Skip to content

Security & Global Data Compliance

Privacy Policy

1. Overview & Data Controller

At Alpha Journal (`alphajournal.co.uk`), we recognise that your trading data is private and sensitive. Alpha Journal operates as the Data Controller registered with the UK Information Commissioner's Office (ICO) under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and complies with the EU GDPR, the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), and the California Consumer Privacy Act (CCPA/CPRA).

2. Data We Collect

We collect only the data necessary to operate your trading journal and protect platform integrity:

  • Account & Identity: Name/display handle, email address, timezone, and encrypted authentication credentials.
  • Trading & Journal Data: Accounts, trade history, symbols, entry/exit prices, position sizes, setup/mistake tags, playbooks, and chart screenshots you upload. Files dropped on the public `/roast` tool are parsed locally in your browser and are not stored on our servers unless you create an account to import them. Share cards (`9:16 PNG`) generated on `/journal`, `/analytics`, or `/challenge` are rendered client-side on your device and shared only if you choose to download or post them.
  • 30-Day Discipline Challenge (Opt-In): If you join the challenge, we store and display on the leaderboard only your chosen nickname (3–20 characters), Discipline Score %, closed trade count, clean-day streak, and challenge day. We never display your real name, email, account balance, or dollar P&L. You can hide your handle or leave the challenge at any time.
  • Refer & Earn & Anti-Fraud Signals: When you use or share a referral link, we record the referral relationship and store one-way cryptographic hashes of network and device identifiers solely to prevent self-referrals and reward abuse. Raw IP addresses are not stored in our anti-fraud records. Referrers see only a masked version of their invited friend's email (e.g., `J•••@gmail.com`), join date, and trade count towards the reward milestone — never the friend's full email, P&L, or trades.
  • Security, Support & Attribution Metadata: Rate-limit counters, support/feedback messages, signup referral source, and cookieless aggregate page analytics.

3. Legal Basis for Processing (UK/EU GDPR)

  • Contractual Necessity (Art. 6(1)(b)): To provide your journal, analytics, AI coaching, Pre-Flight checks, challenge tracking, and transactional account emails.
  • Legitimate Interest (Art. 6(1)(f)): To secure the platform, enforce rate limits, prevent referral/trial fraud via hashed anti-abuse signals, and measure aggregate product usage.
  • Legal Obligation (Art. 6(1)(c)): To comply with UK tax, accounting, and financial record-keeping laws.
  • Consent (Art. 6(1)(a)): Where you opt in to public leaderboard visibility or optional features, which you may withdraw at any time.

4. AI Processing & EU AI Act Transparency

When you use AI features (AI Coach, Pre-Flight, Screenshot Auto-Fill, Trade Insight, Pre-Market Brief, Roast, or Support Triage), the relevant trade records, prompts, or chart screenshots are transmitted securely over encrypted TLS connections to our enterprise AI language model sub-processor. Under our commercial API agreements, your trading data and screenshots are never used to train third-party foundation AI models. We never sell, rent, or trade your personal or trading data to any third party for monetary or cross-context behavioral advertising (CCPA/CPRA), nor do we perform automated profiling that produces legal or similarly significant effects (GDPR Art. 22).

5. Your Privacy Rights (UK/EU GDPR, CCPA & Global)

Subject to applicable law and identity verification, you have the right to:

  • Access and export your complete trading data at any time in machine-readable format (JSON/CSV).
  • Rectify inaccurate personal or trade data directly inside your account.
  • Permanently delete your account and all associated records (`Settings → Delete Account`).
  • Restrict or object to processing based on legitimate interest, or opt out of optional challenge/onboarding emails.

6. Data Retention, Security & Account Deletion

We retain your personal and trading data for as long as your account remains active. All data is protected via TLS encryption in transit, encryption at rest, and strict database Row-Level Security (RLS). You are responsible for keeping your account credentials confidential. When you delete your account in Settings, your profile, trading accounts, trades, uploaded screenshots/avatars, tags, playbooks, challenge entries, and anti-fraud signals are permanently purged from our active database, with encrypted backups cycling out within 30 days. Statutory billing/invoice records are retained only where required by UK tax law (up to 6 years).

7. Categories of Service Providers & International Transfers

In accordance with UK/EU GDPR Article 13(1)(e), we share data only with vetted categories of infrastructure sub-processors bound by strict Data Processing Agreements (DPAs), and never disclose internal infrastructure architecture publicly for operational security:

  • Cloud Database & Storage Infrastructure: Encrypted database hosting, authentication, and isolated object storage.
  • Enterprise AI Processing Providers: Commercial API language and vision processing with zero model-training retention.
  • Transactional Communications: Encrypted account, security, and notification email delivery.
  • Payment Processing: PCI-DSS Level 1 certified subscription billing (we never see or store your payment card numbers).
  • Edge Hosting & Security: Global application delivery, DDoS protection, and cookieless aggregate telemetry.

Where data is processed outside the UK or European Economic Area, transfers are safeguarded by the UK International Data Transfer Agreement (IDTA), EU Standard Contractual Clauses (SCCs), and the EU-US / UK-US Data Privacy Framework. Verified users or regulators may request our specific sub-processor list via support@alphajournal.co.uk.

8. Cookies & Local Storage

We use strictly necessary first-party cookies solely for encrypted session authentication and referral attribution/anti-fraud protection. Theme and interface preferences are stored in browser `localStorage`. We do not use third-party advertising, behavioral profiling, or cross-site tracking cookies.

9. Children's Data, Updates, Supervisory Authorities & Contact

Alpha Journal is strictly for users aged 18 and over; we do not knowingly collect data from minors. We may update this Privacy Policy from time to time by publishing the revised version on this page. If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EU/EEA, you may lodge a complaint with the Data Protection Authority (DPA) in your habitual member state. For all privacy inquiries or rights requests, contact: support@alphajournal.co.uk.