Legal

Privacy Policy

Last updated: 3 May 2026Effective: 3 May 2026

Who we are
Data we collect
How we use your data
Legal bases (GDPR)
Who we share with
Payments & financial data
International transfers
Data retention
Your rights
Security
Children
Changes to this policy
Contact us

TradeForge respects your privacy. This policy explains, in plain English, what personal data we collect when you use TradeForge, why we collect it, who we share it with, and the rights you have over it. By using TradeForge you agree to this policy. If you don't agree, please don't use the service.

1. Who we are

"TradeForge," "we," "us," and "our" refer to TradeForge — a trading journal product operated in partnership with Tundu Trades. The methodology that underpins our flagship 1st Presented FVG education track is licensed from Tundu Trades; TradeForge itself is the data controller for any personal data you submit through the platform.

For privacy questions, write to privacy@tradeforge.app.

2. Data we collect

Data you give us directly

Account data — email, display name, password (hashed; we never see the plaintext), country, timezone, optional profile picture.
Journal & trade data — every entry you write into the 5-timeframe journal: weekly bias notes, daily levels, M15 confluence checks, Mx entries, screenshots, tags, R:R, lot size, P/L, post-trade reflections.
Playbook data — setups you save, screenshots you upload, the patterns you tag your trades to.
Settings & preferences — theme, default account currency, instrument preferences, gate-rule toggles.
Education progress — which modules you've completed inside the Education Centre.
Communications — the content of any support email, contact form or in-product feedback you send us.

Data collected automatically

Device & technical data — IP address, browser type and version, operating system, device type, screen size, language, referrer URL.
Usage data — pages viewed, features used, buttons clicked, errors encountered, session duration. Used to fix bugs and prioritise features — never sold.
Cookies & similar technologies — see our Cookie Policy for the full list.

Data we do not collect

We do not read or store your broker password or API keys. TradeForge never connects directly to your broker. CSV import requires you to upload an export — we read that file once and discard the original.
We do not store full payment-card numbers. Card data is collected by our payment processors (Stripe, Paystack, Flutterwave, Safaricom M-Pesa) and never touches our servers.
We do not sell your data to advertisers, brokers, signal providers, or anyone else. Ever.

3. How we use your data

Provide the service — store your journal entries, render your analytics dashboard, deliver education modules, run the calculators, gate locked features behind your subscription tier.
Account & billing — authenticate you, process subscription payments, send invoices and renewal reminders.
Customer support — respond to your tickets, debug issues, recover account access.
Service emails — security alerts, billing receipts, plan changes, important policy updates. You cannot opt out of these while you have an account.
Marketing emails — product updates, new model launches, education drops. Opt-in only, and you can unsubscribe from every marketing email with a single click.
Improve TradeForge — aggregate, anonymised analytics on which features are used and where users get stuck.
Prevent fraud & abuse — detect chargeback fraud, account takeover attempts, automated scraping.
Legal compliance — satisfy obligations under tax, accounting and consumer-protection laws in the jurisdictions we serve.

4. Legal bases for processing (GDPR / UK GDPR)

If you live in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases:

Contract — to provide the journal, analytics and education you've subscribed to.
Legitimate interests — to keep TradeForge secure, debug bugs, and improve the product. We balance these interests against your privacy and you can object at any time.
Consent — for marketing emails and non-essential cookies. You can withdraw consent at any time.
Legal obligation — to retain certain billing records under tax law.

We share personal data only with the categories of recipients listed below, and only the minimum needed for them to do their job.

Hosting & infrastructure — Vercel (application hosting), Supabase (database, authentication, file storage). They process data on our behalf under contracts that bind them to this policy.
Payment processors — Stripe (USD/GBP/AED/AUD), Paystack (NGN/GHS/ZAR), Flutterwave (NGN/GHS/KES/ZAR), Safaricom M-Pesa (KES). They receive only what's needed to charge you and confirm the payment.
Email delivery — our transactional email provider, used for receipts, password resets and trial reminders.
Analytics & error reporting — privacy-respecting analytics for aggregate usage data and error monitoring for crash reports. We do not run third-party advertising trackers.
Professional advisors — lawyers, accountants and auditors, when bound by confidentiality.
Authorities — when required by valid legal process, but only to the extent strictly required.
A successor — if TradeForge is acquired or merged, your data may transfer to the new owner under the same protections.

We do not, and will not, share your journal entries, trade history or playbook content with any third party for advertising, signal-distribution or training of external models without your explicit consent.

6. Payments and financial data

TradeForge does not store credit-card numbers, bank-account numbers or M-Pesa PINs. Card data is tokenised and held by the relevant payment processor. We retain only the minimum information required to render your invoice history: last 4 digits of the card, expiry month/year, the processor's opaque customer ID, and the amount charged.

TradeForge is not a financial-services provider, broker, investment advisor or signal-distribution service. We do not custody funds. The journal and analytics we provide are educational and record-keeping tools only — see our Terms of Service for the full risk disclaimer.

7. International data transfers

TradeForge is operated globally. Your data is stored in regional data centres in the European Union and the United States. Where data is transferred out of your home region, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and equivalent UK data-transfer mechanisms, supplemented with technical safeguards (encryption in transit and at rest, restricted access).

8. How long we keep data

Journal & trade entries — for as long as your account is active. They're yours; we never delete them while you're a paying customer or in trial.
Closed accounts — 30 days after you delete your account, all journal data, playbooks, screenshots and progress are permanently erased from primary databases. Backups are rotated within 90 days.
Billing records — retained for 7 years to satisfy tax and accounting obligations, even after account deletion.
Support tickets — 2 years from the last interaction.
Server logs — 30 days, unless we're investigating a security incident.

9. Your rights

Depending on where you live, you may have the following rights. We honour them globally regardless of the jurisdiction you fall under, because we believe they're reasonable defaults.

Access — request a copy of the personal data we hold about you.
Portability — export your journal entries, playbooks and trade log as JSON or CSV at any time from Settings.
Rectification — correct inaccurate data.
Deletion — close your account and erase your data (subject to our retention obligations above).
Restriction & objection — ask us to stop or limit certain processing.
Withdraw consent — for any processing based on consent (such as marketing emails).
Lodge a complaint — with your local data-protection authority. In Kenya, the ODPC. In the EU, your national DPA. In the UK, the ICO.

To exercise any right, email privacy@tradeforge.app. We respond within 30 days; in complex cases we may extend by a further 60 days and tell you why.

10. Security

We protect your data using:

TLS 1.2+ encryption for every connection between your browser and our servers.
Encryption at rest for the database and uploaded screenshots.
Argon2 / bcrypt password hashing — we cannot recover your password if you forget it.
Row-level security in the database, so one user's journal can never be queried by another.
Strict role-based access for our team — only a small group can access production, all access is logged, and access requires multi-factor authentication.
Regular dependency patching, vulnerability scans and penetration testing.

No system is perfectly secure. If you suspect your account has been compromised, change your password immediately and email security@tradeforge.app.

11. Children

TradeForge is not directed at and not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete the account.

12. Changes to this policy

We may update this policy as the product evolves. The "Last updated" date at the top reflects the most recent revision. Material changes — anything that meaningfully reduces your privacy — will be notified to you by email at least 30 days before they take effect. Continued use of TradeForge after the effective date counts as acceptance of the new policy.