Privacy Policy
Last updated: 2026-09-16
Controller
The operator of rawpnl, Romania. Contact for anything privacy-related: [email protected].
What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, password hash | Your account and login | Contract |
| Exchange API key and secret (encrypted) | Importing your fills from the exchange | Contract |
| Fills, trades, statistics derived from them | The product itself | Contract |
| Reviews you write (stop, setup, notes, tags) | The product itself | Contract |
| Subscription status and payment provider ids (no card data) | Knowing whether your subscription is active | Contract |
| IP address and email in login attempt counters (kept in memory, minutes) | Blocking brute-force logins | Legitimate interest (security) |
| Server logs (IP, path, timestamp; keys and secrets redacted) | Operating and securing the Service, kept up to 30 days | Legitimate interest (security) |
Who else sees it (processors)
- Hosting: Hetzner Online GmbH, Germany (EU). Application data and encrypted backups.
- Payments: Lemon Squeezy, LLC, United States, as merchant of record. They receive your email and billing details you enter at checkout, under their own privacy policy. Transfers rely on the EU-US Data Privacy Framework and standard contractual clauses.
- Exchanges: we call Bybit or Binance with your key to read your fills. Their handling of that request is governed by their terms.
We do not sell data, do not run advertising, and do not use analytics or tracking scripts.
Cookies
One cookie, tj_session, strictly necessary to keep you logged in. No consent banner is needed because there is nothing else.
Retention
Account data is kept while your account exists. When you delete your account, everything is removed immediately from the live database; encrypted backups are rotated out within 30 days. Payment records held by Lemon Squeezy are kept by them as required by tax law.
Your rights (GDPR)
Access and portability: export your data as JSON. Erasure: delete your account from the Account page. Rectification, restriction, objection, or a complaint: contact us; you can also complain to your local data protection authority (in Romania, ANSPDCP).
Security
Described in detail on the Security page: encryption of keys at rest, read-only enforcement, hashed passwords, signed sessions, HTTPS, hardened headers, encrypted backups.
Changes
We will post changes here with a new date and, for material changes, notify you in the app.