Privacy Policy
Updated 14 October 2026
Your journal is yours. Here is exactly what we hold, who it reaches, and how to get it back or get rid of it.
What we collect
Section titled “What we collect”Your account. Username, email, a hash of your password, and when you last signed in.
What you write. Your theses, setups, notes, reviews and conversations with the agent — and the trades themselves, whether you entered them by hand or the harness placed them for you.
Usage. Which models and data services your account used, how many tokens, and what that cost. This is the figure shown back to you in the app.
Technical. Session cookies, and server logs containing IP address and browser string, kept briefly for security and debugging.
Venue credentials, on a connected account. To place orders at a venue on your behalf the service needs that venue’s API credentials, so it stores them — encrypted at rest with AES-256-GCM, used only to read your account state and to place, modify or cancel orders under the permission you set. You can disconnect an account at any time, which removes them.
A journal account needs none of that: it has no venue, so there is nothing to connect and no credentials to store.
We ask for nothing beyond what a connected account needs. Do not paste a key into a note, a thesis or a message to the agent — those are stored as the text you wrote and are not the place for a secret.
Why we process it
Section titled “Why we process it”- To run the service — storing your journal, answering your questions, showing your usage. This is performance of our contract with you.
- To keep it secure and working — logs, abuse prevention, debugging. Our legitimate interest in a service that stays up.
The model providers
Section titled “The model providers”Answering your questions means sending the relevant part of your conversation — and, where you asked for it, the relevant part of your journal — to a language model provider. Which one depends on the model selected for your account.
Those providers process it under their own terms as our processors. We use API access rather than consumer products specifically because the API terms of the providers we use commit to not training on submitted content by default. We do not separately grant any provider permission to train on your journal.
Market data, fundamentals, filings and social archives are fetched from third-party services. Those requests carry the symbol or query, not your identity.
Who else sees it
Section titled “Who else sees it”Nobody, beyond the processors above and the infrastructure that runs the app (hosting, database, object storage). We do not sell personal data, we do not share it with advertisers, and we run no third-party ad or tracking pixels.
We would disclose data if legally compelled. Where we are permitted to tell you, we will.
How long we keep it
Section titled “How long we keep it”Your journal stays until you delete it or close your account — that is the point of a journal, and a record that expires is not one. Server logs are kept for a short operational window. Usage records are kept for billing and capacity planning.
Deleting your account removes your journals, conversations, notes and usage records. Backups age out on their own schedule, within thirty days.
Security
Section titled “Security”Passwords are hashed, never stored recoverably. Credentials the service itself uses are encrypted at rest with AES-256-GCM. Traffic is served over TLS. Backend services are not exposed to the public internet.
No system is perfectly secure. If a breach affects you, we will tell you and the relevant regulator within the time the law requires.
Your rights
Section titled “Your rights”Depending on where you live, you can ask for a copy of your data, correction of anything wrong, deletion, restriction of processing, or portability, and you can object to processing based on legitimate interest.
Write to privacy@tradeharness.xyz. We answer within thirty days. If you are unhappy with the answer you can complain to your local data protection authority.
Children
Section titled “Children”The service is not for anyone under 18. We do not knowingly collect their data, and we delete it if we find we have.
Changes
Section titled “Changes”If we change this in a way that materially affects you, we will tell you in the app before it takes effect rather than only changing the date at the top.