Privacy Policy

Sharplog ("we", "us") takes your privacy seriously. This policy explains what we collect, why, and your rights — written in plain English.

1. What we collect

• Account info: email, name (optional), hashed password.
• Trade data: everything you log — date, instrument, RR, PNL, notes, screenshots you upload.
• Billing data: handled by Stripe. We store your Stripe customer ID and subscription status; we never see or store your full card number.
• Operational data: standard server logs (IP, user-agent, timestamps) for security and debugging. We do not run third-party analytics or trackers.

2. What we do NOT do

• We do not sell your data.
• We do not share your trade data with advertisers or brokers.
• We do not use your trade data to train AI/ML models.
• We do not allow other users (including mentors) to access your data without your action — mentor/student linking is opt-in.

3. Who else processes your data

• Supabase — stores the database and screenshot uploads (EU region).
• Vercel — hosts the application.
• Stripe — handles payments.
• Resend — sends transactional email (welcome, receipts, password reset). We do not send marketing email.

Each of these processes data on our behalf under their own privacy and security terms.

4. Cookies

We use a single, essential session cookie (td_session) so you stay logged in. We do not use any tracking, advertising or analytics cookies.

5. Your rights

Under GDPR and similar regulations, you can:

• Export your trade data (CSV, on request)
• Delete your account and all data within 30 days
• Request a copy of what we store about you
• Correct inaccurate information

Contact support@usesharplog.com and we will respond within 30 days.

6. Data retention

We keep your data as long as your account is active. After account deletion we remove personal data within 30 days. Some billing records may be kept longer where required by tax law.

7. Security

Passwords are hashed with scrypt + per-user salt. Session tokens are HMAC-signed. Connections use HTTPS. We host on infrastructure with strong baseline security (Vercel, Supabase). No system is 100% secure — we do our best.

8. Children

Sharplog is not directed at children under 18 and we do not knowingly collect data from them.

9. Changes

Material changes will be announced via email or in-app at least 14 days before they take effect.

10. Contact

Privacy questions: support@usesharplog.com. Sharplog is operated from Norway.