Legal
Privacy Policy
Last updated: 22 Sep 2026 · Controller: HADES · lifeoftrader.cc
1. What we collect
- Account: email, name, password hash (Google sign-in: we store email/name, not the Google token), plan and billing status.
- Trade & journal data: trades you import or enter (symbol, P/L, notes), accounts, strategies, journal entries, mood/discipline/photo/voice notes, feedback.
- Technical: encrypted stateless session cookie for login. No third-party ad trackers. Crypto payments go via CoinPayments / NOWPayments; card payments go via Dodo's hosted checkout (merchant of record) — we never see or store card numbers.
2. Why we process it
- Provide the journal, calendar, Monte Carlo, AI critique and reports (contract).
- Authenticate sessions (legitimate interest / contract) via httpOnly encrypted stateless session cookie.
- Support, security and fraud prevention (legitimate interest).
- Show an on-screen payment receipt at checkout and keep a permanent receipt history under Settings → Billing. We email renewal reminders, security codes and support replies — never marketing without opt-in.
3. AI processing (BYOK)
AI features work out of the box via the platform key — no key required. Free accounts get 5 AI uses in total; paid plans get 10 AI uses per day. You may optionally use your own OpenAI-compatible key (BYOK) for unlimited AI use. When you request an AI report, we send the trade context you selected to the AI provider in use. We do not send your key to anyone else and do not train models on your data.
4. Cookies
We use one essential cookie for login (`trading-journal-session`, httpOnly, Secure in production, SameSite=Lax, Path=/, 30-day expiry) plus a transient `google_oauth_state` cookie during Google sign-in, deleted when sign-in completes. The cookie banner choice (`cookie-consent`) is stored in your browser's local storage by the banner, not as a cookie. See Cookie Policy. No marketing cookies. Product analytics is a cookieless page-view counter (Umami Cloud, EU/US privacy-compliant) recording page views and a few feature events — no cross-site tracking, no data sale.
5. Retention
| Data | Kept for |
|---|---|
| Trades, journals, accounts, strategies, photos/voice notes, feedback | You own this data — kept until you delete it. Deleting a trading account is permanent. Full closure via support email. |
| trading-journal-session | 30 days, then expires automatically |
| Payments & invoices (hades_…) | Kept for tax and accounting even after account closure |
Per-account export is available anytime in Settings (Export / full backup JSON). No backup cron runs server-side — exports are user-side.
6. Sharing & sub-processors
We do not sell your data. We share only with these sub-processors, bound to process only on our instructions:
- CoinPayments / NOWPayments — crypto checkout (BTC/ETH/LTC/USDT/USDC/TRX/BNB/DOGE/XRP).
- Dodo Payments — card/bank checkout and subscriptions (merchant of record; card details stay with Dodo).
- Email provider (SMTP) — renewal reminders, verification/security codes, support replies. No marketing mail without opt-in.
- Google — Google sign-in (we store email/name, never the Google token).
- AI provider in use — receives only the trade context you select, when you generate a report. Your BYOK key (stored encrypted, shown masked, never sent back) is never shared.
- Hosting / database provider — runs lifeoftrader.cc with TLS in transit.
No analytics or ad trackers — we use none. Email, job queue (self-hosted Redis), and card processing (Dodo) touch only what they need to do their job, listed above.
7. Your rights (GDPR + similar)
You may request access, correction, deletion, export, or restriction. Email journal.hades@lifeoftrader.cc with subject “Data Request”. We respond within 30 days. You can also export trades via Settings → Export and delete trades/accounts in-app.
8. Security
TLS in transit on hosted infrastructure, hashed passwords, scoped DB access per user, encrypted stateless session cookie. No system is 100% secure — keep your password and AI key private.
9. International transfers
Hosted infrastructure with TLS in transit; data may be processed in other regions by our sub-processors under SCCs / adequacy where required. Per-account export is available in Settings.
10. Children's privacy
HADES is for adults aged 18 and over. We do not knowingly collect data from children. If we discover a child account, we delete it and its associated data on discovery. If you believe a child has registered, email journal.hades@lifeoftrader.cc.
11. Breach notification
If a personal-data breach affects you, we notify affected users and the relevant authority without undue delay — describing what happened, what data was involved, and what we are doing about it. Contact journal.hades@lifeoftrader.cc for security issues; please do not disclose them publicly until we have had a chance to fix them.
12. California privacy rights
California residents (CCPA/CPRA-style) have the right to know what we collect, request deletion or correction, and opt out of any sale or sharing of personal information. We do not sell or share personal information. To exercise any right, email journal.hades@lifeoftrader.cc with subject “Data Request”. We respond within 30 days and never discriminate against you for exercising your rights.
13. Policy changes
We post updates on this page with a new “Last updated” date. Material changes are noted here. Continued use after the effective date means you accept the updated policy. Prior versions are available on request.
14. Contact & complaints
Controller: HADES — journal.hades@lifeoftrader.cc. You also have the right to lodge a complaint with your local data protection authority.
© 2026 HADES.