Privacy Policy

Last updated: [EFFECTIVE DATE — e.g. 30 August 2026]

Killzonda (“Killzonda”, “we”, “us”) is a web-based journal and analytics tool for futures day traders, operated by [OPERATOR — your name or legal entity], based in [JURISDICTION — country / state]. This Privacy Policy describes how we collect, use, store, disclose, and protect information about you when you visit killzonda.com or use the Killzonda application (together, the “Service”).

For the purposes of the EU and UK General Data Protection Regulation (“GDPR”), [OPERATOR] is the “data controller” of your personal information.

1. Information we collect

1.1 Information you provide to us

• Account information. When you create an account, we collect your email address and a password. Your password is stored only as a salted cryptographic hash by our authentication provider (Supabase); we never see or store it in readable form.
• Content you create in the Service. Everything you log: trades and their details (for example setup, instrument or fund, direction, result, points, profit and loss, position size, stop and target, risk-to-reward, time in trade, session, day of week, liquidity and draw-on-liquidity notes, maximum adverse and favourable excursion, ratings, and whether you followed your rules), no-trade days, your written notes and reviews, your trading rules and checklists, prop-firm purchase and payout entries, and any chart screenshots you attach. Screenshots are resized and compressed in your browser and then stored as part of your trade records.
• Billing information. Subscriptions are processed by Stripe. When you subscribe, you provide your payment card details directly to Stripe — Killzonda does not receive or store your card number. We store a Stripe customer identifier, a subscription identifier, your plan, your subscription status, and trial/renewal dates so we can give you access to paid features. Stripe may share limited billing metadata with us (for example the last four digits and card brand, country, and billing postal code) to display in your billing settings.
• Communications. If you email us for support or any other reason, we keep the message and our reply.

1.2 Information collected automatically

• Log and technical data. Like any website, our hosting infrastructure records standard request logs: your IP address, browser type and version, device and operating system, the pages or endpoints you request, referring URLs, and date/time stamps. We use these for security, debugging, and keeping the Service running.
• Authentication tokens. When you sign in, your browser stores a session token so you stay signed in. Signing out clears it.
• Local preferences. The app stores a small amount of data in your browser’s local storage — for example your custom tag options and interface state such as dismissed reminders. This never leaves your device and is not sent to us.

2. Information we do not collect

• We do not connect to your broker and do not collect broker credentials, account numbers, or automated trade feeds. All trade data is entered by you.
• We do not receive or store your full payment card number, CVC, or full bank details.
• We do not use third-party advertising networks, ad trackers, cross-site tracking pixels, or session-replay tools, and we do not build advertising profiles.
• We do not currently use third-party product analytics. If we add privacy-respecting analytics in future, we will update this Policy first and, where required, ask for your consent.
• We do not knowingly collect information from anyone under 18.

3. How we use information

• Provide the Service: create and secure your account, store and display your journal, compute your metrics and calendar, and run the trade filter.
• Billing: start and manage your subscription and free trial, process payments through Stripe, and show your billing status.
• Service communications: send account and transactional emails such as password reset links and, if applicable, billing notices. These are not marketing.
• Support: respond to your questions and troubleshoot issues.
• Security and integrity: detect, investigate, and prevent fraud, abuse, unauthorised access, and technical problems.
• Legal compliance: comply with applicable law and respond to lawful requests, and establish, exercise, or defend legal claims.
• Product improvement: understand aggregate, non-identifying usage patterns (for example error rates) to fix and improve the Service.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

4. Legal bases for processing (EEA / UK users)

5. How information is shared and processed

We do not sell or rent your information. We share it only with the service providers below, who process it on our behalf and under contract, and in the limited circumstances that follow.

Our providers may update their own subprocessors from time to time. We also may disclose information:

• To comply with law — in response to a valid subpoena, court order, or other lawful request, or where disclosure is necessary to protect rights, safety, or property.
• In a business transfer — if Killzonda is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you and honour the commitments in this Policy.
• With your direction — for example, a data export you request and download yourself.

6. Local storage and cookies

Killzonda does not use advertising or tracking cookies. We use the following browser storage, all of which is strictly necessary to operate the Service:

• Authentication token — set when you sign in, so you remain signed in; cleared when you sign out.
• Local preferences — small values such as custom tag options and dismissed in-app reminders, stored on your device only.

Because we use only strictly-necessary storage and no analytics or advertising cookies, no cookie-consent banner is presented. If this changes, we will update this Policy and implement consent where the law requires it.

7. Data retention

• We keep your account information and journal content for as long as your account is active.
• If you delete your account, we delete your journal content and account record from our live systems within [e.g. 30] days. Residual copies may persist in encrypted backups for up to [e.g. 30–90] days before being overwritten on our provider’s backup rotation.
• Billing and transaction records held by Stripe, and any records we must keep for tax, accounting, or legal-compliance reasons, are retained for the period required by applicable law.
• Server logs are retained for a short period for security and debugging and then rotated out.

8. Security

We take reasonable and appropriate measures to protect your information, including:

• Encryption in transit using HTTPS/TLS for all connections to the Service.
• Passwords stored only as salted hashes.
• Database access controls that isolate each account’s data at the row level, so one user cannot read another user’s entries.
• Server-side handling of billing writes using restricted credentials.
• Secrets and keys stored as environment variables, never in application code.

No method of transmission or storage is completely secure. You are responsible for keeping your password confidential and for signing out on shared devices. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities as required by law.

9. International data transfers

We and our providers are located in, or process data in, the United States and other countries. If you are in the EEA, the UK, or Switzerland, your information may be transferred to countries that do not provide the same level of data-protection law as your own. Where we do this, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), which Supabase, Stripe, and our other providers make available. You may request a copy of the relevant safeguards by contacting us.

10. Your rights and choices

Everyone. You can, at any time:

• Access and review your data — it is all visible in the app.
• Export your data — the app provides a full JSON export of your trades and no-trade days that you can download and re-import.
• Correct your data — edit or delete any trade, note, or entry directly.
• Delete your account — contact us at [CONTACT EMAIL] and we will delete your account and journal content as described in Section 7.
• Manage billing — cancel your subscription at any time from the billing portal in the app.

EEA / UK / Switzerland. In addition to the above, you have the right to: restrict or object to certain processing; request data portability; withdraw consent where we rely on it (without affecting prior processing); and lodge a complaint with your local data-protection supervisory authority. We will not discriminate against you for exercising any of these rights.

To exercise any right, email [CONTACT EMAIL]. We will respond within the time required by applicable law (generally within 30 days). We may need to verify your identity first.

11. California privacy rights

If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it (described above), to request access to and deletion of your personal information, to correct inaccurate personal information, and not to be discriminated against for exercising these rights.

We do not “sell” your personal information and do not “share” it for cross-context behavioural advertising, as those terms are defined under California law. The categories of personal information we collect are: identifiers (email, IP address), customer records and commercial information (subscription and billing details), internet activity (server logs), and the content you choose to store in your journal. To make a request, email [CONTACT EMAIL].

12. Children’s privacy

The Service is intended for adults and is not directed to children. You must be at least 18 years old to create an account. We do not knowingly collect personal information from anyone under 18 (or under 16 in the EEA/UK). If you believe a child has provided us information, contact us and we will delete it.

13. Third-party links

The Service may link to third-party websites (for example broker or prop-firm sites, or payment pages hosted by Stripe). We are not responsible for the privacy practices of those sites. Review their policies before providing information.

Killzonda is a journaling and analytics tool. It is not a broker or investment adviser, and nothing in the Service is financial or trading advice. Please also read our Terms of Service and risk disclaimer.

14. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will post the updated Policy here with a new “Last updated” date and, where appropriate, notify you by email or in the app before the changes take effect. Your continued use of the Service after an update means you accept the revised Policy.

15. How to contact us

Questions, requests, or complaints about this Policy or your information:
Email: [CONTACT EMAIL]
Operator: [OPERATOR — name or legal entity]
Postal address: [MAILING ADDRESS, optional but recommended]