Privacy Policy

Last updated: 10 July 2026

This Privacy Policy explains how Fxtrack Limited ("we", "us") collects, uses, and shares information when you use fxtrack (the "Service"). We aim to keep this readable — if anything is unclear, email privacy@fxtrack.app.

1. What we collect

Account data. When you sign up we collect your email, chosen username, and a hashed copy of your password. We never store your password in plain text.

Profile data. Display name, bio, and public/private preferences that you set in Settings.

Trading data. Trade history you upload (CSV, MT4/MT5 statements) or that we fetch on your behalf via MetaApi.cloud using a token you provide. The MetaApi token is stored encrypted at rest (Fernet symmetric encryption); we can decrypt it only to make requests on your behalf.

Usage data. Basic technical logs: IP address, user agent, and request paths, kept for security and abuse-prevention purposes. We do not sell this data.

Communications. Emails you exchange with us (support, transactional).

Cookies and local storage. We use only functional cookies and browser local storage — no third-party trackers. See "Cookies" below.

2. Why we use it

• To provide the Service — display your analytics, sync with your broker, send weekly digests you opt into.
• To secure the Service — detect abuse, rate-limit signups and logins, investigate incidents.
• To communicate — respond to your messages, send account or security notices.
• To improve the Service — analyse aggregate, anonymised usage to fix bugs and prioritise features.

We do not use your trading data for advertising, sell it to third parties, or share it with brokers, prop firms, or regulators except where legally required.

3. Legal bases (EU/UK users)

Where the GDPR or UK GDPR applies, we rely on the following bases:

• Contract — to provide the Service you signed up for.
• Legitimate interests — security, fraud prevention, product improvement.
• Consent — for optional communications such as the weekly digest, which you can turn off at any time.
• Legal obligation — where we must retain or disclose data by law.

4. Who sees it

You control public visibility. A profile or account is private by default at the individual level. When you toggle "Public profile" in Settings, that content becomes visible to anyone with the link and may appear on public leaderboards.

Sub-processors. We rely on a small set of vendors to run the Service:

• Render.com — hosting and database.
• Resend — transactional email delivery.
• MetaApi.cloud — broker connectivity (only when you connect a live account).

Each vendor processes only the data required for its function and is contractually bound to protect it.

5. Where data lives

Our primary database is hosted with Render.com. Depending on the region you select at signup, your data may be processed in the United States or the European Union. By using the Service you consent to this transfer.

6. How long we keep it

• Account and profile data: for as long as your account exists.
• Trade data: for as long as you keep the parent account.
• Server logs: up to 90 days, then aggregated or deleted.
• Backups: up to 30 days after deletion.

When you delete your account, we delete or anonymise personal data within a reasonable period, except where retention is required by law.

7. Your rights

Depending on where you live, you may have the right to:

• Access a copy of your personal data.
• Correct inaccurate data.
• Delete your data ("right to erasure").
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent (e.g. unsubscribe from digests).
• Lodge a complaint with a supervisory authority.

To exercise any of these, email privacy@fxtrack.app. We will respond within 30 days.

8. Security

We use industry-standard measures to protect your data: HTTPS everywhere, password hashing with bcrypt, encrypted MetaApi tokens at rest, restricted database access, and regular dependency updates. No system is perfectly secure. If you spot a vulnerability, please email security@fxtrack.app.

9. Children

The Service is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a child has provided us data, contact us and we will delete it.

10. Cookies and local storage

fxtrack uses a small set of purely functional cookies and browser local-storage keys:

• fxt_token — your session JWT, kept for as long as you stay signed in.
• fxt_user — your profile snapshot, so the interface can render before the network call returns.
• fxt_theme — your dark/light preference.

We do not use third-party analytics, advertising, or tracking cookies. Because these are strictly necessary for the Service to work, no consent banner is shown.

11. Changes to this policy

If we make material changes we will notify you by email or a prominent notice in the Service before they take effect. The "Last updated" date at the top always reflects the current version.

12. Contact

Fxtrack Limited — [TODO: registered address]. Email us at privacy@fxtrack.app.