Privacy Policy

1. Who is responsible for your data

For details on who operates CoTrader 3000 and where your data is held, see the contact information at the end of this policy.

For privacy questions, contact us at thinker@philoinvestor.com.

2. What data we collect

We collect and process the following categories of data:

• Account data: email address, hashed password.
• Trading data from IBKR: trade executions, positions, account ID, base currency — imported via Interactive Brokers' Flex Query service using credentials you provide.
• Content you create: trade plans, journal notes, insights, weekly reviews.
• Billing data: handled entirely by Stripe. We receive a Stripe customer ID and subscription status; we do not see or store your card details.
• Technical data: IP address, browser type, session cookie, error logs. Collected automatically for security and service operation.

3. Why we use your data

We use your data to:

• Provide the Service (import trades, display analytics, save your notes)
• Authenticate you and keep your account secure
• Process payments and manage your subscription
• Diagnose and fix errors (via our error tracker, Sentry)
• Communicate with you about the Service (support, service updates)
• Comply with legal obligations

4. Legal basis (GDPR)

We process your data on the following legal bases:

• Contract: processing is necessary to provide the Service you signed up for.
• Legitimate interest: security, fraud prevention, and error diagnostics.
• Legal obligation: compliance with tax, accounting, and regulatory requirements.
• Consent: where specifically requested (e.g. optional marketing communications — currently none).

5. Who we share data with

We share your data only with the service providers (subprocessors) required to operate CoTrader 3000. Each has been vetted for GDPR compliance.

We do not sell your data to anyone. We do not share it with advertisers or marketing networks.

6. International data transfers

Some of our subprocessors (e.g. Vercel, Stripe) store data in the United States. Where applicable, we rely on Standard Contractual Clauses approved by the European Commission to ensure adequate protection.

7. How long we keep your data

• Active account: we keep your data for as long as your account is active.
• After deletion: when you delete your account, we remove all user-owned records (trades, plans, notes, credentials, subscription) immediately. Identifying metadata retained for churn analysis (email, Stripe customer ID) is stripped after 90 days. Anonymous feedback from the deletion form may be retained indefinitely in aggregate form.
• Billing records: retained for up to 7 years as required by tax and accounting law.
• Error logs (Sentry): retained for up to 90 days.

8. Your rights under GDPR

As an EU/EEA resident (or one covered by similar laws), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data ("right to erasure") — available in-app via Settings
• Restrict or object to our processing
• Receive your data in a portable format
• Withdraw consent at any time (where processing is based on consent)
• Lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus

To exercise any of these rights, email us at thinker@philoinvestor.com. We respond within 30 days.

Note on raw broker executions: the trade data we receive from Interactive Brokers is a cached copy of records IBKR holds about you. We will include this cached copy in any data-access request, but for the authoritative version of your trade history we recommend pulling statements directly from your IBKR account — IBKR is the original record-keeper.

9. Cookies

CoTrader 3000 uses a small number of cookies and browser storage items:

• Authentication (Supabase): strictly necessary — keeps you logged in. Cannot be disabled.
• Error tracking (Sentry): session identifiers used to correlate crashes. No cross-site tracking.
• UI preferences (localStorage): tiny settings like "TradeSquares collapsed/expanded." Local to your browser.

We do not use analytics, advertising, marketing, or cross-site tracking cookies. Because we only use strictly necessary and operational cookies, we do not currently display a consent banner. Your browser settings allow you to delete cookies at any time.

10. Security

We use encryption in transit (HTTPS), at rest (provider-managed encryption), and industry-standard authentication. Access to production data is restricted to authorised personnel. We cannot guarantee absolute security — no online service can — but we take reasonable steps to protect your information.

11. Children

CoTrader 3000 is not intended for users under 18. We do not knowingly collect data from minors. If you believe we have, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced via email or in-app notification. The "last updated" date at the top of this page reflects the most recent revision.

13. Contact

Privacy questions: thinker@philoinvestor.com