Privacy policy

1. Introduction

Tradestar (“we”, “us”, “our”) operates the tradestar.app website and the Tradestar trading journal and automation platform (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By using Tradestar, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

2. Information We Collect

Account Information

• Email address and name (provided during registration)
• Password (stored as a bcrypt hash; we never store plaintext passwords)
• Avatar image (if uploaded)
• Two-factor authentication secrets (encrypted)

Broker Connection Data

• Broker platform credentials (investor/read-only passwords for MT4/MT5, OAuth tokens for cTrader), encrypted at rest with AES-256-GCM
• Trading account identifiers and account numbers
• Trade history data synced from connected brokers (symbols, prices, volumes, timestamps, P&L)

Automation Data

• Webhook URLs and client secret keys
• Signal routing configuration
• TradingView alert payloads received via webhooks
• Signal execution status and broker confirmations

Usage Data

• Pages visited, features used, and session duration
• Browser type, device type, and operating system
• IP address (logged by Cloudflare for security purposes)

Payment Information

• Subscription status and billing history
• Payment details are processed and stored by Stripe; we do not store your credit card information

3. How We Use Your Information

• To provide, maintain, and improve the Service
• To sync and import your trade history from connected brokers
• To execute and relay automated trading signals via the Tradestar Bridge
• To generate trade analytics, reports, and performance metrics
• To process subscription payments via Stripe
• To send transactional emails (account verification, password resets)
• To detect and prevent fraud, abuse, and security threats
• To comply with legal obligations

4. Data Security

We implement industry-standard security measures to protect your data:

• Encryption at rest: All broker credentials and sensitive data are encrypted using AES-256-GCM with server-side key derivation
• Encryption in transit: All connections use HTTPS/TLS via Cloudflare
• Password hashing: Passwords are hashed with bcrypt (12 rounds)
• Read-only broker access: We use investor/read-only passwords for MT4/MT5 and OAuth scopes that cannot execute trades or access funds
• Rate limiting: API endpoints are rate-limited to prevent abuse
• No credential storage for execution: Tradestar never stores credentials capable of executing trades. The Tradestar Bridge runs locally on your machine

5. Data Sharing

We do not sell, rent, or share your personal information with third parties except:

• Stripe: Payment processing (name, email, payment method)
• Cloudflare: CDN and DDoS protection (IP addresses, request metadata)
• MetaAPI: MT4/MT5 trade sync (investor password, transmitted securely)
• Legal compliance: If required by law, court order, or governmental authority

We never share your trade data, strategies, or performance metrics with any third party.

6. Data Retention

• Active accounts: Data is retained for the lifetime of your subscription
• Cancelled accounts: Data is retained for 90 days after cancellation, then permanently deleted
• You may request data export (CSV) or deletion at any time by contacting support

7. Your Rights

You have the right to:

• Access and export your data at any time via the CSV export feature
• Correct or update your personal information via Settings
• Delete your account and all associated data
• Withdraw consent for data processing (which may require account closure)
• Lodge a complaint with a data protection authority

8. Cookies

Tradestar uses essential cookies only:

• auth_token: Session authentication (httpOnly, secure)
• theme: Light/dark mode preference (localStorage)

We do not use tracking cookies, advertising cookies, or third-party analytics.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. Continued use of the Service after changes constitutes acceptance of the revised policy.