Privacy Policy

This policy explains what The Pips Project collects, why we collect it, and what you can do about it. It covers our website and the journalling application behind it.

Who is responsible for your data

The data controller (data fiduciary under the DPDP Act, 2023) is the sole proprietorship trading as The Pips Project, based in India. Its legal name, place of business and grievance contact are published on our Business Information page.

Information we collect

Account information

Your email address, and a display name if you set one. We use Supabase Auth for sign-in via Google or an emailed link, so we never handle or store a password of yours.

Trading data

The trades you import (by auto-sync, by file, or by typing them in) along with the accounts they belong to and anything you write about them. Typically: instrument, direction, size, entry and exit price and time, stop and target, commission, swap, and your own notes.

When you use the sync app, it also sends your account balance and equity, your open positions with their stop and target, and your broker's one-minute candles and bid/ask ticks around each closed trade. These power trade replay, the Risk tab and your analysis. Replay files are stored compressed in private storage that only your account can open. The Strategy Lab reads price history from the sync app on your own computer; that history is not uploaded to us.

The NinjaTrader 8 add-on sends the executions (fills) and account balance of the account you choose, once a minute while NinjaTrader is open. When you connect a broker by signing in with it (cTrader or Tradovate), the broker gives us a read-only access token, which we store encrypted and use only to read your trades. You can revoke it from Settings or from the broker at any time.

Usage and device information

Which pages and features you use, and standard technical details your browser sends — IP address, browser and operating system. We use these to keep the service working and to detect abuse, not to build an advertising profile.

How you found us

After you sign up, we ask once how you heard about us; answering is optional and you can skip it. If you arrive from one of our own links (for example a YouTube video description) and create an account from that visit, we also record the campaign tag in that link, such as “youtube” and the video it came from. The tag travels in the web address only; we store nothing in your browser for this. We use both only to see, in total, which channels bring people to The Pips Project.

How we use your information

• To run the service: storing your trades, computing your analytics, syncing your data.
• To generate AI analysis of trades you submit for review.
• To answer your questions to Pip, the AI Mentor. Each question is sent to our AI provider together with a summary of your own journal (statistics, recent trades and today's plan). Mentor chats are stored in your account so the conversation can continue, and you can delete any or all of them at any time from Pip's chat list. Messages that try to misuse the Mentor may be reviewed by us for abuse prevention.
• To send transactional email: sign-in links, risk alerts you switch on, and service notices. Invoices are available in Settings.
• To investigate abuse, fraud, and security incidents.

We do not sell your trading data. We do not share your individual trading performance with anyone, and we do not use your trades to train third-party models.

Auto-sync and your investor password

Automatic sync uses your investor password, which is read-only by design. It lets us read your trade history. It cannot place, modify or close trades, and it cannot move money. Your broker enforces that restriction on their servers — it is not a promise we are making about our own code.

Stored credentials are encrypted at rest, and they are never returned to the browser or included in any response. You can disconnect an account at any time from Settings, which deletes the stored credential.

Data storage and security

• Encrypted in transit with TLS, and at rest by our hosting provider.
• Row-level security in the database, so a query can only ever return the rows belonging to the signed-in user.
• Privileged keys are held server-side only and are never shipped to the browser.
• Sync devices use their own revocable tokens, stored only as a one-way hash, so a leaked token can be switched off without touching your account.

Data retention

We keep your account and trade data while your account is open. If you delete your account, we delete the associated data within 30 days, except where we are required to keep billing records for tax and accounting purposes.

To keep the Free plan fair, we retain two things after deletion: a one-way salted hash of your email address (it cannot be turned back into the address) and the number of trades logged on it, so re-registering the same inbox does not reset the Free limit. We also keep salted hashes of the device identifier described in our Cookie Policy and of the network address you sign in from. These hashes are used only to spot several Free accounts run from one device, are reviewed by a person, and never block anyone automatically.

Your rights

• Export your data at any time.
• Correct anything inaccurate, from your account settings.
• Delete your account and the data attached to it.
• Ask us what we hold about you, and why.

If you are in India, the Digital Personal Data Protection Act, 2023 applies to your personal data, and the rights it grants — access, correction, erasure, and grievance redressal — are available to you through the contact route below. If you are in the EEA or UK, the equivalent GDPR rights apply.

Cookies

We use a small number of cookies, almost all of them essential to keeping you signed in. See the Cookie Policy for the detail.

Third-party services

We rely on a handful of processors to run the service, each receiving only the data needed for its function:

• Supabase: authentication, database and file storage.
• Vercel: hosting of the website and application.
• Razorpay: payments in India. Dodo Payments: the merchant of record for payments from outside India, which also handles sales tax for those payments.
• Anthropic: the AI features (trade review, chart and statement reading, Pip, the Strategy Lab).
• Upstash: rate limiting, which sees an account or device identifier, never trade content.
• Resend: delivering the alert emails you choose to receive.
• Sentry: error reports, configured not to collect personal data and without session recordings.

MetaTrader auto-sync runs through a sync app on your own computer: your MetaTrader password is stored encrypted and is only ever sent to your own paired computer, never to anyone else.

Children's privacy

The service is not intended for anyone under 18, and we do not knowingly collect data from them.

Changes to this policy

We will update this page when things change, and email account holders before any material change takes effect.

Grievance Officer

In line with the DPDP Act, 2023 and the Information Technology Rules we have a named Grievance Officer, identified on our Business Information page. To exercise any of the rights above, or to raise a complaint about how your personal data is handled, email privacy@thepipsproject.com. We acknowledge requests within 48 hours and aim to resolve them within 30 days.

Contact

General questions or requests: email privacy@thepipsproject.com.