Gizlilik Politikası
TADROST Privacy Policy
Version 2026-10-20 · Effective 20 October 2026
This policy explains what personal data TADROST collects, why, and what rights you have.
1. Who we are
The controller is TADROST ("TADROST", "we"). Contact for privacy questions: [email protected].
2. Summary
- We collect what we need to run your trading journal, keep your account secure and meet legal obligations.
- We do not connect to your exchange or broker accounts. We do not receive your API keys, balances or positions.
- We do not store your IP address. We keep only the country it maps to.
- We do not sell your personal data. We do not use your journal or screenshots to train AI models.
- Our servers are in Germany (EU).
- You can export your data and delete your account at any time.
3. What we collect
| Category | Examples | Source |
|---|---|---|
| Account | E-mail address; password (stored only as an argon2id hash); display name; avatar; language, time zone and theme | You |
| Country and eligibility | Declared country of residence; date of birth; full name for sanctions screening; US state if you live in the US | You |
| Location signal | The country code derived from your IP address when you use the Service (the IP address itself is not stored), with its source and time | Your device, via our CDN or our IP-to-country database |
| Journal content | Trades, fills, prices, quantities, costs, results, decisions, notes, tags, strategies, screenshots and other attachments | You |
| Mentor sharing | Who your Mentor is; when sharing started, paused or ended | You and your Mentor |
| Legal records | Which version of each document you accepted, when, and the country policy in force; your consent choices | You |
| Security | Sessions (stored as a hash, with device description and time); sign-in attempts counted per address; security events | Your device |
| Payments (USDT) | Plan, order amount, network, the receiving address we showed you, the blockchain transaction hash, the sending address and the confirmation time as they appear on the public blockchain. We never receive private keys or seed phrases | You, the public blockchain (read through blockchain data providers) |
| Referrals | Which referral link brought you; resulting commissions | Your browser, our payment records |
| Communications | E-mails we send you and their delivery status | Us |
| Usage analytics | Only with your consent: event names (for example "trade created") without notes, financial values or file contents | Your device |
We do not collect GPS location or biometric data. We do not knowingly collect data from children.
4. Why we use it and our legal bases
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Provide the journal, performance analytics, Setups and Mentor sharing | Contract (6(1)(b)) |
| Recognise trades in screenshots you upload | Contract (6(1)(b)) |
| Decide which features are available in your country | Legal obligation (6(1)(c)) and legitimate interest in complying with foreign law (6(1)(f)) |
| Age check and sanctions screening | Legal obligation (6(1)(c)) / legitimate interest (6(1)(f)) |
| Account security, fraud and abuse prevention, rate limiting | Legitimate interest (6(1)(f)) |
| Payments, invoices, tax records | Contract and legal obligation |
| Service and security e-mails | Contract |
| Product analytics and marketing e-mails | Consent (6(1)(a)), which you can withdraw at any time |
| Records of what you accepted and consented to | Legal obligation / legitimate interest (proof) |
Sanctions screening. If a possible match is found, a person on our team reviews it. While the review is open, some features (such as Setups and payments) may be restricted. Your journal stays available. We do not make legal decisions about you based solely on automated processing.
5. AI processing
- Setups. Setups are generated from public market data only. Your personal data and journal are not used to create them.
- Screenshot recognition. When you choose to recognise a screenshot, the image is sent to an AI model through OpenRouter. We use routing that only selects providers offering zero-data-retention and that do not use prompts for training. The extracted values are shown to you, and nothing is saved until you confirm. Unconfirmed results are deleted within 24 hours.
6. Who we share data with
We share personal data only with:
- Service providers (processors) who act on our instructions under data processing agreements:
| Provider | Purpose | Location |
|---|---|---|
| Our dedicated server provider (data centre in Germany) | Server hosting: application, database and its local copies; the provider has no access to the data in normal operation | Germany (EU) |
| Cloudflare, Inc. | CDN, DNS, security, file storage and database backup copies (EU jurisdiction) | Global edge; stored data in the EU |
| Our own e-mail server | Sending e-mails | Germany (EU) |
| OpenRouter, Inc. and the model provider it routes to | Screenshot recognition | United States |
| Blockchain data providers (e.g. TronGrid; BNB Smart Chain, Ethereum, Polygon RPC providers) | Reading public transfers to our receiving addresses to confirm payments. They receive our addresses and transaction hashes, never your name or e-mail | Various; public blockchain data only |
| — (no third party) | Usage analytics are stored in our own database in Germany, only with consent | Germany (EU) |
- Your Mentor, only after you accept their invitation, and only until you withdraw.
- Authorities, when the law requires it.
- A buyer or successor of the Service, under the same protections.
IP-to-country lookups run on our own servers using the DB-IP database (IP Geolocation by DB-IP). No data is sent to DB-IP.
7. International transfers
Our main data stays in the EU. Some providers above are based outside the EU/EEA (for example in the United States). For those transfers we rely on an adequacy decision (such as the EU–US Data Privacy Framework, where the provider is certified) or on Standard Contractual Clauses.
8. How long we keep data
| Data | Retention |
|---|---|
| Account and journal | While your account exists |
| Items in Trash | 30 days, then permanently deleted |
| Unconfirmed screenshot recognition results | 24 hours |
| Country signals | Latest value only, while your account exists |
| Records of legal acceptances | While your account exists; after deletion kept without your name or e-mail address for 180 days for proof |
| Optional consents (marketing, Mentor sharing, analytics choice) | While your account exists |
| Security and audit logs | 2 years |
| Records of denied access | 90 days |
| Product analytics events (only with consent) | 13 months |
| Data export files | Download link 24 hours; file deleted after 7 days |
| Operational logs (no IP addresses, personal data masked) | 30 days |
| Payment and tax records | As required by law; after deletion kept without your name or e-mail address |
| Sanctions screening results with a possible or confirmed match | As required by law; other results are deleted with the account |
| Backups | Overwritten on a 30-day rotation |
Deleting your account. When you ask to delete your account, you are signed out everywhere, Mentor sharing ends (as student and as Mentor) and open payments are cancelled at once. For 30 days you can restore the account by signing in; Mentor connections do not come back. After 30 days your journal, screenshots, profile and settings are permanently deleted. We keep only the records listed above that the law requires, without your name or e-mail address. A paid period is not refunded. Copies in backups disappear within 30 days as backups rotate.
9. Your rights
Depending on where you live, you can ask us to:
- give you a copy of your data — Export in Settings → Privacy provides one ZIP file with all your data as JSON, your trades, fills, costs and decisions as CSV, and your screenshots and attachments (one export per day);
- correct inaccurate data — most of it in Settings; your country through a change request;
- delete your data — Delete account in Settings;
- restrict or object to processing based on legitimate interest;
- port your data to another service; and
- withdraw consent at any time. This does not affect processing done before.
You can also complain to a supervisory authority, for example the authority in your country of residence. To exercise your rights, use Settings or e-mail [email protected]. We respond within one month.
10. Security
- Passwords are hashed with argon2id.
- Sessions and e-mail links are stored only as hashes and can be revoked instantly.
- Traffic is encrypted with TLS.
- Access by our staff is limited and logged.
- Logs do not contain passwords, tokens, notes, file contents or IP addresses.
No system is perfectly secure. We will notify you and the authorities of a personal data breach where the law requires.
11. Cookies
We use the cookies needed to run the Service (sign-in, language, theme, your cookie choice). Only if you choose “Allow analytics” we also set a random device identifier for product analytics. See the Cookie Policy.
12. Changes
We will tell you about material changes in the app and by e-mail before they take effect. The version and effective date are shown at the top of this policy.
IP-ülke verisi sağlayıcısı: DB-IP