Privacy Policy

This Privacy Policy explains how PassTraq (“we”, “us”) collects, uses, shares and protects personal data when you use the PassTraq website and app at https://passtraq.com (the “Service”). PassTraq is a trading journal and challenge tracker for futures traders running prop-firm evaluations, with analytics, AI coaching, a trading workbench, historical replay and related tools.

PassTraq is the controller of the personal data described here. For anything privacy-related, email [email protected].

This policy works alongside our Terms of Service, Refund Policy and Risk Disclosure. It is effective October 17, 2026.

We collect the following categories of data. Most of it is data you give us directly.

• Account data: email address, display name or username, and your password (stored only as a hash by our authentication provider — we never see the plain-text password).
• Sign-in with Google or Microsoft (optional): if you choose to sign in with one of them, it shares your email address (and whether it has verified it), your name, your profile picture and an account identifier with us. We use them only to sign you in and to connect that sign-in to your PassTraq account; you can disconnect it in Settings → Sign-in & security. On the sign-in pages your browser may offer your Google account through Google One Tap, a sign-in prompt shown only if you accepted all cookies; Google learns you are signing in to PassTraq only if you choose to continue.
• Profile and settings: timezone, notification and email-report preferences, whether your public profile is enabled, and similar choices you make in Settings.
• Trading data you import or sync: your prop accounts (firm, account size, balances, drawdown limits) and your trades (symbol, entry and exit prices, quantity, timestamps, P&L, tags, notes and any screenshots you attach), whether they arrive via CSV import, broker sync or manual entry.
• Journals and playbooks: pre-market plans, post-session reviews, setup documentation and anything else you write in the product.
• AI work: what the AI app you connect saves into PassTraq for you (briefs, trade notes, reviews, drawings, alerts, strategies), the log of its calls, and any earlier in-app Finia chats.
• Broker connection identifiers: if you connect a broker for sync or order routing, the broker login you provide and the associated password, which we store encrypted (see Security).
• Billing identifiers: your customer ID at our payment processor, your plan and subscription status. Card numbers are entered directly with our payment processor and never pass through or get stored on our systems.
• Usage and analytics data: pages viewed, features used, in-app events, error reports and session recordings, as described in Analytics and session recording.
• Device and log data: IP address, browser and device type (user agent), and timestamps, collected in ordinary server and security logs.
• Security-relevant event records: for certain sensitive actions — for example accepting the live-trading acknowledgement before real order routing is enabled — we record the IP address, user agent, time and the version of the text you accepted.
• Support correspondence: emails you send us and our replies.

You choose what trading data to import and what to write in journals or AI chats. Please do not put sensitive personal data (health, government IDs, financial account numbers other than what a broker connection needs) into notes, journals or Finia prompts — the Service does not need it.

We use the data above to:

• Create and secure your account and let you sign in.
• Run the Service: store and display your trades, accounts, journals and playbooks; track your prop challenge against its rules; and power the trading workbench, replay and strategy tools on paid plans.
• Compute analytics and statistics (P&L, win rate, drawdown, equity curves, symbol breakdowns).
• Let the AI app you connect read the data you approved and store what it saves for you.
• Send transactional email (email confirmation, password reset, welcome, mentor invitations) and, if you turn them on, optional daily brief and weekly summary reports.
• Bill you, manage your subscription, and handle payment failures.
• Detect and prevent fraud, abuse, unauthorised access and misuse of the Service.
• Understand how the product is used, find and fix bugs, and improve features.
• Respond to your support requests.
• Comply with legal obligations and enforce our Terms.

We do not use your personal data for third-party advertising, and we do not sell it.

Where data-protection law such as the EU GDPR, the UK GDPR or similar regimes applies to you, we rely on the following legal bases:

• Performance of a contract: providing the Service you signed up for, including storing your trading data, generating analytics and AI coaching, and billing.
• Legitimate interests: securing the Service, preventing abuse, keeping records of security-relevant actions, essential product analytics and error tracking, and improving the product — balanced against your rights and expectations.
• Consent: optional processing such as non-essential analytics cookies, session recordings and optional email reports, where consent is required. You can withdraw consent at any time as described in Your rights.
• Legal obligation: keeping billing and tax records and responding to lawful requests.

Where the California Consumer Privacy Act (CCPA/CPRA) or a similar US state law applies, you have the rights described in Your rights. We do not sell or share personal data for cross-context behavioural advertising.

PassTraq runs no AI model of its own and sends your data to no AI model provider. Finia is the AI app you choose to connect to your PassTraq account — for example Claude — signed in with your own account at that provider and running on your own subscription there. You connect it in Settings → API by signing in with PassTraq and approving what it may do (read your data, draw on your chart, draft alerts, work on strategies).

• While connected, that app can read the data you approved — typically your accounts and their rules, trades, journal text and market data from your own broker feed — when you or it asks. What it sends to its provider, and how that provider handles it, is governed by your agreement with that provider, not by us.
• What the app saves back into PassTraq — briefs, trade notes, reviews, drawings, alerts, strategies — is stored in your account like the rest of your content. Every call it makes is logged in Finia › Agent, and you can disconnect it at any time in Settings → API.
• AI output is generated text, not investment advice. See the Risk Disclosure.
• Chats you had with the earlier in-app Finia (before October 17, 2026, when it ran on a model provider we contracted) stay readable in your account until you delete them.

We use a product-analytics service for usage analytics and error tracking. This includes page views, feature events, performance data, error reports and, on some pages, session recordings.

• Session recordings capture how the interface is used so we can reproduce bugs and improve flows. They exclude the trading workbench and replay and mask form inputs; we configure masking so financial figures are not captured where the tooling allows it.
• Events may be associated with your account (email or user ID) so we can trace a bug report back to what happened, and grouped by plan and prop firm to understand which parts of the product matter to which users.
• We also collect anonymous web-vitals (page-speed) measurements through our hosting provider, and an uptime-monitoring service pings our public health endpoints to tell us when the Service is down. Neither receives user data.

Analytics cookies and session recordings are off until you choose “Accept all” in the cookie banner. If you choose “Essential only”, the analytics service runs cookieless (in-memory only, no identifier stored on your device) and no session recordings are made. You can change your choice at any time via “Cookie preferences” in the page footer, and you can additionally block or clear the analytics cookies and localStorage in your browser (see Cookies), or ask us to exclude your account by email.

We use a small number of cookies and browser storage entries:

• Essential: authentication session cookies set by our authentication provider, which keep you signed in and protect your account. The Service cannot work without them.
• Analytics: analytics cookies and localStorage entries that assign an anonymous or account-linked identifier so events and recordings can be tied together. These are only set after you choose “Accept all” in the cookie banner. With “Essential only” the analytics service stays cookieless (in-memory, cleared when the tab closes) and session recordings are disabled.
• Preferences: local storage used by the app itself to remember layout, chart and workspace settings on your device.

The banner itself remembers your choice in a small local-storage entry (ptq-cookie-consent-v1) so we do not ask again; you can change it any time via “Cookie preferences” in the page footer. You can also block or delete cookies and site data through your browser settings. Blocking essential cookies will sign you out; declining or blocking analytics cookies does not affect the product. We do not use advertising cookies.

We share personal data only with service providers that process it on our behalf and under our instructions (“processors”), and only for the purposes below. We do not sell personal data.

• Database, authentication and application hosting — the cloud services that store your account and trading data and run the web application (a managed database and authentication provider, and a hosting provider for the app itself).
• Infrastructure providers — hosting, CDN and virtual servers in the EU and US that run our market-data and order-management services (they handle market data and, for connected users, order traffic and broker sessions), plus an uptime-monitoring service that pings public health endpoints and receives no user data.
• Payment processor — billing, subscriptions and the customer billing portal. It collects and stores your card details directly (PCI-DSS scope stays with it); we only receive identifiers, plan and status.
• Email delivery provider — sends transactional and optional report emails from [email protected].
• Product-analytics service — usage analytics, error tracking and session recordings (only after you accept analytics cookies).
• The sign-in provider you choose (Google or Microsoft) — not our processor: when you sign in with it, you share your identity with us under your agreement with that provider. We send it nothing beyond the sign-in request.
• Your broker and its connectivity provider — not our processor: when you connect a broker account, your broker credentials and order traffic go to that broker’s systems under the agreements you hold with them. We only relay them on your instruction.

We keep an up-to-date list of the specific providers behind each category; email [email protected] if you want it.

We may also disclose personal data:

• if required by law, court order or a lawful request from a public authority;
• to protect our rights, property or safety, or the rights of our users or others, including to enforce our Terms;
• with your direction or consent — for example when you enable a public profile or invite a mentor;
• to a successor if we merge with, are acquired by, or transfer assets to another business, in which case this policy continues to apply until you are told otherwise.

Our processors operate in the United States and the European Union, so your data may be stored or processed outside the country you live in. Where a transfer is subject to data-protection law that restricts it, we rely on the safeguards available for that transfer — such as the processor’s data-processing terms and, where required, standard contractual clauses or an equivalent recognised mechanism.

You can ask us for more detail on the safeguards that apply to a specific processor by emailing [email protected].

We take reasonable technical and organisational measures to protect your data, including:

• Encryption in transit (HTTPS/TLS) between your browser, our servers and our processors.
• Broker passwords encrypted at rest with a secret held outside the database; they are decrypted only to open a connection to your broker on your behalf.
• Passwords stored only as hashes by our authentication provider.
• Database access rules (row-level security) so each user’s data is scoped to their own account, plus records of security-relevant actions such as the live-trading acknowledgement.
• Continuous monitoring of service health and error signals so we notice problems quickly.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your password and broker credentials confidential and for using a strong, unique password. If you believe your account has been compromised, email us immediately.

• Account and trading data is kept for as long as your account is active. If you downgrade to the free Starter plan, your data is kept — nothing is deleted on downgrade.
• On deletion (you ask us to delete your account) we delete your personal data, except what we must retain for billing, tax, accounting, fraud-prevention or legal reasons, or to resolve a dispute. Copies in backups roll off on the backup schedule rather than instantly.
• Billing records (payment-processor identifiers, invoices, subscription history) are kept for as long as tax and accounting rules require.
• Analytics and logs are kept for a limited period governed by our analytics and hosting providers’ retention settings, then deleted or aggregated.
• Aggregated or anonymised data that no longer identifies you (for example overall pass-rate statistics) may be kept indefinitely.

Your data is private by default. If you turn on Public profile in Settings (available on plans that include public profiles), a public profile page and a leaderboard entry become visible to anyone on the internet, showing your display name and username together with trading statistics such as trade count, win rate, average R-multiple, streaks, monthly green/red performance, P&L percentage and whether your trades were broker-synced or self-reported. Public pages show percentages, ratios and counts, not dollar amounts, and never show your email, broker details or individual journal text.

You can turn the public profile off at any time in Settings; the page and leaderboard entry stop being served, though search engines and third parties may retain cached copies for a while.

If you invite a mentor, you are choosing to share read access to your trading data with that person. A mentor you invite can see your accounts, trades, statistics, journals, playbooks, AI insights, challenge progress and your display name inside the mentor dashboard so they can review your trading — not your email address or billing details. Their access is read-only: they cannot change your data or act on your broker connections.

You can remove a mentor at any time from Settings; they lose access going forward. Anything they noted or copied while they had access is outside our control, so only invite people you trust.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data (most profile and trading data you can edit yourself in the app).
• Delete your account and personal data, subject to the retention exceptions above.
• Export your data in a portable format — trades can also be exported as CSV from within the app.
• Object to processing based on legitimate interests, or ask us to restrict it.
• Withdraw consent at any time for processing based on consent, without affecting what was done before.
• Not be discriminated against for exercising these rights.
• Complain to your local data-protection authority if you believe we have mishandled your data.

To exercise any of these rights, email [email protected] from the address on your account. We may ask you to verify your identity before acting. We respond within a reasonable time and, where a statutory deadline applies, within that period.

PassTraq is for adults. You must be at least 18 years old to create an account, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, email us and we will delete it.

We may update this policy as the product and the law change. When we do, we will update the effective date at the top of the page and, for material changes, notify you by email or with a notice in the app before the change takes effect. Continuing to use the Service after a change means you accept the updated policy.

Questions, requests or complaints about privacy: email [email protected].

Related documents: Terms of Service · Refund Policy · Risk Disclosure.