Privacy policy
What we store, why we store it, and how to have it removed.
1 · Controller
TradingNavi. Email contact@tradingnavi.com. Full details in the Imprint.
2 · What we store, why, and on what basis
| Data | Why | Lawful basis | Kept |
|---|---|---|---|
| Email address, password hash | To create and secure your account | Art. 6(1)(b) — contract | Until you delete the account |
| Trading plans, levels, notes, journal, trade history | The core function: to store and display your own plans back to you | Art. 6(1)(b) — contract | Until you delete them or the account |
| Broker/market-data API keys, MT5 bridge token | To fetch prices and pass plans to your own terminal. Encrypted at rest. | Art. 6(1)(b) — contract | Until you remove them or delete the account |
| Session cookie | To keep you signed in. Strictly necessary; no consent needed. | Art. 6(1)(f) — legitimate interest | 30 days |
| Usage analytics — tab opens, click positions, scroll depth, dwell time, device class, country | To work out which parts of the product to improve | Art. 6(1)(a) — consent, asked before anything is recorded | 90 days, then deleted automatically |
| Server logs | Security and fault diagnosis | Art. 6(1)(f) — legitimate interest | Short-term, rotated |
What the analytics never contain
No tickers, prices, position sizes, stops, targets, P&L, notes or journal text. No keystrokes, no form values, no session recordings. Click positions are stored as a fraction of the window, never as a pixel address, and are labelled only if they land on a control from a fixed allow-list. No IP address is stored — country is resolved by the network edge and the address itself never reaches our database. Account identifiers are replaced with a keyed hash, so analytics cannot be traced back to a person.
Analytics are off until you accept the banner. If your browser sends Do Not Track or Global Privacy Control we treat that as a refusal and never ask. Withdrawing consent deletes what was already collected for that session. You can change your mind at any time on this page, below.
3 · Who else processes your data
| Processor | What for | What they see |
|---|---|---|
| Our hosting provider | Running the server and database | Everything stored, as infrastructure |
| Email delivery provider | Verification and password-reset emails | Your email address and the message |
| Yahoo Finance (market data) | Prices, news and calendar lookups | The ticker symbols requested — not your account or holdings |
| Your broker / MT5 terminal | Only if you connect the bridge yourself | The plans you explicitly submit |
| cdnjs, Google Fonts | Serving scripts and fonts to your browser | Your IP address, as any CDN does |
We do not sell data, and we do not share it with advertisers. There is no advertising on this service.
4 · Your rights
You have the right to access (Art. 15), rectification (16), erasure (17), restriction (18), data portability (20) and objection (21), and the right to withdraw consent at any time without affecting processing already carried out.
Two of these are buttons rather than requests: Settings → Export downloads everything we hold for your dashboard as JSON, and Settings → Delete account removes your account and all its data permanently. For anything else, email contact@tradingnavi.com.
You may also complain to a supervisory authority in your country of residence.
5 · Security
Passwords are stored using scrypt, never in plain text. Provider API keys are encrypted at rest. Traffic is served over HTTPS. Access to the production database is limited to the operator.
6 · Changes
If this policy changes materially we will say so in the app before the change takes effect.