Privacy Policy

NostroPedia operates a trading journal, performance analytics and trader community platform. This policy explains what personal data we process, why, and what rights you have. It applies to nostropedia.com and all related subdomains and services.

Account data: email address, display name, handle, password hash managed by our authentication provider, and optional profile details such as avatar, cover and biography.

Content data: journal entries, trade notes, posts, comments, reactions, reports and messages you create.

Brokerage data: when you voluntarily connect a broker account, we import account identifiers and names, orders, fills, positions, closed trades, realized profit and loss, commissions, and cash/balance activity, together with the access and refresh tokens required to maintain the connection.

Technical data: IP address, browser and device type, timestamps, pages viewed, and error/diagnostic logs.

To create and secure your account; to build your trading journal, statistics, score and equity curve; to operate community features; to detect abuse, fraud and policy violations; to provide support; to process payments for paid features; and to maintain, debug and improve the service.

We do not sell personal data. We do not use your brokerage data for advertising, and we do not share it with advertisers or data brokers.

Broker connections are established through the broker's official authorization flow. The access we request is read-only: we retrieve your own account activity in order to reconstruct your trades. We never place, amend or cancel orders, never move funds, and never perform copy trading.

Broker credentials are never stored by us; only the authorization tokens issued by the broker are stored, encrypted at rest using AES-256-GCM, and used exclusively by our synchronization service. Raw broker events are stored so that trade reconstruction is auditable and idempotent.

You may disconnect a broker account at any time from within the Platform. Disconnection deletes the stored tokens and stops all further synchronization. You may additionally revoke access from the broker's own application settings.

Where GDPR or comparable law applies, we process data to perform our contract with you (providing the journal and synchronization), on the basis of your consent (connecting a broker account, optional communications), for our legitimate interests (security, abuse prevention, service improvement), and to comply with legal obligations.

We rely on carefully selected processors to run the service: cloud hosting and managed database/authentication/storage infrastructure, a dedicated synchronization service for broker connections, a payment processor for paid features, and error/analytics tooling. Processors act on our instructions under contractual confidentiality and security obligations. Some may process data outside your country, subject to appropriate transfer safeguards.

Account, journal and brokerage data are retained while your account is active. When you delete your account, personal data, journal entries and imported brokerage data are deleted or irreversibly anonymized, except where retention is required by law or needed to resolve disputes, prevent abuse or keep financial records for accounting purposes.

We apply encryption in transit, encryption at rest for sensitive tokens, row-level access controls so that each user can access only their own records, role-based administrative access, and audited server-side processing. No system can be guaranteed perfectly secure; please use a strong, unique password.

Subject to applicable law, you may request access to your data, correction, deletion, restriction of or objection to processing, portability of your data in a machine-readable format, and withdrawal of consent. You can exercise most of these rights directly in your account settings, or contact us through the contact page. You may also lodge a complaint with your local data protection authority.

We use strictly necessary cookies and local storage for authentication, session continuity and display preferences, plus privacy-conscious analytics. You may block cookies in your browser, though some features may then stop working.

The Platform is not directed to persons under 18, and we do not knowingly collect their personal data. If you believe a minor has registered, contact us and we will remove the account.

We may update this policy; the current version and its revision date are always published on this page, and material changes will be communicated in-product. For any privacy request, please reach out through our contact page.