This policy explains how FreeTradingChecklist.online (the “service”) handles personal data. It applies to the marketing site, the authenticated workspace and the public API routes used by the workspace.

The operator of the deployment you use is the controller of the account data described here. Contact details are at the end of this page.

Account data: your email address, password (stored as a hash by the authentication provider, never by this application in plain text), display name, avatar URL if you set one, timezone and optional trading-experience note.

Workspace content: watchlists and their symbols, saved scanner strategies, checklist templates and runs, trade records (including prices, fees, notes and timestamps), analysis notes, alert definitions, backtest parameters and results, and notifications generated for you.

Uploaded files: if a deployment enables screenshot upload, images you attach to a trade in the private trade-screenshots storage bucket. The bucket is access-controlled per user.

Communications: messages you send to support, including the email address and any information you choose to include.

Preferences: theme, reduced-motion preference, base currency, timezone, default risk settings and similar interface choices. Some are stored in your account; the collapsed state of the desktop sidebar is stored only in your browser.

Authentication data: session cookies, refresh tokens and timestamps needed to keep you signed in and to protect your account. Supabase Auth issues and validates these credentials.

Technical logs: the hosting provider and authentication provider may record request metadata such as IP address, user agent, timestamps, status codes and error details for security, debugging and abuse prevention.

Market-data requests: symbols, timeframes and chart ranges you request. These requests are sent from the application server to public Binance endpoints. Your email, journal entries and notes are not sent with them.

To create and authenticate your account, keep you signed in and secure the service against abuse.

To store and display the workspace you create, calculate journal and risk figures, run scans and simulations, and deliver alerts and notifications you configure.

To respond to support requests, diagnose failures, comply with legal obligations and enforce the terms of use.

We do not use your journal, notes or trading records to train advertising profiles, and we do not sell personal data.

The application uses strictly necessary authentication cookies set through Supabase's server-side auth helpers. Without them you cannot stay signed in. They are not advertising cookies.

The browser stores a theme preference under the key “theme” and the desktop sidebar state under “ftc:sidebar”. These are local-storage values, not cookies, and they stay on your device until you clear site data.

The application as shipped does not include third-party analytics, advertising pixels or behavioural tracking. If an operator adds analytics, this page must be updated before that deployment goes live, and any consent required by law must be collected first.

Supabase provides authentication, the Postgres database and file storage. Account and workspace data is stored in the Supabase project configured by the operator.

The hosting provider serves the application and may process request logs as described above.

Binance public market-data endpoints receive requests for public candles, tickers, funding rates and open interest. They do not receive your account identity or workspace content from this application.

Email delivery for verification, password reset and account notices is handled by the email service configured in the Supabase project.

We may disclose data if required by law, to protect rights or safety, or in connection with a reorganisation of the service, subject to appropriate safeguards. We do not otherwise share your workspace content with other users or advertisers.

Cloud providers may process data in a region chosen by the operator, which may be outside your country. Where required, the operator is responsible for putting appropriate transfer safeguards in place and for reflecting them in this policy.

Account and workspace data is kept while your account is active. You can delete individual trades, notes, alerts, watchlists and saved runs from the workspace at any time.

You can request account deletion from the account page. When deletion completes, the authentication record is removed and related profile, preferences, watchlists, strategies, checklist data, trades, notes, alerts, evaluations, notifications and backtest runs are removed by database cascades. Uploaded files are removed with the account.

Some records may persist for a limited period in provider backups, fraud-prevention logs or legal hold records. Those copies are not used for normal product operation and expire under the provider's backup schedule.

Deleting your account is permanent. Export any journal data you need first using the CSV export in the journal.

Workspace tables use Postgres row-level security so queries are scoped to the authenticated user. Server actions re-check the signed-in user before writing. Storage policies scope files to the owner's folder.

The service-role key is read only in server-only code and is never sent to the browser. The application does not ask for exchange API keys and cannot place orders.

Data is encrypted in transit between your browser and the application. Encryption at rest, backup frequency and regional hosting depend on the operator's Supabase and hosting configuration.

No system is perfectly secure. Use a unique password, keep your email account protected and contact support if you suspect unauthorised access.

Depending on where you live, you may have the right to access, correct, export, restrict or object to processing of your personal data, and to delete your account. You may also have the right to complain to a data-protection authority.

You can correct profile details and preferences in settings and export trade history as CSV from the journal. For a copy of other account data or a request that is not self-service, contact support from the email address on the account.

We may need to verify your identity before acting on a request. We will respond within the period required by applicable law.

The service is intended for people aged 18 or older. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. Contact support if you believe a minor has created an account.

This policy may change as the service or its providers change. The effective date at the top of the page will be updated, and material changes will be surfaced in the product where practical.

Privacy questions and requests: support@freetradingchecklist.online. Do not send passwords, private keys, seed phrases or card details by email.