records to detect and stop password guessing, credential stuffing, scraping, abuse of rate limits and attempts to reach restricted areas. Live connections (real-time updates and live voice calls) are recorded once when they end, with their duration and the number of messages they carried, or with the reason they were refused; never what was said or sent.

AI request records. For each call to an AI model we record which feature asked for it, the account (or that it was a support visitor or a background job), whether the paid or the free model lane was used and why a paid request moved to a free model, the provider and model, the number of attempts, token counts reported by the provider, timing and the result or error code. We never store the prompt, the answer or tool inputs in these records. They let us operate the AI lanes, reconcile credit, find failing providers and detect abusive volumes.

We use no third-party analytics or advertising trackers. Cookies and browser storage are listed in full in the Cookie Policy.

4. Information from other sources#

• Google: if you sign in with Google we receive your Google account identifier, name, email address and profile image. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
• Notion and connected services: at your direction, workspace information and content you authorize us to access or import.
• Other users: information another user provides when they follow, mention, message, connect with, refer or report you.
• Payment, email, hosting and infrastructure providers: transaction status, delivery status, security signals and operational information needed to provide the Service.
• Market data and charting providers: prices, candles, news and calendar information about instruments and markets, not about you.

5. How and why we use information#

We do not use personal information for advertising, do not sell it and do not build profiles about you for third parties. Our legitimate interests never override your fundamental rights: where the balance tips in your favour, we do not rely on them.

6. AI, personalization and service improvement#

When you use AI features we send your prompt, attached images, relevant conversation history and the journal context the feature selects to an AI provider so it can generate a response. Which provider handles a request depends on your plan, the task and availability; the current providers are OpenAI (premium model), Mistral AI (backup model and memory search, speech recognition and synthesis for live voice, safety classification), OpenRouter and NVIDIA (free-lane models) and Tavily (web search, which receives only a search query derived from your request). None of them may use your content to train their models under our agreements. The AI Transparency Notice describes each one. We separately keep metadata about each AI request (feature, model, tokens, timing and result, never the content) as described in Section 3.

Live voice mode. While a call is active, audio from your microphone is streamed through our real-time voice gateway to a speech provider, currently Mistral AI, which converts it to text; the reply is converted back to speech and played to you. Audio is not retained as a recording. The transcript, the reply and any memories derived from them are stored with your other AI conversations and used the same way.

Memory and learning. We store AI conversations, feedback, generated content and derived memories to preserve history, personalize later responses, evaluate quality and safety, troubleshoot and improve the Service. You control memory in Settings → Intelligence → Memory: whether past chats can be searched, whether lasting facts are generated, whether memory is used in conversations, whether sensitive topics may be remembered, and you can edit or delete every memory. We may create learning or evaluation examples from selected interactions after removing or generalizing identifiers, financial amounts, dates, account IDs, image links and similar details; approved de-identified examples may be used as context for later AI responses and to evaluate quality. De-identification reduces but may not eliminate every risk in free-form text, so do not include information about yourself or others that is unnecessary for your request. Information that has been irreversibly anonymized is not personal information under this policy.

Safety review and access enforcement. Separately from coaching, our safety systems may send case summaries and relevant evidence to an AI provider, currently Mistral AI, for classification and independent adjudication of category, severity, confidence, evidence sufficiency and proposed action. When the configured evidence and confidence requirements are met, a warning, throttling, feature restriction, suspension or ban may be applied automatically. This is the only automated decision-making with significant effects on the Service. You have the right to obtain human intervention, to express your point of view and to contest the decision through the appeal route described in the Guidelines; every appeal is reviewed by a person. We keep decision hashes and related records so the process can be audited.

7. How we disclose information#

We disclose personal information only as described here:

• Service providers (processors): hosting and infrastructure (Vercel, Cloudflare, our EU virtual-server provider), payments (Stripe), email (Resend), media storage (Cloudinary), AI (OpenAI, Mistral AI, OpenRouter, NVIDIA, Tavily), monitoring (Better Stack) and support tooling. They process information only on our instructions and are listed with locations at /legal/subprocessors.
• Embedded and media providers: charting embeds (TradingView), GIF providers (Giphy, Tenor) and Stripe's checkout pages receive the requests your browser makes to display their content, under their own privacy policies. We do not send them your journal, trade or conversation information.
• Integrations you choose: Google and Notion when you connect an account or request an import, and any external application you give an API key, until you revoke it. Their handling of exported data is governed by their own terms.
• Other users and the public: information you place in a public profile, post, comment, story, shared AI chat, share card, shared trade, achievement, published indicator or other public area. Direct messages are visible to participants, are not end-to-end encrypted and may be accessed when reasonably necessary for support, safety, security, enforcing our Terms or legal compliance.
• Authorized administrators: personnel with an operational need may access account, journal, AI, community, support, safety and related records to operate and support the Service, investigate abuse or incidents, review evidence and appeals, enforce our Terms and comply with law. Access is role-based, protected by two-factor authentication and recorded in tamper-evident audit logs.
• Mentors, students and organizations: information made available through a mentor connection or an organization workspace. Review your connections and sharing choices before posting sensitive journal information.
• Someone who referred you: if you joined through another user's referral link, that user can see that you signed up and whether the referral qualified, and can export a list of the people they referred that includes username, email address and those dates. They may use it only for the referral program and in line with privacy law. If you would rather this not apply, do not sign up through a referral link.
• Professional advisers: lawyers, accountants, auditors and insurers under confidentiality duties.
• Authorities and affected parties: when we reasonably believe disclosure is required by law, a court order or a valid request from a competent authority, or is necessary to protect the Service, users, our rights or the rights and safety of others. Where the law allows, we tell you first.
• Business transfers: parties to a financing, reorganization, merger, acquisition, sale or insolvency, under confidentiality protections; this policy continues to apply to your information.

We do not sell personal information, do not share it for cross-context behavioural advertising and have not done so in the preceding 12 months.

8. Public content and sharing#

Public profiles and content can be viewed, copied, indexed, reshared or captured by others. Deleting content from the Service may not remove copies already shared by other users, stored in browser or search caches or retained where legally permitted. Mentor mode, share cards and shared AI links can reveal journal, analytics or conversation information to the people who receive access. Only connect with people you trust, check whether a profile or item is public and remove sensitive details before sharing.

9. Data retention#

We keep personal information only as long as needed for the purposes above. Retention depends on the type of information, whether your account is active, sensitivity, security needs, limitation periods and legal, tax, accounting or dispute-resolution requirements.

10. Security#

We use technical and organizational safeguards designed to protect personal information: TLS encryption in transit, encryption at rest for the database and backups, password hashing, encryption of selected secrets such as two-factor and Notion connection secrets, encryption of safety evidence and appeal statements, integrity hashes, append-only custody records, tamper-evident audit chaining, role-based access controls with two-factor authentication for administrators, session controls, rate limiting, dependency and vulnerability management and a responsible-disclosure programme. Live voice mode runs through a dedicated real-time gateway; audio reaches it over an encrypted connection and is held only as long as the call needs it.

Breach notification. If a personal data breach is likely to put your rights at risk we notify the competent authority within 72 hours of becoming aware, as the GDPR requires, and tell you without undue delay by email and in the Service, with what happened, what we are doing and what you can do.

No system is completely secure. Protect your password, recovery codes, API keys and devices, enable two-factor authentication, and tell us promptly if you suspect unauthorized access.

11. International data transfers#

Your account data is stored in the European Union. Some providers process information in the United States or other countries whose laws differ from yours. Where that happens we rely on an adequacy decision (including the EU–US Data Privacy Framework for certified providers) or on the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum and Swiss amendments, together with supplementary measures where needed. For transfers from Brazil, Canada, Australia, Japan, Korea, India, Singapore, South Africa and other countries we use the mechanism those laws recognise, including contractual protections. You can ask for a copy of the relevant safeguards at [email protected].

12. Your choices#

• edit your profile and public-profile setting;
• delete individual trades, posts, comments, stories, AI chats, projects, memories, indicators and other content;
• control AI memory, sensitive topics and chat search in Settings → Intelligence → Memory;
• end a voice call, mute the microphone or withdraw microphone permission in your browser;
• choose which trade fields a shared post reveals before you publish it;
• disconnect Notion, mentors, students, organizations or other integrations;
• revoke API keys and active sessions;
• change notification preferences or use the one-click unsubscribe link in any recurring email;
• export everything as JSON or delete your account in Settings → Data & privacy; and
• clear cookies or local storage through your browser (see the Cookie Policy).

13. Children#

The Service is intended only for people who are at least 18 years old. We do not knowingly collect personal information from anyone under 18 (or under the age of digital consent in their country), we do not direct any part of the Service to children and we close accounts that turn out to belong to a minor and delete their data. If you believe a minor has provided personal information, contact us so we can act.

14. Your privacy rights#

Wherever you live, you can ask us to: access the personal information we hold about you and receive a copy; correct inaccurate information; delete it; restrict or object to processing, including processing based on legitimate interests and product activity recording; receive your information in a portable, machine-readable format; withdraw consent you previously gave; not be subject to a decision based solely on automated processing without human review; and appeal if we refuse a request. We apply these rights to everyone, not only where the law requires them.

How to exercise them. Export and deletion are self-service in Settings → Data & privacy. For anything else use the privacy request form or email [email protected]. We may need to verify that you own the account, usually by asking you to confirm from the account email. An authorized agent may act for you with written permission. We respond within one month (45 days under US state laws), extendable once where the law allows and we tell you why. Requests are free unless manifestly unfounded or excessive. We never discriminate against you for exercising a right.

Limits. Deletion and objection are not absolute: we may keep invoices and tax records, security and fraud-prevention records, safety evidence under a legal hold and audit, decision, enforcement and appeal records where the law permits or requires it, and we may continue processing where we have compelling legitimate grounds that override your interests or need the information to establish, exercise or defend legal claims. We tell you which records we keep and why.

Complaints. You can complain to the supervisory authority where you live, work or where the issue happened. We would appreciate the chance to resolve your concern first.

15. Do Not Track and Global Privacy Control#

There is no uniform standard for browser Do Not Track signals, so the Service does not respond to them. We do not sell or share personal information for cross-context behavioural advertising, so a Global Privacy Control signal does not change our practices; we treat it as a valid opt-out for the future should our practices ever change, and we would update this policy first.

16. Third-party services#

Third-party websites, integrations, market-data sources, payment services and linked content operate under their own terms and privacy policies. This policy does not govern their independent processing. Review their policies before connecting an account, following a link or providing information.

17. Changes to this policy#

We may update this policy to reflect changes to the Service, our practices or the law. We post the revised policy with a new effective date. If a change materially affects your rights or how we use personal information we give you notice in the Service or by email at least 30 days before it takes effect, and we request consent where the law requires it; continued use alone is not treated as consent where an affirmative choice is required.

18. California and other US states#

This section applies to residents of California and of the other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Jersey, New Hampshire, Nebraska, Kentucky, Maryland, Minnesota, Tennessee, Indiana and Rhode Island). In the preceding 12 months we collected the categories of personal information below for the business purposes in Section 5, from the sources in Sections 2 to 4, and disclosed them to the service providers in Section 7.

You have the right to know, delete, correct, and to opt out of sale, sharing and targeted advertising (we do none), and to limit the use of sensitive personal information (we use it only to provide the Service you request, as permitted). We do not use or disclose sensitive personal information for inferring characteristics, and we do not knowingly sell or share the information of anyone under 16. Exercise your rights as described in Section 14; we verify requests by confirming the account email, you may use an authorized agent, and you may appeal a decision by replying to our response, after which we tell you how to contact your state attorney general. California's "Shine the Light" law: we do not disclose personal information to third parties for their direct marketing. Retention is described in Section 9. The referral program gives rewards to the referrer, not in exchange for your personal information, so it is not a financial incentive program under the CCPA.

19. Regional disclosures#

European Economic Area, United Kingdom and Switzerland: the legal bases in Section 5 apply. Where we rely on legitimate interests you can object (Section 14). Explicit consent is the basis for sensitive memory topics. You may lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office; in Switzerland, the FDPIC). Our representative details, if any, appear below.

Brazil (LGPD): you have the rights in article 18 of the LGPD, including confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing and about the consequences of refusing consent, and revocation of consent. Our data protection officer (encarregado) can be reached at [email protected]. Complaints go to the ANPD.

Canada: we comply with PIPEDA and provincial laws including Quebec's Law 25. The person in charge of the protection of personal information is reachable at [email protected]. Your information may be stored and processed outside Canada, including in the EU and the United States, where it is subject to local law; we assessed those transfers. You may withdraw consent subject to legal or contractual restrictions, and complain to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.

Australia: we are bound by the Australian Privacy Principles. We may disclose information to the overseas recipients listed in Section 7. You can complain to us and then to the Office of the Australian Information Commissioner.

Japan: we handle personal information under the Act on the Protection of Personal Information; information may be transferred to third parties abroad as described, under contractual protections equivalent to the Act. Requests for disclosure, correction, suspension of use or deletion follow Section 14.

South Korea: we comply with the Personal Information Protection Act. Section 7 and the subprocessor list identify the recipients abroad, the countries, the items transferred, the purposes and retention. You may refuse the overseas transfer by not using the Service, as it is necessary to perform the contract.

India: under the Digital Personal Data Protection Act 2023 you may access, correct and erase your data, nominate a person to exercise your rights and lodge a grievance at [email protected], which we answer within the statutory period before you approach the Data Protection Board.

Singapore, South Africa, Nigeria, Kenya, Israel, Turkey and others: we apply the PDPA, POPIA, NDPA, DPA, PPL, KVKK and other applicable laws, including their rules on consent, notification, cross-border transfer and the right to complain to the relevant commissioner or authority. The information officer or representative, where one is required, is reachable at [email protected].

20. Contact#

For privacy questions or requests, use the privacy request form, email [email protected], use the support chat in the Service or the contact support page. Please identify the account email involved. Our full identification, including our data protection officer and EU or UK representative where appointed, is below.