Privacy Policy
Last updated: 2026-10-25
Controller
The operator of rawpnl, Romania. Contact for anything privacy-related: [email protected].
What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, password hash | Your account and login | Contract |
| Exchange API key and secret (encrypted) | Importing your fills from the exchange | Contract |
| Fills, trades, statistics derived from them | The product itself | Contract |
| Reviews you write (stop, setup, notes, tags) | The product itself | Contract |
| Subscription status and payment provider ids (no card data) | Knowing whether your subscription is active | Contract |
| IP address and email in login attempt counters (kept in memory, minutes) | Blocking brute-force logins | Legitimate interest (security) |
| Server logs (IP, path, timestamp; keys and secrets redacted) | Operating and securing the Service, kept up to 30 days | Legitimate interest (security) |
| Visit counts: the page, the day, and a visitor code that changes every day (a keyed hash of IP and browser; the IP itself is not stored, no cookie is set) | Knowing how many people visit and sign up | Legitimate interest (running the Service) |
Who else sees it (processors)
- Hosting: Hetzner Online GmbH, Germany (EU). Application data and encrypted backups.
- Payments: Lemon Squeezy, LLC, United States, as merchant of record. They receive your email and billing details you enter at checkout, under their own privacy policy. Transfers rely on the EU-US Data Privacy Framework and standard contractual clauses.
- Exchanges: we call your exchange (Bybit, Binance, OKX, Kraken, KuCoin, MEXC; Hyperliquid by public address) with your key to read your fills. Their handling of that request is governed by their terms.
We do not sell data, do not run advertising, and do not use third-party analytics or tracking scripts.
With the visit counts above we also record the referring website's domain (not the full address) and the campaign tags (utm_*) of the link you used to arrive, under the same model: no cookie, no IP stored, a visitor code that changes daily. If you sign up that same day, that source is noted in your account's activity log.
Cookies
One cookie, tj_session, strictly necessary to keep you logged in. No consent banner is needed because there is nothing else.
Retention
Account data is kept while your account exists. When you delete your account, everything is removed immediately from the live database; encrypted backups are rotated out within 30 days. Payment records held by Lemon Squeezy are kept by them as required by tax law.
Your rights (GDPR)
Access and portability: export your data as JSON. Erasure: delete your account from the Account page. Rectification, restriction, objection, or a complaint: contact us; you can also complain to your local data protection authority (in Romania, ANSPDCP).
Security
Described in detail on the Security page: encryption of keys at rest, read-only enforcement, hashed passwords, signed sessions, HTTPS, hardened headers, encrypted backups.
Changes
We will post changes here with a new date and, for material changes, notify you in the app.