Privacy Policy

1. Introduction

Tradeor is a verified social trading journal, social trading network, and performance transparency platform for traders ("Tradeor", "we", "us", or "our").

This Privacy Policy explains how Tradeor collects, uses, stores, shares, and protects information when you use the Tradeor mobile application, the Tradeor website at https://tradeor.app/, and related services (together, the "Service").

This Privacy Policy is one of the three documents you are asked to acknowledge when you create a Tradeor account. Acknowledging it is not the same as consenting to every kind of processing: most of what we do with your data rests on the contract between us or on our legitimate interests, as Section 6 sets out, and only the processing identified there as consent-based depends on your consent.

2. Who Operates Tradeor (Data Controller)

Tradeor is currently operated from Israel by an individual operator and is not currently operated through a separate registered legal company. For the purposes of data protection laws such as the EU and UK GDPR, the operator of Tradeor is the controller of personal data processed through the Service.

For privacy questions and requests to exercise your rights, contact: privacy@tradeor.app. For support requests or account deletion, contact support@tradeor.app.

3. Minimum Age

Tradeor is intended only for users who are at least 18 years old. When you create an account you are asked to confirm that you are 18 or older, and that confirmation is recorded (see Section 4.11). We do not knowingly collect personal data from anyone under 18; if we learn that we have, we will delete it and may terminate the related account.

4. Information We Collect

We collect information that is necessary to provide, secure, improve, and operate Tradeor.

4.1 Account Information

When you create an account, we may collect:

• Email address (required to create and use an account)
• Username
• Profile photo, if you upload one
• Display name and bio, if you provide them
• Authentication provider information (Apple, Google, or email login)
• Account settings and preferences
• Privacy settings, including whether your profile is public or private
• Subscription plan and plan history

4.2 Authentication Information

Tradeor supports account access through email and password, Apple login, and Google login. When you use Apple or Google login, we may receive limited account information from the authentication provider, such as your email address and an authentication identifier, depending on the permissions and settings used by that provider. Passwords are handled by our authentication provider and are never stored by Tradeor in plain text.

4.3 Phone Number and Verification Data

If you use phone verification, we collect your phone number and verification status. One-time verification codes are short-lived. Verification messages are delivered through a third-party messaging provider, which processes your phone number as necessary to deliver the message under its own terms and privacy policy.

4.4 Broker Connection Information

When you connect a supported broker or trading platform, we collect what is required to read and sync your trading activity: the broker name, account identifiers, the credential you supply, server or platform details where required, connection status, sync history, and technical logs about the connection.

The credential you supply depends on the broker. Some brokers issue a credential that can be restricted to reading data — an API key whose permissions you set, or a separate read-only password — and where one exists, the connection screen tells you to use it. Other brokers issue only your ordinary account login, which on the broker's side may also permit trading; where that is the case the connection screen says so before you enter anything. In every case Tradeor uses the credential only to read data. Tradeor does not execute trades, does not place, change, or cancel orders, does not move or withdraw funds, and contains no capability to do any of those things.

Credentials and tokens are encrypted at rest with per-record keys. For one broker family the credential is used only to open a session and is then discarded rather than stored. Decrypted credentials are held in memory only for the duration of a sync and are transmitted over encrypted connections to the components that perform it, some of which run on infrastructure separate from the main application.

4.5 Trading Activity Data

When you connect a broker, Tradeor may collect and process real trading activity data, including: symbols and instruments traded, entry and exit times, entry and exit prices, position size, trade direction, profit and loss, fees and other cost data where available, leverage where available, account type where available (live, demo, paper, or simulation), trade duration, journal notes, tags and ratings you add, and derived trading statistics and performance metrics.

Where you connect several of your own accounts that execute substantially similar trades, we process this data to group those executions and display them as a single trade with an account count. This grouping happens after the fact, across your own accounts only, and is a display feature; it never places or routes an order.

4.6 Subscription and Purchase Data

If you purchase a subscription, the purchase is processed by the store or payment provider for the channel you bought in — Apple for in-app purchases on iOS, Google for Google Play, and Whop Inc., which processes payment for purchases made on the Tradeor website — together with the subscription-management provider we use to reconcile entitlements. We receive information such as your subscription tier, product or plan identifier, purchase and renewal status, and platform transaction identifiers. We do not receive or store your full payment card details.

4.7 Trade Posts, Media, and Social Data

Tradeor may collect information related to your public and social activity, including: verified trade posts, text descriptions added to trades, media added to trades or messages, likes, comments, followers and following relationships, group memberships and roles, private messages between users, profile information, public trading statistics, and reports, blocks, and moderation actions.

4.8 Notifications and Push Tokens

If you enable push notifications, we collect and store a device push token so that we can send you account updates, social activity alerts, trade-related updates, security alerts, and other relevant notifications. You can control notification permissions through your device settings and, where available, through Tradeor notification settings.

4.9 Device, Usage, and Technical Data

We may collect technical and usage information, including: device type, operating system, app version, browser type when using the website, IP address, log data, performance data, feature usage, security events, and error reports.

Tradeor does not intentionally collect precise location data. We may process general technical information such as IP address as part of normal security, hosting, logging, and fraud-prevention operations. Tradeor does not operate any third-party analytics, product-analytics, session-recording, or crash-reporting service, and no such service receives data from the Tradeor website or app.

4.10 Support Communications

If you contact us, we collect the contents of your message, your contact details, and related account information needed to respond.

4.11 Legal Acceptance Records

When you accept our Terms of Use, acknowledge this Privacy Policy, and agree to the Refund & Cancellation Policy, we record evidence of that acceptance: your account identifier, which documents were accepted, the exact version and content hash of each, the date and time in UTC, the surface and the action you used, the exact acceptance sentence displayed to you, your confirmation that you are 18 or older, the app platform and version, your browser or app user agent, and a keyed one-way hash of the network address the acceptance arrived from. We store a keyed hash rather than the address itself, so the record corroborates the acceptance without retaining an identifier we do not need.

We process this on the basis of our legitimate interest in being able to prove what you agreed to and when, and to comply with legal obligations. Because the record is evidence of an agreement, it is retained after an account is deleted; at that point it is unlinked from the deleted account and only the keyed hash of the account identifier remains (see Section 14).

5. How We Use Information

We use information to:

• Create and manage user accounts and authenticate users
• Connect supported brokers and sync real trading activity
• Generate verified trade posts, journals, dashboards, and statistics
• Group related executions across a user's own connected accounts
• Provide and manage subscriptions and plan-gated features
• Enable likes, comments, follows, groups, private messages, reports, and blocks
• Deliver push notifications you have enabled
• Verify phone numbers where offered
• Provide customer support
• Maintain security; detect abuse, spam, fraud, manipulation, or unauthorized activity
• Operate content moderation, including reviewing reports and recording moderation decisions
• Record and evidence your acceptance of our legal documents
• Fix bugs, improve performance, and develop new features
• Enforce our Terms of Use
• Comply with legal obligations

6. Legal Bases for Processing

Where laws such as the EU or UK GDPR apply, we process personal data on these legal bases:

• Performance of a contract: providing the Service you signed up for, including accounts, broker syncing, posts, subscriptions, and support.
• Legitimate interests: securing and improving the Service, preventing fraud and abuse, moderating content, evidencing acceptance of our legal documents, and defending legal claims — balanced against your rights and interests.
• Consent: where required, for example push notifications you enable at the device prompt and phone verification you choose to complete; you may withdraw consent at any time, including through your device settings.
• Legal obligation: where processing is necessary to comply with applicable law.

Acknowledging this Privacy Policy is not itself the legal basis for the processing described in it.

7. How We Share Information

We do not sell your personal data. We share it only with the following categories of recipient, and only as far as each needs it:

• Infrastructure and platform providers that host the Service and run it for us: cloud hosting and application hosting, the managed database, authentication and file storage, background job and caching services, mobile application build and delivery infrastructure, push-notification delivery, and transactional email. These act as our processors under contract.
• Payment and subscription providers: the store or payment provider for the channel you purchased in, and the subscription-management provider that reconciles entitlements. Apple, Google, and Whop Inc. are named here because you deal with them directly when you pay. For App Store and Google Play purchases the terms of the purchase are Apple's or Google's. For purchases on the Tradeor website, Tradeor is the supplier and our terms apply; Whop processes the payment and handles that payment relationship under its own terms, and we and Whop each act as an independent controller of the personal data we hold about the transaction.
• A messaging provider used only to deliver phone-verification messages, where you use that feature.
• The brokers and trading platforms you choose to connect, which receive the credential you supplied in order to return your trading data at your request.
• Other users, according to your privacy settings and the public nature of content you publish (see Section 8).
• For legal reasons, where reasonably necessary to comply with law, regulation, legal process, or an enforceable governmental request, or to protect the rights, property, or safety of Tradeor, our users, or the public.
• In a business transfer: if the Service is transferred to or reorganized into a company, or in connection with a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to this Privacy Policy.
• In aggregated or anonymized form that cannot reasonably identify you.

We keep an internal register of the specific providers in each category, the data each receives, and where each processes it. If you want to know which provider sits in a category that matters to you — for example because you are exercising a right, or assessing an international transfer — email privacy@tradeor.app and we will tell you. We do not publish the register itself, because a public map of our infrastructure is a security exposure and is not something any law requires us to publish.

8. Public Information

Tradeor is built around verified trading transparency. Information you choose to share publicly may be visible to other users and, where applicable, to visitors. Public information may include your username, profile photo, public profile information, verified trade posts, text or media added to trade posts, trading statistics, likes and comments, and follower and following activity where shown.

You are responsible for the information you choose to publish. Do not share information that you consider private, confidential, personal, sensitive, or commercially important.

9. Private Messages

Private messages are not public, but they may be processed, stored, or reviewed when necessary for technical operation, safety, abuse prevention, legal compliance, user reports, or enforcement of our Terms of Use.

10. Reports, Blocking, and Moderation

You can report a profile, a trade post, an insight, a comment, or a conversation. A report records who reported what, the reason chosen, any details added, and the time. Reports are visible only to Tradeor administrators.

We may use reports, blocks, the reported content, account activity, and technical data to investigate abuse, enforce rules, protect users, and maintain the integrity of the platform. Where we act on a report, we record the decision, the reason, the acting administrator, and the time. Content removed by moderation is hidden from the Service rather than immediately erased, and moderation records may be retained after the related content or account is deleted, where that is needed for safety, for review of the decision, or for legal purposes.

11. Broker Data and Broker Credentials

Section 4.4 describes what a broker connection involves and how the credential is handled. In short: Tradeor reads trading data and does nothing else with the connection; where your broker offers a credential that can be restricted to reading, you should use it, and the connection screen tells you which one; where your broker does not offer one, the connection screen tells you that before you enter anything.

You should never provide a credential with permissions that allow withdrawals or transfers, and you should never enable a permission a connection screen has not asked for. Although we use reasonable technical and organizational measures to protect broker connection information, no system can be guaranteed to be fully secure.

12. Cookies and Similar Technologies

The Tradeor website uses strictly necessary cookies and similar technologies (such as local storage) to keep you signed in, maintain your session securely, and remember essential preferences. We do not use advertising cookies, analytics cookies, or any third-party tracking technology. The mobile app uses secure on-device storage for session data and local storage for non-sensitive preferences and caches. You can control cookies through your browser settings; disabling essential cookies may prevent parts of the website from working.

13. Subscriptions, Payments, and Advertising

Tradeor offers optional paid subscriptions. Payments are processed by the store or merchant of record for the channel you purchased in, as described in Section 4.6 and in the Refund & Cancellation Policy. Tradeor does not display third-party advertisements and does not use your personal data for third-party targeted advertising or for cross-context behavioural advertising. If that ever changes, this Privacy Policy will be updated and the change presented to you before it takes effect.

14. Data Retention

We keep information for as long as it is needed for the purpose it was collected for, and then for as long as we are required or reasonably need to keep it. In practice:

• Account, profile, and settings data is kept while your account exists, and is deleted when you delete your account.
• Trading data, trade posts, journal entries, comments, insights, and uploaded media are kept while your account exists or until you delete them, and are deleted when you delete your account.
• Private messages are kept while the conversation exists; deleting your account removes your side of it.
• Broker connections and credentials are kept while the connection exists and are deleted when you disconnect the broker or delete your account.
• Phone-verification codes are short-lived and expire within minutes.
• Operational and security logs held by our hosting and database providers are retained for limited periods set by those services, typically days to a small number of weeks, and are not kept by Tradeor beyond that.
• Encrypted database backups are retained by our database provider on a rolling window measured in days, so data you delete may persist in a backup for a short period before ageing out.
• Moderation records — the report, the decision, the reason, and the hidden content — are retained after the related content or account is removed, so a decision can be reviewed and repeated behaviour recognised.
• Legal acceptance records (Section 4.11) are retained after account deletion as evidence of the agreement, unlinked from the deleted account.

We do not currently run an automated deletion schedule that removes inactive-account data before you ask us to. We do not keep data indefinitely as a matter of policy: if you delete your account, the categories above marked as deleted are deleted, and if you ask us to delete something we hold that is not covered by a retention reason above, we will delete it.

15. Account Deletion

You may delete your account at any time from Account settings in the app or on the website, or by contacting us at support@tradeor.app.

When your account is deleted we delete your profile and account settings, your trading data and prop-firm records, your trade posts, insights, comments, and likes, your side of private messages, your group memberships, your broker connections and their stored credentials, your push tokens, and the avatar and post media you uploaded to our storage. Records that must survive are limited to those described in Section 14 — moderation records, legal acceptance evidence unlinked from your account, and anything we are legally required to keep — together with encrypted backups until they age out.

Deleting your account does not cancel a subscription bought through Apple, Google, or on the website. Cancel it in the relevant place first; the Refund & Cancellation Policy explains how.

16. Your Rights

Depending on your location, you may have rights regarding your personal information, including the right to: access your personal information; correct inaccurate information; delete your information; object to certain processing; restrict certain processing; withdraw consent where processing is based on consent; and request a copy of your data in a portable format.

To exercise these rights, email privacy@tradeor.app from the address on your account, or contact us from within the app. We may need to verify your identity before acting on a request. We will respond within the time required by applicable law, and within one month where the GDPR applies. Deleting your account from Account settings is the fastest way to exercise the right to erasure and does not require you to contact us.

17. Users in the EEA and United Kingdom

If you are in the European Economic Area or the United Kingdom, the EU GDPR or UK GDPR applies to our processing of your personal data. In addition to the rights in Section 16, you have the right to lodge a complaint with your local data protection supervisory authority. Where we transfer personal data outside the EEA or UK, we rely on appropriate safeguards recognized under applicable law, such as adequacy decisions or standard contractual clauses implemented by us or our service providers. Israel, where Tradeor is operated, is the subject of a European Commission adequacy decision.

18. Users in California and Other US States

If you are a resident of California or another US state with a comprehensive privacy law, you may have rights to know, access, correct, delete, and port your personal information, and to opt out of the "sale" or "sharing" of personal information. Tradeor does not sell your personal information and does not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes other than those permitted by law. We will not discriminate against you for exercising your privacy rights. You may submit requests via privacy@tradeor.app, including through an authorized agent.

19. Users in Israel

If you are in Israel, our processing is also subject to the Israeli Protection of Privacy Law, 5741-1981. You have rights to review information held about you in our databases and to request correction or deletion of inaccurate information, exercisable via privacy@tradeor.app.

20. International Data Transfers

Tradeor is operated from Israel and is intended for users worldwide. Your information is processed and stored outside your country of residence. Our primary database and file storage are hosted in the Asia-Pacific region; application hosting, background processing, and supporting services run in the Asia-Pacific, European, and United States regions of the providers described in Section 7; and the brokers you choose to connect process your request wherever they operate. These countries may have privacy laws that differ from those in your jurisdiction. Where required, we rely on the safeguards described in Section 17. If you want to know the specific location for a specific category of data, email privacy@tradeor.app.

21. Security

We use reasonable technical and organizational measures to protect user information, broker connection information, trading data, and account data — including encryption in transit, encrypted storage of broker credentials with per-record keys, access controls, and database-level row access rules that restrict what each account can read.

However, no method of transmission, storage, or processing is completely secure. You are responsible for keeping your account credentials secure and for the broker credential you choose to supply. If we become aware of a personal data breach that we are legally required to report, we will notify the relevant authorities and affected users as required by applicable law.

22. Do Not Track

The website does not respond to browser "Do Not Track" signals, because we do not track users across third-party websites and run no third-party tracking technology at all. Where legally required, we honor recognized opt-out preference signals for applicable rights.

23. Children

The Service is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact privacy@tradeor.app and we will delete it.

24. Financial and Trading Disclaimer

Tradeor is not a broker, exchange, financial advisor, investment advisor, trading platform, portfolio manager, or fund manager. Tradeor does not execute trades, hold user funds, provide personalized investment advice, or guarantee financial results.

Any trading data, statistics, trade posts, community content, market opinions, or user-generated content shown in Tradeor is provided for informational, journaling, transparency, and social purposes only. Past performance does not guarantee future results. Trading involves risk, including the possible loss of capital.

25. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Each version is published with an effective date and a content hash at tradeor.app/legal/versions. If we make a material change, we will present the updated version and ask you to acknowledge it before you continue using the Service. For a non-material change we will update the effective date and take reasonable steps to notify users.

26. Contact Us

For questions about this Privacy Policy or your privacy rights, contact us at: privacy@tradeor.app. For support or account deletion, contact support@tradeor.app.