Privacy Policy

1. Who we are

Pipsfolio is a forex trading journal operated by Pipsfolio (Pipsfolio, we, us). This policy explains what personal data we collect when you use the Pipsfolio web app, why we collect it, how long we keep it, and the choices you have.

Privacy questions and requests: support@pipsfolio.com.

2. What we collect

• Account — your email address, your name, and your password. Passwords are stored only as a bcrypt hash; we never store your original password.
• Google sign-in — if you register or sign in with Google, we receive your email address, your name, and your Google account identifier (the sub claim).
• Preferences — your language, your currency, and the account balance you enter so the app can calculate risk.
• Trading journal — the trades you log, your monthly targets, and your notes.
• Marketing attribution — the source, medium and campaign you arrived from, and the referral variant you were shown.
• Analytics — anonymous visitor events. Google Analytics 4 loads only if you accept analytics in the consent banner.
• Email — delivery logs and unsubscribe status for the emails we send you.
• Push notifications — only if you turn them on; we store the browser push endpoint you register.
• Phone number (optional) — only if you give it to us. We do not send SMS and we do not use it for marketing.
• Trading account preferences — your account currency (USD/USC), the account balance you enter so the app can calculate position size, and your preferred primary instrument.
• Consent record — the date and the version of the Terms of Service you accepted when you registered (compliance evidence).
• Device and connection signals — when you register, or when you start signing up with Google, we record your IP address, your browser’s user-agent string, and a device fingerprint: a random identifier kept in your browser’s local storage, combined with basic browser properties (user-agent, platform, language, screen size, colour depth, time zone and CPU core count) and hashed with SHA-256. We use it only to spot trial abuse — several trial accounts created from the same device — and it never blocks anyone automatically: it is a flag for us to review. It is not a cookie, it is not shared with third parties, and it is not sent with any other request.

3. Cookies

We use one essential cookie to keep you signed in:

• pipsfolio_session — your session. It lasts 14 days, is HttpOnly (not readable by JavaScript) and SameSite=Lax.

Analytics cookies are set only after you accept analytics in the consent banner. If you decline, no analytics cookie is set. We do not use advertising cookies.

4. How we use your information

• provide your account and keep it secure (sign-in, session, abuse prevention);
• show your own journal, statistics and risk numbers back to you;
• send transactional email, such as account and security messages;
• improve the product using aggregate, anonymous usage data.

We do not sell your personal data, and we do not use it for advertising.

5. Google Sign-In

If you sign in with Google, we receive your basic profile information (your name, email address, and a Google account identifier). We use it only to create and authenticate your account. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Pipsfolio’s access at any time from the third-party access page of your Google Account.

6. Third parties

• Google — Sign-In, and Analytics only with your consent.
• Railway — hosting for the application and its database.
• Our SMTP email provider — delivers transactional email on our behalf.
• Market data providers — supply news and economic calendar data; no personal data is sent to them.

We do not sell your personal data.

7. Payments

Payments are not enabled yet. Pipsfolio has no active checkout and no card details are collected today. When payments are enabled, a third-party payment processor will handle the transaction and we will not store your card number.

8. Data retention

We keep your data for as long as your account is active. After you delete your account we keep records for a reasonable period where we need them for legal, accounting or administrative purposes, and then we delete or anonymise them.

9. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you;
• ask us to correct data that is wrong;
• ask us to delete your data;
• receive a portable copy of your data;
• withdraw your consent to analytics at any time;
• object to how we process your data.

You can export your journal at any time from Profile → Your data (CSV file or full backup). To delete your account, email support@pipsfolio.com from your account address — we will delete the account and its journal data. The same address handles every request in this section.

10. Children

Pipsfolio is a trading journal for adults. It is not intended for anyone under 18, and we do not knowingly collect data from children.

11. Changes to this policy

We update this page when our practices change and revise the “Last updated” date above. If a change is material, we tell you in the app or by email.