Privacy Notice

Effective September 23, 2026

Information you provide

Depending on what you use, the service processes your sign-in email and provider, profile settings, trades and price levels, risk limits, P&L, notes, account rules and manually entered balances, screenshots, AI prompts, and support information. Do not submit broker passwords, payment card numbers, or information you do not want processed.

Information about your agreement

After you sign in, the first saved-workspace visit asks you to accept the current Terms of Use. We save the account identifier, the terms version, the time accepted, and the email associated with that sign-in. The record is used to remember acceptance for that account and to keep an acceptance history when terms versions change.

How information is stored

Supabase handles account authentication and passwords; FrameTheTrades does not receive or store your Google password. Trade, profile, and account records are stored in the application database and screenshots in object storage. Records are tied to the signed-in account and checked on server requests. Tradovate access tokens are encrypted with AES-GCM before they are stored. The app stores a hash of its own session token rather than the raw token.

Encryption and security

Traffic uses HTTPS. Cloudflare D1 and R2 provide provider-managed encryption at rest, and D1 connections within Cloudflare use TLS. These protections do not mean data is end-to-end encrypted: the application can access records to provide the workspace and process a feature you request. No online service can promise zero security incidents. Use a strong password, secure your email account, and keep downloaded backups private.

When information is sent to AI

When you request AI help or attach an image, the information needed for that request is sent to OpenAI’s API. Images are sent for automated safety and chart-type screening before permanent screenshot storage; a chart-planning request that passes screening is also sent with your prompt for analysis. Images that fail screening are not written to FrameTheTrades screenshot storage, but the screening provider has already processed the image. Automated screening may misclassify images and can miss non-chart or identifying details, so crop out personal information before upload. A journal review may include calculated findings, selected trades, notes, your optional review focus, and profile settings. Weekly reviews use their displayed seven-day window; Pro custom reviews use the selected dates and filters. These reviews do not send screenshots or stored account balances. AI selects from calculated findings and process exercises; saved reports preserve their evidence and review focus. AI responses can be wrong or incomplete. Provider-side processing and retention are governed by the provider’s current terms and data controls.

Other providers

Google may process information when you choose Google sign-in. Cloudflare provides website hosting, database, and file storage infrastructure. If Stripe checkout is enabled later, Stripe will process payment details; FrameTheTrades is designed to receive subscription status and identifiers, not card numbers. A Tradovate connection uses OAuth so you can authorize access; the site does not ask for your Tradovate password. Providers handle data under their own terms and notices.

How we use information

• Provide sign-in and save your account-specific workspace.
• Calculate results and risk scenarios from your entries.
• Return an AI response when you explicitly submit a request.
• Enforce plan limits, protect the service, and investigate technical errors.

We do not sell trade journals or screenshots and do not use them for advertising.

Your choices and retention

You can download a backup of your workspace from Settings. A self-service account deletion control is not available yet. Records remain until removed through an administrative process or retention requirements apply. A working privacy contact and a clear account deletion and retention process must be added before paid subscriptions launch.

Contact and operator

The public privacy contact and legal operator identity have not yet been published. “FrameTheTrades” is the current service name; no LLC has been formed or verified. The operator details will be added after they are established.