Privacy policy

Last updated: [GO-LIVE DATE] · This is a translation; the French version prevails.

In short: your journal is on your Auction Edge account, online (auctionedge.app/app), whatever your plan. The extension sends it your trades and the pictures of your charts. The data is stored in the European Union. We never sell, rent or share your data, and we never use it for advertising.

Data controller

Ethan Papagno, sole trader, [ADDRESS], France. Contact: [EMAIL].

The website

The website uses no advertising cookies, no analytics and no trackers. It is hosted by Cloudflare, which processes technical connection data (IP address, browser) to serve the pages and protect them against attacks.

Your account

• What we keep: your email and your password as a fingerprint (salted PBKDF2-SHA256, never the password itself). For your safety, the list of your signed-in devices (date, browser type) and your last 20 sign-ins (date, browser type, country), shown in “My account”. A session lasts 30 days.
• Against abuse: the IP address of each request is used to count attempts (sign-ups, wrong passwords) for a few hours at most; it is not kept beyond that.
• Emails: we only send emails about your account (address confirmation, forgotten password, change alert, welcome after a purchase, end of subscription). No newsletter, no advertising.

Purchases

Payment on the site, invoicing and subscriptions are handled by Stripe (stripe.com), which receives your payment details. We never see your card. We receive your email, your country, your plan, your subscription status and its end date from Stripe, to open your account, manage your licence and answer you. The purchase is linked to the account with the same email address, once that address is confirmed. Orders placed on Whop (whop.com) are handled the same way by Whop. This data is kept while your subscription is active, then for as long as accounting obligations require (10 years for invoices).

Your online journal

• What is kept: your trades and their measures, notes and pictures (added by hand or taken automatically by the extension at the end of a trade), your strategies, tags, rules, session plans, notes, goals, prop firm settings, Lab scripts and rules, your “My business” tracking (expenses, payouts), the name you gave Jarvis.
• What is never sent: your AI and voice keys, your platform logins and sessions, your Copilot conversation history.
• Where: in a Cloudflare D1 database and a Cloudflare R2 storage space (for the pictures), located in the European Union. Traffic is encrypted (HTTPS). Each picture has a secret address that cannot be guessed. In the browser where you open it, the journal is also kept (IndexedDB) so it opens faster. The database is backed up continuously by Cloudflare (it can be restored up to 7 days back).
• Why and on what basis: only to provide the journal you bought (performance of the contract). We do not read your trades, unless you ask us to help you (support).
• How long: as long as your account exists. “My account → Delete my account” erases your account, your online journal, your pictures and your sessions immediately.
• End of subscription: access stays open until the end of the paid period. Then your journal stays readable (read-only) and exportable for 90 days (an email at the end, then 7 days before), after which the online journal and its pictures are deleted. Your account (email, password fingerprint) stays until you delete it.

The extension

• Sign-in: you sign in to the extension with your account (or your licence key). About once a day, it sends your key and a random identifier of your browser to our server, which checks the subscription with Stripe or Whop; the identifier limits a key to two browsers.
• Platforms: on Tradesea and TopstepX, the extension reads your closed trades, read-only, with your own session, and sends them to your online journal. It never places an order.
• Chart pictures: at the end of a trade, the extension takes a picture of the trading chart on screen (TradingView, Tradesea or TopstepX, never another site) and sends it to your journal. You can turn this off in the extension's window.
• Trading Buddy runs in your browser; its settings stay in the extension.
• Public information: the extension reads the public economic calendar (nfs.faireconomy.media) and public news headlines (FinancialJuice). No personal data is sent to these sites.

Copilot (AI) and voice

These features are optional and use your own key: Mistral, Anthropic (Claude) or Groq for the Copilot, ElevenLabs for the voice. When you ask a question, the journal sends it directly from your browser to the provider you chose, with the data you allowed in its settings (trades, rules, news, notes). Nothing goes through our servers. Your key stays in your browser. These requests are governed by the chosen provider's privacy policy.

Processors and transfers

• Cloudflare, Inc.: hosting of the website, the server, the database and the pictures (journal data stored in the EU).
• Stripe Payments Europe, Ltd. (Ireland): payments on the site, invoices and subscriptions.
• Whop, Inc.: payments, subscriptions and licence keys of orders placed on Whop.
• Resend, Inc.: sending the account emails (your email address and the content of the email).

Cloudflare, Whop and Resend are based in the United States. Any transfer outside the European Union is covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.

Your rights

You can ask for access to, correction, deletion or portability of your data, or object to its processing, by writing to [EMAIL]. We answer within one month at most. You can also do it yourself: “My account” on auctionedge.app/app to change your email or password, see your devices and delete your account; “My data → Back up” for a full copy of your journal (JSON file), and the CSV export of your trades. You can also file a complaint with the CNIL, the French data protection authority (cnil.fr).

If this policy changes in an important way, we will tell you by email before the change applies.