Privacy Policy
Last updated: August 2026
1. What we collect
Your account email, the trades and journal entries you log or sync, the chart screenshots you attach, your settings, and — if you provide them — a display name and profile photo. If you connect an exchange we also read and store your futures trade history and your account balance, because that is the data the analysis is performed on.
2. Exchange API keys — what actually happens to them
Requests to your exchange are signed in your browser, and your API key and secret are held in your browser’s local storage to do it. A copy is also stored on our servers, encrypted (AES-256), so that your connections follow you when you sign in on another device: only our server holds the decryption key, and it will only release a connection to the signed-in account that owns it. Pressing Remove on a connection deletes both copies. We ask for read-only access and nothing else — Postmortem cannot place, modify or close a trade, and cannot withdraw or transfer funds. If you would rather we held no copy at all, import a CSV instead of connecting a key.
3. How it’s stored
Everything is stored in Supabase (Postgres and Storage) and scoped to your account by row-level security, so no other customer can read or write your rows. Chart screenshots live in a private bucket and are served through short-lived signed links. Profile photos are stored under a path derived from your account id in a bucket that is readable by URL — do not upload a photo you would not want a link to. Traffic is encrypted in transit.
4. Who else touches it
Supabase (database, auth and file storage), Vercel (hosting and anonymous traffic analytics), and PayMongo (payments — they receive what a checkout needs, never your trade data). Connecting an exchange means requests go to that exchange. We don’t sell your data, we don’t place trades on your behalf, and we don’t share your trading history with anyone for advertising. Aggregate, anonymised usage informs product decisions.
5. How long we keep it
Trade history is a rolling window by plan — Free keeps 30 days, Basic 6 months, Pro keeps everything — and trades older than your window are permanently deleted, not archived. The window is widened to 90 days until your account has enough history for a first diagnosis. Everything else is kept until you delete it or close your account.
6. Your controls
You can edit or delete any journal entry, trade, chart or profile field in the app at any time. To close your account and have everything erased — rows, files and your login — email support@postmortem-tradingjournal.com from your account address and we will action it within 30 days and confirm when it is done. There is no soft-delete; deletion is permanent.
7. Contact & changes
Privacy questions, data requests and deletion requests: support@postmortem-tradingjournal.com. This policy may be updated as the product evolves; material changes will be announced in-app and the date above will change.