Privacy Policy

Last updated: September 21, 2026

This privacy notice describes how TradeReview ("we," "us," or "our") collects, stores, uses, and shares ("processes") your personal information when you use our services ("Services"), including:

• Our website at https://tradereview.app/
• Our web application at https://tradereview.app/web/
• Our mobile applications for iOS and Android (TradeReview)
• Any related sales, marketing, or support interactions

Questions or concerns? Contact us at support@tradereview.app. See also our Terms of Use, Disclaimer, and Cookie Policy.

Who we are (data controller)

The data controller responsible for your personal information is:

Artsiom Yatskevich (sole proprietor)
NIP: 8943195062
Świętego Mikołaja 8/11/lok. 208
50-125 Wrocław, Poland
Email: support@tradereview.app

Because we are established in the European Union, we do not appoint a separate EU representative under Article 27 GDPR.

1. What information do we collect?

Personal information you provide to us

In Short: We collect personal information that you provide when you register, use the Services, connect brokers, subscribe, or contact us.

Account and profile information

• Email address, display name, first and last name, profile picture
• Timezone, language, currency, dashboard and UI preferences
• Onboarding answers (trader type, experience, markets, goals)
• Notification preferences for email and push

Trading journal data

• Trades, executions, symbols, quantities, prices, fees, profit and loss
• Tags, strategies, cash transactions, notebook notes, and note templates
• Images you upload to trades or notes

Broker connection data

• OAuth access and refresh tokens for supported brokers (such as Alpaca and cTrader)
• Login credentials you provide for broker sync where supported (such as MT5 and TradeLocker), stored to retrieve your trading data at your request
• Linked account identifiers and sync metadata

Subscription and payment information

• Subscription plan, status, billing period, and payment history stored in our systems
• Stripe customer ID for web subscriptions
• Apple App Store or Google Play receipt and transaction identifiers for mobile purchases
• We do not store full payment card numbers

Support communications

• Information you send us by email or through support channels

Information collected automatically

In Short: We collect certain technical and usage information when you use the Services.

• Log and usage data: IP address, browser type, device type, operating system, app version, timestamps, pages or features used, and error or crash reports
• Affiliate attribution data: referral codes, click identifiers, and related visit data when you arrive through a partner link, processed by Revshare to credit referring partners
• Authentication data: refresh tokens stored in secure cookies and local storage to keep you signed in
• Push notification data: device tokens and user identifiers when you enable push notifications through Pushwoosh

We do not collect precise GPS location from your device. Our infrastructure may infer approximate location (such as country) from IP address for security and service operation.

Google API

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2. How do we process your information?

In Short: We process your information to provide and improve the Services, communicate with you, keep accounts secure, and comply with law.

• Provide the Services: create and manage accounts, store and display your trading journal, sync broker data, process subscriptions, credit referring partners, and deliver core app features
• Communicate with you: send service messages, trade reports, app updates, and support responses based on your notification settings
• Improve and secure the Services: troubleshoot errors, analyze usage trends where permitted, prevent abuse, and maintain infrastructure
• Marketing: send promotional or educational emails where permitted by law and your preferences; you can opt out at any time
• Legal compliance: respond to lawful requests and enforce our terms

3. What legal bases do we rely on to process your personal information?

In Short: We process personal information only when we have a valid legal reason under applicable law.

If you are located in the EEA, UK, or Switzerland, this section applies to you.

• Performance of a contract (Art. 6(1)(b) GDPR): providing account registration, trade journaling, broker sync, subscriptions, and other core Services you request
• Legitimate interests (Art. 6(1)(f) GDPR): securing the Services, preventing fraud, improving product quality, sending service-related communications, attributing referred subscriptions to affiliate partners, and limited direct marketing where our interests are not overridden by your rights
• Consent (Art. 6(1)(a) GDPR): optional analytics cookies (Google Analytics), granted via the website cookie banner or by agreeing to our Privacy Policy when logging in to the app; push notifications where required; and certain marketing communications where consent is required
• Legal obligation (Art. 6(1)(c) GDPR): tax, accounting, and regulatory requirements

Withdrawing consent: Where we rely on consent, you may withdraw it at any time through the cookie banner or footer link on our website, notification settings, email unsubscribe links, or by contacting us. Withdrawal does not affect processing that was lawful before withdrawal.

If you are located in Canada, this section applies to you.

We may process your information with your consent or as permitted under applicable Canadian privacy law. You may withdraw consent subject to legal or contractual restrictions.

4. When and with whom do we share personal information?

In Short: We share personal information with service providers that process data on our behalf, and in limited other situations.

Service providers (subprocessors)

Provider	Purpose	Typical location
Microsoft Azure	Application hosting, database, file storage, queues, and backend services	EEA and/or other regions per our Azure configuration
Cloudflare	Static website hosting for our marketing site	Global
Google	Google Sign-In and Google Analytics (with consent)	US / EU
Apple	Sign in with Apple and App Store in-app purchases	US / EU
Stripe	Web subscription payments	US
Revshare	Affiliate program tracking and commission attribution	EEA (Denmark)
Klaviyo	Email delivery, subscriber profiles, and event-triggered messages	US
PostHog	Product analytics and error tracking	Per our PostHog configuration
Pushwoosh	Mobile push notifications	US
TradingView	Embedded chart widgets	US

We use written agreements requiring these providers to protect personal information and process it only on our instructions.

Other sharing situations

• Business transfers: in connection with a merger, acquisition, financing, or sale of assets
• Legal requirements: when required by law, court order, or to protect rights, safety, and security

International transfers

When personal information is transferred outside the EEA or UK, we rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, and processor data protection commitments.

5. Do we use cookies and other tracking technologies?

In Short: We use essential cookies and local storage to operate the Services, including affiliate attribution. We use Google Analytics only after you consent. We use PostHog for product analytics on the marketing website and web application.

Essential technologies include authentication cookies (such as RefreshToken), access tokens in local storage, preference storage for themes, filters, and UI settings, and first-party affiliate cookies used to credit referring partners.

We use PostHog to understand how the marketing website and web application are used. With your consent, we also use Google Analytics 4. We do not use advertising cookies or sell your personal information for cross-context behavioral advertising.

Details are in our Cookie Policy. You can manage analytics consent through the cookie banner or footer link on our website, or when logging in to the app.

6. How do we handle your social logins?

In Short: You can register or log in using Google or Apple.

If you choose social login, we receive information from the provider such as your name, email address, profile picture, and a provider-specific user ID. We use this information only to create and authenticate your account as described in this notice.

We do not receive your social media friends list. The provider’s use of your information is governed by its own privacy policy.

7. How long do we keep your information?

In Short: We keep personal information for as long as necessary to provide the Services and fulfill the purposes in this notice.

• Account data: kept while your account is active
• Authentication tokens: until logout, expiry, or account deletion
• Marketing profiles: we request deletion from Klaviyo when you delete your account
• Payment records: retained as required for tax, accounting, and legal obligations
• Backups: deleted data may remain in isolated backups for a limited period before being overwritten

When we no longer need personal information, we delete or anonymize it unless retention is required by law.

8. How do we keep your information safe?

We use technical and organizational measures designed to protect personal information, including encryption in transit, access controls, and secure cloud infrastructure. No method of transmission or storage is 100% secure.

9. Do we collect information from minors?

Our Services are not directed to children under 18. We do not knowingly collect personal information from children under 18. If you believe we have collected such information, contact us at support@tradereview.app.

10. What are your privacy rights?

In Short: You may have rights to access, correct, delete, restrict, port, or object to processing of your personal information, depending on your location.

EEA, UK, and Switzerland

• Right of access, rectification, erasure, restriction, and portability
• Right to object to processing based on legitimate interests
• Right to withdraw consent where processing is consent-based
• Right not to be subject to solely automated decision-making with legal or similarly significant effects (we do not use such decision-making)

You may lodge a complaint with your local supervisory authority. In Poland, the supervisory authority is the President of the Personal Data Protection Office (UODO). UK residents may contact the ICO.

Account information

• Update profile and notification settings in the app
• Export trades to CSV from the app
• Delete your account under Account settings; we will delete active account data and request deletion of related marketing profiles

Marketing communications

You can opt out using unsubscribe links in emails, notification settings in the app, or by emailing support@tradereview.app.

11. Controls for Do-Not-Track and Global Privacy Control

There is no uniform standard for Do-Not-Track signals. We do not respond to DNT browser signals.

If your browser sends a Global Privacy Control (GPC) opt-out signal, we treat it as a decline of non-essential analytics cookies in our web application.

12. Do United States residents have specific privacy rights?

In Short: Residents of certain US states may have additional rights regarding access, correction, deletion, and opt-out of certain processing.

Categories of personal information collected in the last 12 months

Category	Examples	Collected
A. Identifiers	Name, email, account ID, IP address, online identifiers	YES
B. California Customer Records	Name, contact information, employment or financial information beyond what we collect	NO
C. Protected classification characteristics	Gender, age, race, ethnicity, and similar data	NO
D. Commercial information	Subscription history, purchase records, payment status	YES
E. Biometric information	Fingerprints, voiceprints	NO
F. Internet or network activity	App usage, analytics events, interactions with the Services	YES
G. Geolocation data	Precise device location	NO
H. Sensory information	Images you upload to the Services	YES
I. Professional or employment information	Business contact details, job history	NO
J. Education information	Student records	NO
K. Inferences	Profiles drawn from collected information	NO
L. Sensitive personal information	Special category data under state law	NO

We do not sell personal information or share it for cross-context behavioral advertising.

Your rights may include access, correction, deletion, portability, and opt-out of certain processing. To exercise these rights, email support@tradereview.app. We will verify your request before responding.

13. Do we make updates to this notice?

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Last updated" date. Material changes may be communicated through the Services or by email where appropriate.

14. How can you contact us?

Email: support@tradereview.app

Postal address: Artsiom Yatskevich, Świętego Mikołaja 8/11/lok. 208, 50-125 Wrocław, Poland

15. How can you review, update, or delete the data we collect from you?

Depending on applicable law, you may request access to, correction of, or deletion of your personal information.

• Email us at support@tradereview.app with your request. We respond within the time required by applicable law (generally within 30 days for GDPR requests).
• Update your account in Account → Settings.
• Export trades using the CSV export feature in the app.
• Delete your account in Account settings. This permanently deletes your active account data from our systems and triggers deletion of related third-party marketing profiles where applicable.