Privacy Policy

Who we are

RuleTrade AI (“RuleTrade”, “we”, “us”) operates the discipline platform available at ruletradeai.com and the Android app RuleTrade AI. This policy explains what personal data we collect, why we collect it, and the rights you have over it.

Contact: support@ruletradeai.com

What we collect

• Account data — email, display name, hashed password (bcrypt). If you use Google Sign-In, we also receive the email and display name Google shares with us.
• Trading data — the constitutions, planned trades, journal entries, screenshots, and preferences you create inside the app.
• Broker connection data — OAuth access & refresh tokens for cTrader when you connect a broker account. We never receive your broker password.
• Payment data — subscription state (plan, expiry). Card details are handled entirely by Razorpay and never touch our servers. We only store the Razorpay order/payment ID.
• Product analytics — pageview / feature-usage events via PostHog(identified only after you sign in). Used to understand which flows help traders stick to their rules.
• Technical data — IP address, user-agent, and standard request headers, used for security & abuse prevention.

Third-party processors

We share the minimum data needed with:

• Razorpay — payment processing. Governed by Razorpay’s privacy policy.
• Resend — transactional email delivery (password resets, receipts).
• Google (OAuth & FCM) — sign-in only. We never post to your Google account.
• cTrader (Spotware) OpenAPI — broker sync only when you explicitly connect an account.
• PostHog — product analytics.
• Emergent — our hosting, object storage (for journal screenshots), and Google-OAuth broker.

How we use your data

• To run the service — validate trades, store your journal, calculate analytics.
• To authenticate you securely (HTTP-only, SameSite cookies with a signed JWT).
• To notify you in-app when your rules are broken or a subscription event occurs.
• To improve the product using anonymised, aggregated usage patterns.

We do not sell your data, we do not advertise, and we do not use your trades or notes to train machine-learning models.

Cookies and local storage

• Authentication cookie — an HTTP-only, Secure, SameSite cookie holding a signed JWT so you stay signed in. Required for the app to work.
• Theme preference — stored in local storage under ruletrade-theme.
• PostHog session cookie — anonymous session identifier.

Data retention

We keep your account and trading data for as long as your account is active. If you delete your account, we permanently erase your data within 30 days, except where we are legally required to retain records (for example, tax records tied to payments).

Your rights

You can, at any time:

• Access, export, or correct your data — through Settings → Export, or by emailing support@ruletradeai.com.
• Delete your account — through Settings → Delete account, or by email.
• Revoke a broker connection at any time — Broker sync → Disconnect.
• Complain to your local data-protection authority.

Security

All traffic is served over TLS 1.2+. Passwords are hashed with bcrypt. Broker OAuth tokens are stored server-side and never exposed to the browser. We follow the principle of least privilege for every third-party integration.

Children

RuleTrade AI is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will remove it.

Changes to this policy

When we make material changes, we will notify you in-app and update the “last updated” date at the top. Continuing to use RuleTrade after the change means you accept the revised policy.