Privacy Policy

Last updated: 29 September 2026 · Kalmat Trading Journal (tradeidhazh.com)

1. What we collect

Account data: name, email, hashed password (bcrypt — we never see your plain password).
Trading data: trades you enter, import via CSV, or sync from a broker connection you set up; profiles, challenges, checklists, notes, screenshots you upload.
Broker credentials: API tokens/IDs you save for auto-sync. Secrets and access tokens are stored encrypted (AES-256-GCM), used only against your own broker account, and never shared or shown back to the browser. Your broker account password is never stored by us — connections such as MetaApi hold master credentials on their own infrastructure.
Technical data: standard server logs (IP, timestamps) for security and abuse prevention, and a sign-in history (time, IP address, browser/device type) that you can see in Settings → Security.
Site statistics: anonymous page views on the public pages and the dashboard (page, referring site, campaign tags, mobile or desktop), counted with a daily-rotating hash of your IP address and browser that cannot be reversed or linked across days. No cookies, no tracking across other sites, nothing sent to a third party.
Two-factor sign-in: if you turn it on, the authenticator key is stored encrypted and recovery codes are stored only as one-way hashes.
Payments: when paid plans open, card/UPI details are entered on Razorpay's checkout and never reach our servers; we keep only the subscription status.
Push subscriptions: a device endpoint if you enable notifications.

2. What we do with it

Provide the service: journaling, analytics, alerts, notifications, community features and order routing you initiate. We do not sell your data, show third-party advertising, or share your trading history with anyone except as needed to operate the service (see below).

3. Third-party processors

Hosting: Amazon Web Services (Mumbai region).
Charts/market data: TradingView, Yahoo Finance, Binance, CFTC public data — these receive standard request metadata, not your journal contents.
Email delivery: Zoho Mail / Resend (transactional emails such as password resets and alerts).
Broker connectivity: MetaApi (for MT4/MT5 sync), Spotware's cTrader Open API (when you connect cTrader — you log in on cTrader's page and Kalmat stores only encrypted login tokens and your account numbers) and the Indian broker APIs you connect (Zerodha, Dhan, Upstox, Angel One, Fyers) — these process your trades on your instruction.
Payments: Razorpay (subscriptions), once paid plans are switched on.
Sign-in with Google (optional): if you choose it, Google handles the sign-in and gives us your name, email address and a Google account identifier, which we store so we recognise you next time. Google's handling of your data is covered by Google's own privacy policy. Email-and-password sign-in never involves Google.
AI features: trade statistics or news headlines may be sent to Anthropic's API to generate summaries when you use AI features; no credentials are ever included.

4. Community content

Trade Ideas and comments are visible to all users and permanent by design (accountability). Anything you attach to a public post (including images) is public.

5. Retention and deletion

Your data is retained while your account is active. Deleting your account: open Settings → Security → Delete my account in the web app, enter your password (and your authenticator code if two-factor sign-in is on) and type DELETE. Your account, trades, notes, screenshots, settings, broker links, Trade Ideas you posted (with the replies under them) and mentor spaces you own are erased immediately, and a confirmation email is sent. If you cannot sign in, email admin@tradeidhazh.com from your registered address and we will do it within 30 days. Daily server backups roll off after 14 days, so deleted data disappears from backups by then.

6. Security

HTTPS everywhere (HSTS), bcrypt password hashing, optional two-factor sign-in with an authenticator app, AES-256-GCM encryption for broker secrets and two-factor keys, sign-in alerts for new devices, per-account lockout after repeated failed sign-ins, "log out all devices", a strict content-security policy, and an access-restricted server with daily backups. No internet service is perfectly secure — use a unique password and turn on two-factor sign-in.

7. Your rights

Access, correct, export or delete your data any time via the app or by emailing us. We comply with India's DPDP Act, 2023 principles for personal data.

8. Contact

admin@tradeidhazh.com