Privacy Policy

1. Who we are

TradingRx (www.tradingrx.net, the "Service") is a trading-journal and behavior-analytics web application for retail traders. It analyzes the trading history you provide and shows behavior diagnostics, plan compliance, and progress tracking. This policy explains what personal data we collect, why, and how you can control it. Data controller contact: admin@tradingrx.net.

2. Data we collect

• Account data from Google Sign-In — your name, email address, and profile picture (details in section 3). We never receive your Google password.
• Trading data — MetaTrader statements you upload and the closed-trade history derived from them (account number, broker, symbols, volumes, prices, stop-loss/take-profit, profits, timestamps).
• Content you create — trading plans, checklists, journal notes, prop-firm challenge settings, treatment-protocol progress, and the one-tap mood check-ins you choose to record.
• Broker connection credentials — if you enable automatic sync, we store your MetaTrader login number, server name, and read-only investor password. The investor password is encrypted at rest with AES-256-GCM and, by MetaTrader design, cannot place trades or withdraw funds.
• Integration data — if you link the RX-Aegis companion tool or the Telegram bot: a device/link identifier, the plan-compliance events RX-Aegis reports (for example, a warning that an order exceeded your risk limit), and your Telegram chat ID and notification preferences.
• Subscription data— plan, status, billing interval, period dates, and the order or subscription identifiers returned by the payment processor. Card and bank details are entered on the processor's page and never reach our servers.
• Technical data — server logs (IP address, browser type, timestamps, errors) kept for security and debugging, and anonymous, aggregated page-view and performance statistics (section 8).

3. Google user data

TradingRx uses Google Sign-In only to let you create an account and log in. We request the basic openid, email, and profile scopes and nothing else — we do not access your Gmail, Google Drive, Calendar, Contacts, or any other Google service.

• What we receive:your name, email address, profile picture URL, and Google's confirmation that the email belongs to you.
• How we use it: to create and identify your TradingRx account, keep you signed in, show your name and picture in the app, and send service messages about your account and subscription (for example, when a free trial is about to end).
• How we store it: in our account database (hosted in Singapore), protected by TLS in transit and access controls; your session is a signed cookie.
• Who we share it with: nobody, except (a) your name and email are passed to the payment processor when you start a checkout, so it can issue your receipt, and (b) our own infrastructure providers listed in section 5, which process it only on our behalf. We do not sell Google user data, use it for advertising, share it with data brokers, or use it to train generalized AI or machine-learning models.
• Retention and deletion:kept while your account exists and deleted when you delete your account (section 7). You can also revoke TradingRx's access at any time from your Google Account permissions page; you will then no longer be able to sign in until you grant access again.

TradingRx's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use your data

• to operate the Service: parse statements, compute health scores, behavior diagnostics, and plan compliance, and display your dashboards and reports;
• to run the automatic history sync and RX-Aegis link you have explicitly set up;
• to send the Telegram messages you opted into (daily debrief, pre-session brief, alerts) — you can turn them off with /daily_off or unlink with /stop;
• to manage your trial and subscription and send service-related messages;
• to secure, debug, and improve the Service.

We do not sell your personal data, do not share your trading data with other users, and do not use it for third-party advertising. Diagnostics are computed by rules in our own software; we do not send your trading data to third-party AI services.

5. Service providers

We share data only with the processors required to run the Service:

• Google — sign-in;
• Vercel — application hosting (Singapore region), anonymous web analytics and performance metrics;
• Supabase — database hosting (Singapore region);
• PayOS and Lemon Squeezy — payment processing (Lemon Squeezy acts as merchant of record for card payments);
• Telegram — message delivery, only if you link the Telegram bot; we also use it to notify our own operator of new sign-ups (email address only).

We may also disclose data if required by law or to protect the rights and safety of our users and the Service.

6. Security

All traffic is encrypted in transit with TLS. Stored broker credentials are encrypted with AES-256-GCM using keys held outside the database. Internal sync traffic and RX-Aegis requests are authenticated with signed requests or revocable tokens. No method of storage is 100% secure, but we design the Service so that the most sensitive credential we ever hold is read-only.

7. Retention and deletion

Your data is kept while your account is active. You can delete uploaded trading accounts (with all their trades), broker connections, and trading plans in the app at any time; sync logs are deleted automatically after 30 days. To delete your entire TradingRx account and all its data — including the Google account data in section 3 — email admin@tradingrx.net from your registered address. We complete deletion within 30 days, except records we must keep for legal or accounting reasons (such as payment records).

8. Cookies, local storage, and analytics

We use only the cookies required to keep you signed in. Your browser's local storage remembers interface preferences such as language and the selected trading account. We use Vercel Web Analytics and Speed Insights, which count page views and measure performance without cookies and without identifying you. We do not use advertising or cross-site tracking cookies.

9. Your rights

You may request access to, correction of, export of, or deletion of your personal data, or withdraw a consent you gave, at any time by contacting admin@tradingrx.net. We honor the rights granted by applicable data-protection laws, including Vietnamese personal-data-protection law and, where it applies, the GDPR.

10. Children

The Service is not directed at, and may not be used by, anyone under 18 years of age.

11. Changes to this policy

We may update this policy from time to time. Material changes will be announced in the app or by email before they take effect. This policy is also available in Vietnamese; both versions have the same content. See also our Terms of Service.