Privacy Policy
In short: Traced keeps your journal in your own account so it works on every device. We only collect what the journal needs, we never sell your data, there are no ads and no tracking cookies, and you can export or delete everything at any time.
Who we are
Traced (“we”, “us”) is a trading journal at tracedapp.pages.dev, run by an independent developer based in Thailand. Questions about your data go to traced.support@gmail.com.
What we collect
| What | Why |
|---|---|
| Your email address and name | To create your account, confirm your email, sign you in and send password-reset links. |
| Your password | To sign you in. It is stored only as a one-way hash by our sign-in provider; we never see it. |
| Your journal | Trades, days, prop-firm accounts, payouts, notes, study notes, screenshots, card backgrounds (pictures and videos) and settings. This is what Traced is for, and it is only shown to you. |
| Discord profile (if you connect it) | Your Discord ID, username, display name and picture, to sign you in with Discord and put your name and picture on your share cards. We ask Discord for your email too, to create the account. We never read your messages or servers. |
| Trading connections (if you add them) | The platform, a name you choose, your platform username and account number, so trades are filed under the right account. |
| Tradovate API key, secret and password (if you use Tradovate sync) | To fetch your closed trades from Tradovate when you press Sync. They are encrypted on our server and never sent back to a browser. A password is only kept if you tick “Remember”. |
| NinjaTrader sync keys (if you make one) | To let the add-on on your computer add trades to your journal. We store only a scrambled fingerprint (hash) of the key. |
| Two-step sign-in (if you turn it on) | The secret your authenticator app uses, kept by our sign-in provider. |
| Basic technical data | IP address, browser type and times of sign-in, kept in our providers' logs to run the service, prevent abuse and fix problems. |
We do not collect payment details today. If paid plans open, payments will be handled by a payment provider and we will update this policy first.
What we don't do
- We don't sell or rent your data, and we don't share it for advertising.
- We don't use advertising trackers or tracking cookies. We count visits with Cloudflare Web Analytics, which sets no cookies and does not identify you.
- We don't place trades or change anything in your broker or prop-firm accounts. Connections only read your trades.
Who helps us run Traced
These services process data for us, only to provide Traced:
- Supabase: accounts and sign-in, the database for your journal, private file storage, and the server functions for Tradovate and NinjaTrader sync.
- Cloudflare Pages: hosts the website.
- Cloudflare Turnstile: the human check on sign-up, log-in and password reset. Cloudflare looks at signals from your browser to tell people from bots.
- Cloudflare Web Analytics: counts page visits, where visitors came from, and their country and device type, without cookies or anything that identifies you.
- Google: sends our account emails (Gmail) and serves the website's fonts (Google Fonts).
- jsDelivr: serves some of the code libraries the website uses.
- Discord: only if you sign in with or connect Discord.
- Tradovate: only when you sync a Tradovate connection, using the key you gave us.
- YouTube: only when you play a video in the Study room.
These providers may store data in other countries. We may also share data if the law requires it.
What's kept in your browser
Traced keeps your sign-in session and a few preferences (like your look and the last page you used) in your browser's local storage so the app opens quickly. These are not tracking cookies, and they stay on your device.
How long we keep it
We keep your journal for as long as you have an account. When you delete your account, your profile, journal, files, connections, saved keys and sync keys are deleted straight away. Our providers' logs and backups may keep traces for a limited time before they are cleared.
Your choices and rights
- See and export: Settings → Your data → Download backup gives you everything, pictures included.
- Correct: edit any trade, note or setting, and change your name, email or password in Settings.
- Delete: Settings → Account and security → Delete account. You can also delete just the journal, or single trades and files.
- Disconnect: remove Discord from your cards, delete trading connections, or remove sync keys at any time.
Depending on where you live, you may have further rights, such as asking what we hold about you or objecting to how we use it. Email traced.support@gmail.com and we will answer.
Security
Data is sent over encrypted connections. Each person can only reach their own data, enforced by the database itself. Broker secrets are encrypted with a key only our server holds. You can turn on two-step sign-in. No system is perfectly secure, so please use a strong password you don't use elsewhere.
Age
Traced is meant for adults trading their own accounts. You must be at least 18 to use it.
Changes
If we change this policy, we will update the date above, and for important changes we will tell you in the app or by email before they apply.