TraderLeveling Privacy Policy
Effective date: June 11, 2026 Last updated: July 1, 2026
This Privacy Policy explains how TraderLeveling — currently operated by its founder as a sole proprietorship doing business as "TraderLeveling" — ("TraderLeveling," "we," "us") collects, uses, shares, and protects information when you use the TraderLeveling application and website at traderleveling.com (the "Service"). It applies to all users of the Service. Capitalized terms not defined here have the meanings in our Terms of Service.
Plain-language summary: We collect your account information and the trading content you create — trades, journal entries, methodology descriptions, chart annotations, and explanations. AI features send relevant portions of that content to our AI provider (Anthropic) under commercial terms that prohibit training on it. Your methodology is yours; we don't sell it, show it to other users, or sell your personal information to anyone. If you connect a brokerage account, we read your fills to automate your journal; if you stream your own live market data through the Service, we process it ephemerally and never store it. We use a product-analytics provider (PostHog) to improve the product; it is pseudonymous, never includes your trade content, honors Do Not Track, and can be turned off in settings. You can export your records and delete your account and data at any time.
1. Information We Collect
1.1 Account information
- Email address and display name
- Password (stored as a salted hash; we never store plaintext passwords)
- Account settings, preferences, and plan/subscription status
1.2 Trading and methodology content ("User Content")
The core of the Service:
- Trades you log or import (instruments, entries, exits, sizes, times, profit/loss, stops/targets)
- Journal entries, session reviews, notes, and explanations (text or voice; voice may be transcribed)
- Methodology descriptions, strategies, rules, setups, and concepts
- Chart annotations, drawn objects, and labels
- AI-assisted derivations of the above generated at your direction (compiled methodology specifications, concept registries, sensor configurations, trade theses, playbook entries)
- Derived analytical events: records that a condition or pattern you defined occurred (e.g., "setup conditions 4 of 6 met"). These contain analysis language and references to your own annotations — not market data series.
1.3 Brokerage and data connections (when available)
If you connect a brokerage, platform, or data account (e.g., via OAuth):
- Connection tokens needed to maintain the link (we do not receive your brokerage username or password)
- Trade, fill, order, and position data from the connected account, used to populate your journal and analytics
- Live market data from your connections is processed ephemerally and per-session to provide features to you. We do not store it, do not display it to other users, and do not add it to our own data sets.
- Desktop application (the Terminal, formerly the Cockpit). When you connect a broker or data feed through the downloadable desktop Terminal, the credentials you enter are stored locally on your own device and are not transmitted to or stored by us; your live feed is read and analyzed on your device. Only the derived records you choose to sync — closed trades and plans — flow back to your account, as described above.
You can disconnect any linked account at any time in settings, which revokes our access.
1.4 Payment information
Payments are processed by Stripe. We do not receive or store full card numbers. We receive limited billing details (name, billing email, card brand and last four digits, transaction and subscription status).
1.5 Technical and usage information
- Log data: IP address, browser and device information, pages and features used, timestamps
- AI usage metrics: requests made and associated token/cost accounting (used for operations, abuse prevention, fair-use limits, and billing)
- Market data access logs: which symbols, timeframes, and windows your account requested (counts and windows — we log access, not the data itself)
- Product analytics: we use a third-party product-analytics provider (PostHog) to understand how the Service is used — pages and features visited, navigation paths, approximate (city/country-level, IP-derived) location, and return visits — so we can improve it. Events are sent to PostHog through a first-party connection on our own domain, are keyed to a pseudonymous account identifier (never your email), and never include your trades, journal, methodology, or market data. You can turn it off at any time in settings, and we honor browser Do Not Track / Global Privacy Control signals (see Section 11)
- Cookies and local storage: strictly necessary for authentication and session management, plus first-party storage for the product analytics described above (which you can disable). Aside from that product analytics, we do not use advertising or cross-site tracking cookies or third-party advertising trackers.
1.6 Communications
If you contact us, we keep the correspondence and your contact details.
1.7 Information we do NOT collect
We do not collect government identifiers, precise geolocation, biometric data, or data from data brokers. Market data displayed to you (price/quote information) is not information *about you* and is not treated as your personal information, though your access to it is logged per Section 1.5.
2. How We Use Information
We use information to:
- Provide and operate the Service: journaling, analytics, charts, replay, AI coaching, methodology compilation, and sensor features — including processing your User Content through AI models at your direction (this is the product working as intended)
- Authenticate you and secure your account and our systems (including tenant isolation, rate limiting, and abuse prevention)
- Track AI usage and costs, enforce fair-use limits, and bill subscriptions
- Maintain market-data compliance (access logging, embargo enforcement, audit records)
- Communicate with you: transactional email (verification, password reset, billing) and important service announcements
- Improve the Service using aggregated or de-identified information that does not identify you and does not reveal your methodology
- Understand and improve how the Service is used through our product-analytics provider (PostHog) — navigation, feature usage, retention — which you can opt out of in settings
- Comply with legal obligations and enforce our Terms
We do not: sell or rent your personal information; sell, share, or expose your methodology, trades, or journal content to other traders, firms, or data buyers; use one user's content to provide coaching, insights, or signals to any other user; or use your content to train AI models.
Legal bases (where required, e.g., GDPR): performance of our contract with you (core Service), legitimate interests (security, abuse prevention, service improvement), consent (where specifically requested), and legal obligation (tax, accounting, lawful requests).
3. AI Processing Disclosure
AI features are powered by third-party large language model providers, currently Anthropic (Claude models), accessed via API.
- When you use AI features (coaching, methodology compilation, trade grading, thesis refinement, insights), relevant portions of your User Content are transmitted to the provider's API for processing, and results are returned to the Service.
- Under Anthropic's commercial API terms, API inputs and outputs are not used to train Anthropic's models.
- Quantitative results shown in the Service (statistics, metrics, detection events) are computed by our own deterministic systems; AI models interpret and explain — they do not invent your numbers.
- If we add or change AI providers, we will update this policy and the subprocessor list before routing your content to them.
4. How We Share Information
We share personal information only as described here.
Service providers (subprocessors), under contracts limiting their use of data to providing services to us:
| Subprocessor | Purpose | Data involved |
|---|---|---|
| Render | Application and database hosting | All Service data |
| Anthropic | AI model processing | User Content sent for AI features |
| PostHog | Product analytics | Pseudonymous usage events (navigation, feature usage, retention) — no User Content |
| Resend | Transactional email delivery | Email address, email content |
| Stripe (when paid plans launch) | Payment processing | Billing information |
*(No voice-transcription subprocessor is currently in use; one will be added to this table before any voice feature ships.)*
Our product analytics (Section 1.5) sends only pseudonymous usage events to PostHog — never your User Content — reached through a first-party endpoint on our own domain. PostHog processes this data only to provide analytics to us and does not use it for its own purposes.
Data sources (not subprocessors): we license market data from providers such as Databento. Market data flows *to* the Service; we do not send your personal information to data providers, other than technical access information inherent in API use.
Legal and safety: we may disclose information to comply with law, regulation, legal process, or enforceable governmental request; to enforce our Terms; or to protect the rights, safety, or property of TraderLeveling, our users, or the public.
Business transfers: in a merger, acquisition, financing, or sale of assets, information may be transferred as part of the transaction; this policy will continue to apply, and we will notify you of any material change in ownership or use of your personal information.
With your direction: when you export your data or direct us to share it.
We do not sell personal information and have not done so. We do not "share" personal information for cross-context behavioral advertising.
5. Your Content, Your Methodology
Your trading methodology and the content you create remain yours, including AI-derived artifacts compiled from it (see Terms of Service §6). We hold only the limited license needed to operate the Service for you. We do not use one user's methodology to benefit another user, and aggregated/de-identified improvement data is constructed so that it cannot reveal your methodology.
6. Data Retention
| Data | Retention |
|---|---|
| Account information | While your account is active |
| User Content (trades, journals, methodology, annotations, derived artifacts) | While your account is active, or until you delete the specific content |
| Live market data from your connections | Not stored (ephemeral, per-session) |
| Derived analytical events | While your account is active, or until deleted |
| Market data access logs (audit) | Up to 24 months (compliance/audit) |
| AI usage/cost records | Up to 24 months (billing/abuse prevention) |
| Product analytics events (PostHog) | Up to 12 months (default; pseudonymous, no User Content) |
| Payment records | As required by tax and accounting law (typically 7 years) |
| Support correspondence | Up to 24 months after resolution |
When you delete your account, we delete your personal information and User Content within 30 days, except where retention is required for legal, security, audit, or accounting purposes. Deleted data may persist in encrypted backups for up to 90 days before purging on normal rotation; backup copies are not restored to production except for disaster recovery.
7. Security
We use technical and organizational measures appropriate to the data we handle, including: TLS encryption in transit; database-level tenant isolation (PostgreSQL row-level security with fail-closed policies); hashed passwords; signed, expiring tokens for email verification and password reset; per-IP credential rate limiting and per-user usage rate limiting; environment-enforced production secrets; and audit logging of market data access.
No system is perfectly secure, and we cannot guarantee absolute security. If we learn of a breach affecting your personal information, we will notify you and applicable regulators as required by law, without undue delay.
8. Your Rights and Choices
8.1 All users
You can: update account information in settings; delete trades, journal entries, methodology content, and annotations directly in the app; export your trades and journal records using the export tools; disconnect linked broker/data accounts at any time; turn product analytics on or off in settings (Account & Security); and delete your account entirely.
8.2 California residents (CCPA/CPRA)
You have the right to: know/access the categories and specific pieces of personal information we collect, the sources, purposes, and categories of third parties to whom it is disclosed; delete personal information, subject to legal exceptions; correct inaccurate personal information; portability of your data; and non-discrimination for exercising rights.
Categories we collect (per Cal. Civ. Code §1798.140): identifiers (name, email, IP); commercial information (subscription records; your trading records as content you provide); internet/electronic activity (usage logs); audio (voice explanations, if you record them); and inferences only insofar as analytical outputs are derived from your own content at your direction.
We do not sell personal information and do not share it for cross-context behavioral advertising, so there is no sale/sharing to opt out of; we honor Global Privacy Control signals where applicable. We do not use or disclose sensitive personal information for purposes requiring a right to limit.
To exercise rights, email privacy@traderleveling.com from your account email. (We operate exclusively online with a direct relationship with our users, so email is our designated request method.) We will verify your identity via your account and respond within the time required by law (generally 45 days). You may use an authorized agent with written permission.
8.3 EEA/UK residents (if applicable)
You may have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your supervisory authority. The legal bases in Section 2 apply. The Service is operated from the United States (Section 9).
9. International Users
The Service is operated from the United States, and information is processed and stored in the U.S., which may have different data protection laws than your jurisdiction. By using the Service, you understand your information will be transferred to and processed in the U.S.
10. Children
The Service is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact us at privacy@traderleveling.com and we will delete it.
11. Do Not Track and GPC
We honor Global Privacy Control signals for applicable rights. We also honor browser Do Not Track and Global Privacy Control signals for our first-party product analytics (Section 1.5): when your browser sends either signal, that analytics does not load or run. You can additionally turn product analytics off at any time in settings. We do not track users across third-party sites.
12. Changes to This Policy
We may update this policy. Material changes will be announced via the Service or by email at least 14 days before they take effect. The "Last updated" date reflects the current version. Prior versions are available on request.
13. Contact
TraderLeveling privacy@traderleveling.com (We operate exclusively online; a mailing address is available upon written request.)