Privacy Policy

Traderbase currently processes account identity and security records; versioned policy choices; launch-interest email addresses and consent history; Stripe customer and subscription identifiers; saved product content such as chats, charts, watchlists, screeners, journal entries, notes, and agents; uploaded files; transactional email state; and operational security records.

Some requested features send selected prompts, context, files, or market information to generated-content, hosting, email, payment, authentication, and market-data providers. The exact production vendor configuration, residency, and retention must be verified before this draft is approved.

Proposed purposes include providing and securing accounts; delivering requested workspace functions; processing subscriptions; sending essential account, security, billing, and privacy messages; preventing abuse; responding to support and privacy requests; and meeting approved legal obligations.

Optional public-page analytics and performance telemetry are blocked until a visitor grants analytics consent. Optional marketing technology is not currently installed. The launch-interest form separately asks for affirmative consent to send launch news, product updates, and occasional promotional offers.

The repository integrates or anticipates Vercel hosting and telemetry, Postgres, Redis, Stripe, Resend, Google authentication, generated-content services, Vercel Blob, and multiple market/content sources. A final policy must list approved subprocessors and explain the data each receives.

A final policy must also define legally required disclosures, transaction disclosures, security-incident handling, business-transfer handling, and jurisdiction-specific sale, sharing, targeted-advertising, or profiling disclosures. This draft does not make a verified no-sale or no-sharing representation.

Necessary browser storage supports authentication, security, app state, and saved privacy choices. The consent record is versioned in local browser storage. Vercel Analytics and Speed Insights cannot mount before analytics consent, and the integration removes query strings, collapses content slugs, and excludes auth, account, support, admin, API, referral, ticker, screener, and workspace routes.

Custom analytics are limited to two categorical public-marketing interactions: a marketing call-to-action location and an educational-article location. Traderbase does not identify signed-in users to Vercel Analytics and does not send email, account/session IDs, symbols, prompts, trade/journal/support content, billing IDs, search text, URLs, or other free text as custom properties.

Global Privacy Control is treated conservatively by keeping optional analytics and marketing off while the signal is active. The Cookie and Telemetry Policy describes the current implementation and unresolved configuration decisions.

Traderbase implements access checks, session controls, redaction, encrypted transactional-email payloads, rate limits, and account export and deletion-request workflows. These controls reduce risk but cannot guarantee absolute security.

Retention periods, legal holds, backup expiry, provider deletion, final account erasure, billing-record obligations, and cached market-data retention are unresolved. Account deletion is therefore a restricted cooling-off workflow, not a claim of immediate complete erasure.

Users can manage local telemetry preferences, withdraw optional marketing email consent, export supported account data, and request account deletion through available account settings. Launch-interest subscribers can withdraw through the unsubscribe link provided in promotional email or submit a privacy request. Depending on approved jurisdictions, additional access, correction, portability, restriction, objection, appeal, or opt-out rights may apply.

A private privacy-request form is available and creates a tracked support record, but the final response time, identity-verification steps, authorized-agent process, appeals, and exceptions are not approved. Do not include identity documents or sensitive evidence in the initial form.

Minimum age, prohibited geographies, international transfer mechanisms, and jurisdiction-specific notices remain blocked for attorney and owner decisions.

A final change process must distinguish editorial updates from material changes and define notice and re-consent thresholds. A new local telemetry-consent version fails closed and requests a fresh choice.