Privacy and Cookie Policy
Under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) · Last updated: 14 October 2026
1. Data Controller
The controller of the personal data collected through the website voltrade.space and its application is Tommaso Capello (“Voltrade” or the “Controller”).
For any request, question or to exercise your privacy rights, write to: privacy@voltrade.space.
2. Categories of Data and Purposes
We only collect the data strictly needed to run your journal, compute your statistics and keep your account secure. Specifically:
Account Data
Email address and login credentials. Your password is never stored in plain text: Supabase’s authentication system keeps only an irreversible cryptographic hash of it.
Trading Data (SMC Journal)
Trade date (saved in your browser’s local time zone), killzone (London, NY AM, NY PM, Asia), direction (long, short), R risked, outcome, R result, emotional state and free-text notes. If you fill them in, the name you give the setup and the instrument traded are stored too, as text you write. These data are used only to compute your confidence intervals (Wilson method) and the estimated cost of losing streaks.
Screenshots and Broker Charts
The chart images you upload with a trade are stored in a private storage bucket (trade-images). Plainly stated: screenshots may show parts of your broker’s interface, including account balance or position size. These files are not public: only you can open them, through signed links that expire, protected by Row Level Security rules.
Broker Statements in the Calculator
If you drop a broker statement, or a CSV or Excel file of your own trades, on the home page or into the calculator at /calc, the file is read inside your browser and is never sent to our servers. Only the resulting counts (decided trades and wins) are recorded, as the usage event described below.
The Journal Without an Account
You can use the journal at /app without an account. The trades you log that way are kept in your browser’s local storage, on your device, and are not sent to our servers. The usage events described below are still recorded, with no account attached. When someone signs in to an account from that browser, they are asked whether those trades are theirs: with a yes the trades are copied into that account and removed from the guest copy, with a no they stay in the browser and nothing is added. Until then, clearing your browser data deletes them and we have no copy to give back.
Security and Rate Limiting
IP addresses and timestamps of login and password-reset attempts, in the rate_limit_attempts table. They are kept briefly (a rolling window of 15 to 60 minutes) for the sole purpose of stopping brute-force attacks and abusive access.
2FA Recovery Codes
If you turn on two-factor authentication, we store only the SHA-256 hash of your recovery codes, in the mfa_recovery_codes table. The codes themselves are shown only to you, once, when they are generated.
Usage Events and Product Metrics
We record essential events (for example, use of the calculator or saving a trade). The link between an event and your account uses an on delete set null constraint: if you delete your account, the personal link is removed and the event stays fully anonymous, for aggregate analysis and software stability.
3. Legal Bases for Processing
- Performance of a contract (Art. 6.1.b GDPR): providing the journal, storing your trades, computing your statistics and managing authentication.
- Legitimate interest and security (Art. 6.1.f GDPR): defending against attacks and preventing abuse, dictionary and brute-force attacks through short-lived rate-limiting checks.
- Explicit consent (Art. 6.1.a GDPR): for the images (chart screenshots) you choose to upload.
4. Recipients and Service Providers
Your data are never sold or handed to third parties for advertising. To run the infrastructure we rely on the following providers, compliant with European regulations:
- Supabase Inc.: PostgreSQL database, authentication and file storage. The database servers are located in the European Union (Frankfurt / EU Central region).
- Vercel Inc.: frontend hosting, edge routing and serverless compute.
- Google LLC (Google Identity): used only if you choose to log in with your Google account.
- Cloudflare Inc. (Turnstile): the anti-bot check on the sign-up and login forms. Its script runs in your browser and sees your IP address.
- Resend / SMTP provider: for transactional service emails (address confirmation and password recovery).
5. Where Data Are Kept, and for How Long
Data are kept on servers located in the European Union. Your journal data stay active for as long as your account is open.
Temporary security records (failed login attempts) expire automatically at the end of their window (15 to 60 minutes). Automatic database backups are managed by the Supabase infrastructure for up to 7 days for disaster recovery, after which they are overwritten.
6. Your Rights (Articles 15–22 GDPR)
Under the GDPR you keep full control of your personal data. You can exercise these rights directly:
/app/account by typing “DELETE”. The system automatically removes all your trades, deletes every screenshot from the storage bucket, deletes your 2FA codes, clears your rate-limit records and deletes your user record. The operation is immediate and irreversible.7. Data Protection Officer (DPO)
Under Art. 37 GDPR, Voltrade is not required to appoint a Data Protection Officer: its processing does not involve regular and systematic monitoring of data subjects on a large scale, nor special categories of data or data relating to criminal matters. For any privacy question you can contact the Controller directly at privacy@voltrade.space.
8. Cookies and Tracking Tools
Voltrade uses no profiling cookies, no advertising trackers and no third-party analytics (no Google Analytics, no tracking pixels, no marketing SDKs).
We only use strictly necessary technical storage:
- Session and authentication cookies: managed by Supabase to keep your login session secure, validate access tokens and prevent Cross-Site Request Forgery (CSRF) attacks. Without them, the private area cannot work.
- Your browser’s local storage: an offline copy of your journal, so it stays readable without a connection, and short-lived links to your screenshots, both cleared when you log out; plus the risk per trade and max drawdown you set in the survival panel (
voltrade.risk). They stay on your device and are not used to track you.