Privacy Policy

Introduction

myTraderDash ("we", "us", "our") is a trading analytics and journaling application. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and your rights regarding your data.

By using myTraderDash, you agree to the collection and use of information as described in this policy.

Information You Provide

Account Information — When you sign in via a supported identity provider, we receive your email address and display name. We do not collect passwords.

Trading Data — Trade history, journal entries, notes, tags, and strategy configurations that you import or create within the application.

Financial Account Connections — If you connect a bank or brokerage account through one of our supported financial data providers, we receive account metadata and transaction data as authorized by you through that provider's consent flow.

Feedback — Any message you send us through the in-app feedback form.

Information Collected Automatically

Session Data — We generate a session identifier when you sign in, referenced by a secure cookie, to keep you signed in.

Workspace Data — We create a workspace identifier to isolate your data from other users.

Device Tokens — If you enable push notifications in our mobile app, we store the device token needed to deliver them.

IP Addresses — Your IP address is processed transiently by Cloudflare and our servers for security purposes such as rate limiting and abuse prevention. It is not used to track or profile you. The one exception: when you accept our Terms of Service and this Privacy Policy, we keep the IP address and browser you used with the record of that acceptance, for as long as your account exists.

Usage Events — So we can support you and fix problems, we record what happens in your account: the days you use it, signing up, connecting or disconnecting a brokerage or calendar, imports (how many trades, not the trades themselves), the features you use (for example adding a journal entry, changing a watchlist or opening a Ticker Report), settings you change, and errors the app or our servers run into. These records never hold your email address, your journal text or your messages. They are kept with your account and deleted with it.

Notification Deliveries — For each email or push notification we send you, we record whether it was delivered, failed or was held back (for example to an address that can't receive mail), with the provider's message id and any error. These records never hold your email address or the message itself. They are kept for 90 days, then deleted automatically, and deleted with your account.

Tax Document Handling

When you upload tax documents (T5008, 1099-B, 1099-DIV, etc.) for import, they are processed in-memory and not stored in their original form. If your document format is not yet supported, we extract the document text with all Social Insurance Numbers (SIN) and Social Security Numbers (SSN) redacted before any storage. Raw PDF files containing PII are never persisted.

Files We Can't Read Yet

When you upload a broker file in a format we don't support yet, or attach a file to feedback, we keep a copy for up to 30 days so we can add support for it, then delete it automatically. Tax documents are kept only as text with SIN/SSN redacted, as described above. Files we can read are imported and not kept.

Information We Do NOT Collect

Passwords, payment card numbers, banking credentials, government-issued identification (SIN/SSN are redacted from tax documents), or your browsing activity outside myTraderDash. We do not use third-party analytics services, tracking cookies, or advertising pixels: the usage events described above are recorded by our own servers and not shared with anyone.

How We Use Your Information

We use your information solely to provide and improve the myTraderDash service: display your trades, analytics, journal entries, and portfolio data; verify your identity and maintain your session; connect to your brokerage accounts when you choose to; understand how the app is used and fix problems (the usage events above); and send the alerts, reminders, and summaries you receive by email or push notification. These are on by default and can be turned off at any time in Settings.

We may occasionally email you about product updates. Every such email includes an unsubscribe link, and you can opt out at any time.

We do not sell, rent, or share your personal information for advertising or marketing purposes.

Service Providers

We use the following service providers to operate myTraderDash. Each receives only the data needed for its function.

DigitalOcean — Server hosting (Toronto, Canada). Stores all application data.

Cloudflare — Network security, DNS, and content delivery. All traffic to myTraderDash passes through Cloudflare, which processes requests (including IP addresses) in transit.

Google, Apple, Yahoo — Sign-in (OpenID Connect). Data received by us: email address, name, and whether the email is verified.

Google (Gmail) — Delivery of notification emails. Data shared: your email address and the content of the notification.

Google (Firebase Cloud Messaging) — Delivery of mobile push notifications, if enabled. Data shared: device token and notification content.

Google Calendar — Optional calendar sync, only if you connect it. Data shared: the trades, dividends, journal entries, and market events you choose to sync, written to your own Google Calendar.

SnapTrade, Plaid — Brokerage and financial account connections, only if you connect an account. Data received: account and transaction data you authorize through the provider's consent flow.

Market data providers — Prices and company data are requested using ticker symbols only. No personal information is sent.

Stripe — Payment processing. Stripe collects your payment details directly; we receive only your subscription status and never see or store card numbers.

We do not share your trading data, journal entries, or analytics with any third party except as needed to deliver a feature you have enabled (for example, calendar sync).

Where Your Data Is Stored

Your data is stored on servers in Toronto, Canada. Some of the service providers listed above, including Cloudflare and Google, are based in the United States or operate globally, so data they process may be handled outside Canada and may be subject to the laws of those jurisdictions, including lawful access requests by foreign courts or authorities.

For residents of Quebec: your personal information is stored outside Quebec (in Ontario) and some processing occurs outside Canada as described above. We choose providers that protect data with encryption and access controls, and we consider the sensitivity of your information when deciding what each provider receives.

Data Storage and Security

All data is transmitted over HTTPS (TLS 1.2 or higher). Traffic between Cloudflare and our servers travels through an encrypted tunnel; our servers accept no other inbound connections from the internet. The database is reachable only on a private network. User data is isolated by workspace, enforced at the database level with row-level security. Sessions use HttpOnly, Secure, SameSite cookies. Authentication uses PKCE to prevent token interception. See our Information Security Policy for additional details.

Data Retention

Account data, trading data and usage events are retained for the lifetime of your account. Session data expires automatically after 30 days of inactivity. All data is permanently deleted when you delete your account. There is no soft-delete period or backup retention after account deletion.

Your Rights

You have the right to:

Access — View all data associated with your account.

Portability — Export your trades, journal, dividends, and analytics from within the app, or request a copy of your data by email.

Correction — Edit your data in the app or ask us to correct it.

Delete — Permanently delete your account and all associated data via Settings.

Disconnect — Remove linked financial accounts at any time.

Withdraw consent — Turn off notifications or disconnect integrations at any time.

myTraderDash primarily serves users in North America. We do not sell personal information. If you are subject to regional privacy laws (including PIPEDA, Quebec's Law 25, CCPA, or GDPR), we will comply with data access, correction, portability, and deletion requests. Contact privacy@mytraderdash.com.

Privacy Officer

The person responsible for the protection of personal information at myTraderDash is its owner and operator, reachable at privacy@mytraderdash.com.

Security Incidents

If a confidentiality incident involving your personal information presents a risk of serious harm, we will notify you and the relevant privacy regulator (such as the Office of the Privacy Commissioner of Canada or Quebec's Commission d'accès à l'information) as required by law.

Children's Privacy

myTraderDash is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will email you at the address on your account at least 30 days before the change takes effect, with the new text, the text it replaces and the date it takes effect. If you keep using myTraderDash on or after that date, you accept the updated policy; if you don't, you may close your account at any time, at no cost. For a significant change, we may also ask you to accept it in the app.

Contact

General — admin@mytraderdash.com

Support — support@mytraderdash.com

Privacy — privacy@mytraderdash.com

Security — security@mytraderdash.com