Data Retention and Disposal Policy

User Account Data

Retention period: Indefinite — data is retained for the lifetime of the user's account. Includes email address (from OIDC provider), display name, workspace settings, theme preferences.

Trading Data

Retention period: Indefinite — retained until the user deletes their account. Includes trade history, trade groups, journal entries, tags, account configurations, strategy assignments, dividend records.

Financial Account Connections

Retention period: Retained until the user deletes their account or disconnects the linked account. Includes access tokens, account metadata, transaction data.

Subscription and Billing Data

Retention period: Retained until account deletion. Includes subscription ID, plan status, billing cycle dates. Payment card details are never stored.

Notification Delivery Records

Retention period: 90 days, then deleted automatically (sooner if you delete your account). Whether each email or push notification was delivered, failed or held back, with the provider's message id and any error; never the address or the message.

Uploaded Files We Can't Read Yet

Retention period: 30 days from upload, then deleted automatically (sooner if you delete your account). Includes broker files in formats not yet supported and feedback attachments; tax documents only as text with SIN/SSN redacted.

Usage Events

Retention period: Retained until the user deletes their account. Includes the days the account was used, sign-up, brokerage and calendar connections, imports (counts only), features used, settings changed, and errors. Never email addresses or content the user wrote. When an account is deleted, only the fact that an account was deleted is kept, with nothing that identifies it.

Session Data

Retention period: 30 days of inactivity (automatic expiry). Includes session ID, workspace ID, email.

Notification Device Tokens

Retention period: Retained until you disable push notifications or delete your account.

Data Disposal

When a user deletes their account (via Settings), all user data is immediately and permanently deleted via cascade deletion. This includes all trades, groups, accounts, journal entries, tags, workspace settings, identity records, usage events, and subscription records. All access tokens are revoked. All active sessions are destroyed. Deletion is irreversible — no soft-delete or grace period. Deleted data cannot be recovered.

Data Not Retained

myTraderDash does not store passwords, payment card numbers, banking credentials, government-issued identification, or IP addresses, except the one kept with your record of accepting the Terms of Service and the Privacy Policy.

Policy Review

This policy is reviewed when new data categories are introduced, third-party integrations change, regulatory requirements change, or at minimum annually.

Contact

General — admin@mytraderdash.com

Support — support@mytraderdash.com

Privacy — privacy@mytraderdash.com

Security — security@mytraderdash.com