1. Scope & Operations
This Privacy Policy describes how EdgeSpine ("we", "us", "our") collects, processes, and stores personal data when you use the EdgeSpine journal application and our marketing landing page.
Our data collection is strictly limited to information necessary to provide, manage, and secure your trading journal. We do not sell your personal data or share it with third parties for marketing purposes.
2. Data We Collect
Depending on your interactions across our web and progressive web application (PWA) interfaces, we collect and process the following categories of information:
- Authentication Credentials: Hashed passwords, email addresses, and OAuth tokens managed securely through our identity provider. We also support WebAuthn / Passkeys for passwordless cryptographic authentication.
- Operator Profile: Optional display names, profile avatar preferences, and discipline rules settings.
- Trading Portfolios & Log: Information about your trading accounts, balances, currencies, setup tags, habits, execution timestamps, execution prices, and individual trade entries. This includes data entered manually or synchronized automatically via brokerage integration webhooks.
- Trade Screenshots & Hashes: Chart image files uploaded to our secure object storage bucket alongside their cryptographic SHA-256 hashes used for deduplication and visual review.
- AI Geopolitical Analysis Cache: Prompt inputs and macroeconomic analysis reports generated by our AI Coach and geopolitical tracking engine.
- PWA Web Push Subscriptions: Cryptographic push notification endpoint URIs and verification keys stored to enable real-time trading alerts and background sync notices.
- Cookie Session Chunking: Authenticated session tokens split across secure, HTTP-accessible cookies to support synchronous resolution and protect against session token exfiltration.
- Telemetry & Consent: Ephemeral diagnostics and analytics, gated entirely by your settings toggle.
3. Data Retention Matrix
We retain your information only as long as necessary to provide service, enforce compliance, or as required by system design.
| Data Category | Storage Location | Retention Period | Deletion Method |
|---|---|---|---|
| Auth Credentials | Secure Identity Service | Until account deletion | Automated cascade delete |
| Profile Data | Database User Profiles | Until account deletion | Automated cascade delete |
| Trading Accounts | Database Portfolio Registry | Until user deletes | Direct user deletion / Account deletion |
| Trades & Setups | Database Trade Logs | Until user deletes | Direct user deletion / Absolute Reset |
| Screenshots & Hashes | Secure Object Storage & Hash Table | Until user deletes | Direct trade deletion / Absolute Reset |
| AI Geopolitical Cache | Database Geopolitical Logs | Until user deletes | Direct cache clear / Account deletion |
| PWA Push Subscriptions | Database Subscription Registry | Until unsubscription | Browser push toggle / Account deletion |
| Rules, Logs & Tags | Database Analytics Registry | Until user deletes | Direct user deletion / Absolute Reset |
| Session Cookie Chunks | Browser Secure Cookie Storage | 30 Days max-age | Direct sign-out / Auto cookie expiration |
| Notes & Notebook | Browser Local Cache | Until cache cleared | Direct UI deletion / Manual browser clear |
| Audit Logs | Database API Traffic Audit | 90 Days | Automated cleanup scheduler |
| Telemetry | Diagnostic Clouds | Per vendor policy | Gated by UI consent toggle |
4. Automated Cleanup
Our backend automatically enforces storage minimization rules. To prevent indefinite storage of personally identifiable metadata:
We run a database scheduled task on the first day of every month at midnight that identifies and purges API logging metadata older than 90 days.
This purges IP addresses, browser User-Agents, and API traffic records older than 90 days, ensuring your footprint is kept to the absolute minimum necessary for security troubleshooting and DDoS protection.
5. Third-Party Processors & Sub-Processors
To operate EdgeSpine with enterprise-grade reliability, security, and artificial intelligence, we partner with vetted, industry-leading sub-processors under strict Data Processing Agreements (DPAs):
- Google Gemini / Vertex AI: Provides generative artificial intelligence processing for the AI Coach and macroeconomic analysis modules. Operator prompts and execution logs are processed securely without being used to train public foundational models without consent.
- Cloudflare: Provides our Content Delivery Network (CDN), Web Application Firewall (WAF), DDoS shielding, and Serverless Edge Functions.
- Supabase: Provides PostgreSQL database hosting, authentication infrastructure, secure object storage, and automated database scheduler routines.
- MetaTrader 5 (MetaQuotes / Brokerage EAs): When configured by the operator, our edge webhook endpoints receive trading execution logs transmitted directly from your MetaTrader 5 terminal.
- Sentry & Microsoft Clarity: Provides exception monitoring and UI diagnostic telemetry. These services are strictly gated behind your client-side settings preference.
6. Your Rights & Choice
EdgeSpine puts you in full control of your personal data, supporting your rights under GDPR (Article 15 - Access, Article 16 - Rectification, and Article 17 - Erasure):
- Access & Export: You can export your entire trading history, setups, and rules from the Settings dashboard at any time.
- Absolute Reset: Wipe all trades, tags, rules, and balances instantly inside the Settings panel while preserving your credentials.
- Account Deletion: You can delete your operator account in the Security tab, triggering a cascade delete that permanently removes all records linked to your user ID from our systems.