Security

Plain description of what we do with your exchange keys and your data. If anything here is unclear, ask: [email protected].

Exchange keys

Read-only, enforced. When you connect, we ask the exchange what the key is allowed to do. A key with trading or withdrawal permission is refused and not stored. On Binance, futures keys cannot be made read-only, so we require withdrawals and spot trading to be off and recommend IP restriction.
Encrypted at rest with a server-side key (Fernet, AES-128-CBC + HMAC) that lives only in the server's environment, never in the database or in backups of the database.
Displayed as the last 4 characters only. The full key is decrypted in memory for the duration of a sync and nowhere else. Raw exchange payloads are redacted before being stored.
Deleting a connection deletes the key and every fill and trade imported through it.

Encrypted at rest: exchange keys, and everything you write yourself — notes, setup labels, tags. Each field is sealed with a key derived from the server's secret, so a copy of the database file or of a backup is unreadable without it.
Not encrypted at the field level: the trades themselves (symbol, prices, size, times, PnL). The server has to read them to compute your statistics; encrypting them with a key the server holds anyway would add nothing but cost. They sit on an encrypted disk, on a server only the operator can reach.
Not end-to-end. The server can read your notes while it renders your journal. If you need a journal that even we cannot read, this is not it — we would rather say so than pretend.
Nothing leaves the server: no third-party analytics, no AI provider, no email content beyond the account mails listed in the privacy policy.

Passwords are hashed with bcrypt. Login attempts are rate-limited per address and account.
Sessions are signed cookies (SameSite=Lax, Secure, HttpOnly) that expire 30 days after login at the latest. "Log out" revokes that session on the server; "Log out everywhere" invalidates them all instantly.
Cross-site request forgery is blocked at the middleware level; responses carry a strict Content-Security-Policy, HSTS and the usual hardening headers.

Hosted in the European Union (Hetzner, Germany). HTTPS only. Nightly backups, encrypted before they leave the server; the encryption key is not part of them.
Payments are processed by Lemon Squeezy. We never see or store card numbers.
No third-party analytics, tracking scripts or CDNs: every script is served from this domain.

Export all your data as JSON, or delete your account and everything with it, from the Account page. No email needed, no waiting.

Write to [email protected]. We answer, we fix, we credit you if you want.