Privacy Policy – Tradoloom

Version 3.0 · Last updated: 14 October 2026

1. Controller

Denis Erk – Tradoloom, c/o POSTFLEX PFX-948-380, Emsdettener Straße 10, 48268 Greven, e-mail [email protected] (further details in the legal notice). We have not appointed a data protection officer because there is no obligation to do so.

2. What this policy applies to

To the website tradoloom.com, the web app app.tradoloom.com, the iPhone app “Tradoloom” and the newsletter “Der Plan-Check”.

We have not yet introduced some of the features described here: the additional statistics with consent on the website (section 3), the storage of campaign identifiers in your account (section 3), newsletter sign-up with Cloudflare Turnstile (sections 8 and 11) and purchases on the web via Stripe (sections 7 and 12). Until they are introduced, the respective processing does not take place.

3. Visiting the website

Hosting: The website and app are hosted by DigitalOcean, LLC in the Frankfurt am Main data centre.
Cloudflare: All requests pass through Cloudflare, Inc. (network, protection against attacks, access protection). In the process, Cloudflare processes technically necessary connection data such as IP address, time, requested address, browser identifier and referrer. Legal basis: legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).
Server logs: Our servers do not store access logs containing IP addresses. Technical error logs are continuously overwritten and deleted after 90 days at the latest.
Referral links: If you access the website via a referral link (address with ?ref=CODE), we pass the code on to registration from this page when you click “Create account”. We do not store anything on your device for this (no cookie).
Audience measurement without consent (server-side): When you open a page or click “Create account”, the App Store link or the template download, our server reports this to Umami, the statistics software we operate ourselves (on our server at DigitalOcean in Frankfurt am Main). In this process, no script runs in your browser and we store nothing on your device. The data transmitted are the page accessed, language, referring website (domain only), campaign identifiers (UTM), the browser identifier (user agent) and your IP address in truncated form only (IPv4 to the first three blocks, IPv6 to the first 48 bits). Umami uses this to create a visit identifier; the value from which it is derived changes daily, and we do not use it to link visits on different days. This produces figures such as visits per page, channel, country and device type. We do not count known bots. Legal basis: legitimate interest in a website that meets users’ needs (Art. 6(1)(f) GDPR). If your browser sends a “Global Privacy Control” or “Do Not Track” signal, we do not count your page views. Retention period: 24 months, after that only totals. Objection: section 13a.
Additional statistics only with consent: At the bottom of the page we ask (text version stat-2026-10-v1): “May Tradoloom also measure how far you scroll, how long you stay and how large your screen is? This helps us improve the website and the path to your account. For this we store a random identifier in your browser (6 months). If you then create an account and agree there again, we link the measurement to your account. Without your consent we only count page views – without a persistent identifier and without storing anything on your device. You can change your choice at any time under “Statistics settings” at the bottom of every page.” If you allow it, we store your choice (tl_consent) and a random identifier (tl_vid) in your browser, each for 6 months, and load the Umami script from our own domain. It measures only scroll depth, time spent on the page and screen size (in rough categories). The reports are sent via our server to Umami; in doing so, we pass on your IP address only in truncated form. If you then create an account, we give the registration a one-time code valid for 10 minutes; only if you agree again there do we link these website statistics to your account, your purchases and your app usage. Legal basis: consent (§ 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act), Art. 6(1)(a) GDPR). If you decline, we only store the refusal (tl_consent=nein), without an identifier. Proof: We log each choice with identifier (if any), choice, text version, time, page and language – without IP address and browser identifier (legitimate interest in proving consent, Art. 7(1), Art. 6(1)(f) GDPR). Withdrawal: at any time via “Statistics settings” at the bottom of every page, as easily as giving consent. We then delete the identifier in your browser immediately and the associated raw data in Umami within 24 hours; only totals without an identifier remain. The withdrawal itself is logged (proof).
No advertising trackers: We do not use pixels from advertising platforms (e.g. Meta, TikTok, Google).
Bot protection: The newsletter form uses Cloudflare Turnstile (section 8).

Campaign identifiers (UTM): If you come to the website via a link with a campaign identifier (e.g. utm_source=instagram), we pass this identifier on to registration when you click “Create account” and store it in your account in order to see which channels lead to registrations. Without an identifier, we only record the page from which you register. We do not store anything on your device for this. Legal basis: legitimate interest (Art. 6(1)(f)).

4. What data we process in the service

Account: e-mail address, name (optional), password (only as a bcrypt hash; not applicable if you sign in only with Apple or Google), whether and when you confirmed your e-mail address.
Sign-in with Apple or Google: the provider’s identifier, the e-mail address transmitted (for Apple, possibly a relay address), for Apple your name once, time of linking and of the last sign-in.
Two-factor: secret key of your authenticator app (encrypted, key stored separately from the database), last used time step, backup codes (only as a hash).
Passkeys: public key and identifier, name assigned by you, synchronisation yes/no, usage counter, timestamps. We never receive private keys or biometric data.
Trading data: trades, executions, accounts, notes, ratings, chart screenshots, strategies with description, rules and daily limits.
Journal and emotion data: journal fields, emotions before, during and after trades, daily check-in (energy, calm, focus, plan), daily notes (including notes on days without trades).
Voice notes: The recording is sent to the speech recognition service (section 6) for conversion into text and is not stored afterwards; the transcript is stored.
Tradovate connection: Only the iPhone app stores login credentials, in your device’s keychain; we receive only order reports and account names.
iPhone app and notifications: device model, platform, times of sign-in and last use, push identifier, notification settings (types, times of day, weekdays, time zone), log of notifications sent (type and time, without content).
Purchases in the iPhone app: see section 10.
Usage and subscription events: see section 10a.
Security log: sign-ins (including failed ones), password, account and admin changes, changes to sign-in methods, each with time, IP address and browser identifier.
Abuse protection: counters for sign-in, code and e-mail attempts per account or IP address (only as a hash).

Note on sensitive information: Emotions, check-in and free-text notes may allow conclusions to be drawn about your well-being. In notes and voice notes, only write what you want to have processed, and nothing about other people.

Mandatory or voluntary? For an account, we need your e-mail address and a way to sign in (password, Apple, Google or passkey); without these, we cannot create an account. All journal, emotion and check-in information, notes, voice notes and screenshots are voluntary; without them, only the corresponding analyses are not available. You can switch off the AI features. We do not make automated decisions within the meaning of Art. 22 GDPR.

5. Purposes and legal bases

Provision of Tradoloom, including the sign-in methods, AI analyses, speech recognition, notifications and transactional e-mails – contract (Art. 6(1)(b) GDPR).
Processing of purchases on the web via Stripe and in the iPhone app via Apple – contract (point (b)); retention of invoices and accounting records – legal obligation (point (c) in conjunction with § 147 AO (German Fiscal Code), § 257 HGB (German Commercial Code)); tracing refunds and preventing improper attribution after an account deletion – legitimate interest (point (f)).
Security, abuse prevention, error diagnosis (security log, rate limits, bot protection, notification e-mails about security-relevant changes) – legitimate interest in secure operation (point (f)); access to browser information for Turnstile is strictly necessary for the service you have requested (§ 25(2) no. 2 TDDDG).
Proof of completed erasure requests – legal obligation (point (c) in conjunction with Art. 5(2), Art. 17 GDPR).
Newsletter – your consent (point (a)); measurement of opens and clicks only with separate consent (§ 25(1) TDDDG, point (a)); proof of consent and unsubscribe flag – legitimate interest (point (f)).

6. AI features and providers

For the AI features, specialised providers process data on our behalf. We do not transmit your account data – name, e-mail address, account names and broker login credentials – as separate data items; if they appear in your notes, voice notes or screenshots, they are sent to the provider together with this content.

Speech recognition (voice note → text): audio recording to Mistral AI SAS, Paris (processing in the EU); only in the event of a disruption, as a fallback, to Groq, Inc., USA.
Automatically fill in journal (from voice note or check-in): transcript to Mistral AI SAS (EU).
Analyses, AI coach and AI chat (trade, day, week, month, emotions, patterns): to Anthropic, PBC, USA. The data transmitted are key figures on your trades, journal and emotion fields, your daily check-in (energy, calm, focus and your plan for the day, possibly as a transcript), your notes, daily notes and transcripts, your strategies with name, description, rules and daily limits and – if available – chart screenshots.

According to the providers, this data is not used to train their models; at Mistral, we have switched off use for training in our account. The providers store it for abuse detection: at Mistral for up to 30 days, at Anthropic for up to 30 days – if a breach of Anthropic’s usage policies is suspected, for up to 2 years –, at Groq not by default.

You can switch off AI processing in the settings at any time: no data is then sent to Anthropic any more and the journal is no longer filled in automatically. Speech recognition continues as long as you record voice notes yourself.

7. Other service providers

DigitalOcean, LLC – hosting of website, app and database in Frankfurt am Main, including server backups.
Cloudflare, Inc. – network, protection against attacks, access protection for the app interface; Cloudflare R2 stores uploaded images (e.g. chart screenshots), accessible via a link that cannot be guessed.
Cloudflare Turnstile – bot protection for sign-in, registration, “Forgot password” and the newsletter form (section 8).
Brevo (Sendinblue GmbH, Berlin) – sending of transactional and security e-mails and of the newsletter.
650 Industries, Inc. (Expo) – delivery of push notifications and of app updates.
Stripe Payments Europe, Ltd. (Dublin, Ireland) – payment processing for purchases on the web. In doing so, Stripe processes name, e-mail address, billing address, payment method data, IP address and device information. Card data and bank details are processed exclusively by Stripe; we receive only a customer and subscription identifier, payment status, invoices and, where applicable, card type and last four digits. For payment processing, Stripe acts partly on our behalf and partly under its own responsibility, in particular for fraud prevention, anti-money laundering checks and its own legal obligations. Stripe’s privacy policy: stripe.com/privacy.
Apple and Google process sign-in via “Sign in with Apple/Google” under their own responsibility; Apple also processes purchases in the App Store (section 10).

8. Cloudflare Turnstile

Turnstile checks in the browser whether a human is using the form. For this purpose, Cloudflare processes your IP address, browser and device information and information about your interaction with the page – on our behalf to protect Tradoloom and, according to its own statements, under its own responsibility to improve its bot detection, not for advertising. We receive only the check result with technical information and store none of it. More: Cloudflare’s privacy notice on Turnstile.

9. Transfers to third countries

Some service providers are based in the USA. The transfer is based on the EU standard contractual clauses (Art. 46(2)(c) GDPR) from the providers’ data processing agreements. If a provider is certified under the EU-US Data Privacy Framework (e.g. Stripe for the transfer to Stripe, LLC), the transfer is additionally based on the adequacy decision of the EU Commission (Art. 45 GDPR); for non-certified providers such as Anthropic and Groq, only the standard contractual clauses apply. You can obtain a copy of the safeguards on request to [email protected].

10. Purchases in the iPhone app

Apple sells subscriptions in the iPhone app via the App Store; only Apple receives payment data, and Apple issues receipts. When you purchase, we pass Apple a random identifier of your Tradoloom account so that we can assign the purchase to your account. From Apple, we receive via the App Store Server API and Apple’s server notifications information about the purchase: product (plan and term), original transaction ID, expiry date, whether a trial period was running, whether automatic renewal is on, grace period, refund or revocation. We do not receive your name, Apple ID or payment data. Apple processes purchase data under its own responsibility in accordance with Apple’s privacy policy.

10a. Usage and subscription events

Payment journal: For each subscription, we store the events relating to purchase and billing (e.g. trial period started, purchased, renewed, plan changed, cancelled, refunded, payment failed) with time, plan, amount and currency as well as the transaction or invoice identifier from Apple or Stripe. Purpose: billing, access, tracing refunds and the settlement of partner commissions. Legal basis: contract (point (b)) and legitimate interest (point (f)). Retention period: 3 years, after that only totals; statutory retention of accounting records remains unaffected (section 12).
Product events: To improve Tradoloom, we record individual steps of use on our server, e.g. registration (with campaign identifier and sign-in method), activation, first import, first journal entry, first AI analysis, limits reached, switch to read-only mode, opening the payment page and purchase attempts or abandonments in the app or on the web (with technical error code). These events are stored with a pseudonymous identifier of your account – without name, e-mail address, IP address or free text. Legal basis: legitimate interest in improving the offering (point (f)). Retention period: 24 months, after that only totals.
Upon account deletion, we anonymise these events: the link to your account, transaction identifiers, referral codes and exact timestamps are removed or coarsened to the calendar week.
You can object to the product events at any time (section 13a).

11. Newsletter “Der Plan-Check”

If you sign up, we process your e-mail address in order to send you the newsletter every two weeks (topics around trading plan, rules, emotions and journal as well as information about Tradoloom features and offers). The legal basis is your consent (Art. 6(1)(a) GDPR).

Sign-up uses double opt-in: you receive an e-mail with a confirmation link; you only receive the newsletter after clicking it. As proof, we store the time of sign-up and confirmation, the form and the version of the consent text.

Measurement of opens and clicks (only with your consent): If you tick the optional box when signing up, we use Brevo with tracking pixels and personalised links to record whether and when you open the newsletter and which links you click and when, and assign this to your e-mail address in order to improve content and sending time (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Brevo stores whether, when and via which form you consented. You can withdraw your consent at any time with effect for the future – via “Nicht mehr messen” (‘stop measuring’) in every newsletter e-mail or by e-mail to [email protected]; you will then continue to receive the newsletter. Without this consent, we measure neither opens nor clicks.

Unsubscribing: at any time via the link in every e-mail. Your account and trial period do not depend on the newsletter; you receive system e-mails (e.g. password reset) regardless.

12. Retention period

Account and trading data: until your account is deleted.
Account deletion: After your confirmation (code by e-mail) or after a deletion by support, the account is blocked for 3 days and then deleted together with its content; during this period, you can cancel the deletion and export. Excluded are the residual data named in this section (backups, security log, deletion record, purchase data), which are retained until the respective deadlines; “without reference to your account” does not mean anonymous here, but without a link to your deleted account.
Server backups: Deleted data may still be contained in backups until these are overwritten in rotation, at the latest after 37 days (we delete backups made before database changes and the daily backups of the website statistics after 30 days; the server backups are overwritten after 7 days). This also applies to raw statistics data after a withdrawal (section 3).
Security log: IP address and browser identifier are removed after 12 months, the remaining entries (type and time) are deleted after 3 years. After an account deletion, they are retained without reference to your account until these deadlines.
Deletion record: time and e-mail address of an account deletion; the e-mail address is removed after 3 years.
Confirmation codes and links: only as a hash, valid for 15 minutes to 24 hours, deleted afterwards.
One-time sign-in verification values: valid for 5 to 15 minutes, deleted one day after expiry.
Apple/Google link, two-factor, backup codes, passkeys: until you unlink, switch off or remove them, at the latest until account deletion.
Proof of consent for statistics (section 3): until the end of the third calendar year after the consent ends, then deleted (monthly, at the latest after around 5 years).
Abuse protection counters: effective for one hour at most, deleted at the latest one day after the end of the counting window.
iPhone app sign-ins: expire after 60 days without use, at the latest after 12 months; deleted 30 days later together with the push identifier and notification settings. Log of notifications sent: 30 days.
Purchases in the iPhone app: subscription record until account deletion; notifications from Apple (raw data) 90 days after processing. After an account deletion, the subscription record is retained without reference to your account (only Apple’s transaction ID, product, dates, refund status) until 13 months after account deletion or the end of the term (whichever is later).
Transactional and security e-mails: Brevo deletes sending logs after one month; neither we nor Brevo store the content of e-mails sent.
Newsletter: e-mail address until you unsubscribe; unconfirmed sign-ups after 30 days (the confirmation link expires at the same time); proof of consent for the duration of the subscription and thereafter until the end of the third calendar year after unsubscribing, in the event of a legal dispute until its conclusion; after you unsubscribe, your e-mail address remains stored at Brevo with an unsubscribe flag so that we no longer send you any newsletter; we check annually whether this is still necessary.
Purchases on the web: subscription data until account deletion; invoices and accounting records 8 years, commercial and business letters 6 years, in each case from the end of the calendar year (§ 147 AO, § 257 HGB); at Stripe according to its retention periods.
Newsletter measurement data (opens, clicks): until you withdraw your consent to measurement or until you unsubscribe; after that, we do not collect any new measurement data and delete the existing data. If you continue to receive the newsletter, your contact remains stored for that purpose.
Uploaded images in R2: until the trade or your account is deleted.

Statutory retention obligations remain unaffected.

13. Your rights

Access (Art. 15) and data portability (Art. 20) – in the app under Settings → Privacy → Export (JSON).
Rectification (Art. 16) – directly in the app.
Erasure (Art. 17) – Settings → Privacy → Delete account.
Restriction (Art. 18) and objection (Art. 21), in particular to processing based on legitimate interests; you can switch off AI processing in the settings.
Withdrawal of consent (Art. 7(3)) at any time with effect for the future (newsletter, measurement); the lawfulness of processing carried out up to that point remains unaffected.
For all requests, an e-mail to [email protected] is sufficient; the functions in the app are only an additional route.
Complaint to a data protection supervisory authority (Art. 77), e.g. to the authority responsible for us, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).

13a. Your right to object (Art. 21 GDPR)

If we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process this data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Website statistics and product events (sections 3 and 10a): You do not need to give reasons here. An informal e-mail to [email protected] is sufficient. After that, we do not record any further events for your account; we delete events already recorded or separate them from your account. Website statistics without consent do not use a persistent identifier, so we cannot attribute individual visits to you. To ensure that your page views are not counted in the first place, activate “Global Privacy Control” or “Do Not Track” in your browser (section 3).

We will provide you with the balancing of interests on request.

14. Cookies and local storage

Web app: technically necessary session cookie for sign-in (httpOnly, Secure, SameSite=Lax; 24 hours or 30 days with “Stay signed in”); during sign-in with Apple or Google, two short-lived cookies for the return redirect (10 minutes at most).
Website: no cookies; only if you consent to or decline “Statistics” in the notice window, tl_consent and, if you consent, tl_vid (6 months each, section 3).
Turnstile runs in an embedded Cloudflare frame and, according to Cloudflare, does not set any cookies for advertising or analytics.
The display mode you have chosen (light/dark) is kept in your browser’s storage.
No advertising trackers. Audience measurement (section 3) works without cookies; statistics cookies only with consent. There are no cookies in the iPhone app; sign-in uses a key in the iOS keychain. The app contains no analytics, advertising or tracking tools and does not use an advertising ID.

15. The iPhone app in detail

On your device (iOS keychain, encrypted, stays on this iPhone and is not transferred to other devices): your Tradoloom sign-in token, the Tradovate credentials, the app lock setting and the status of the last Tradovate sync.
Microphone: only while you record a voice note. The recording is sent to the speech recognition service (section 6) to convert it to text and is not stored afterwards.
Face ID / Touch ID: the app lock and passkeys use the iOS unlock function. Tradoloom receives no biometric data, only the answer “unlocked” or “not unlocked” or the passkey's signature.
Passkeys: passkeys for Tradoloom are bound to tradoloom.com and – if you have set this up in iOS – are synced with your other Apple devices via iCloud Keychain. Apple is responsible for this; we never receive the private key, only the public key, sign-in proofs and the data named in section 4.
Tradovate: the app signs in directly with Tradovate, LLC (USA) and fetches your orders there. Tradovate's privacy policy applies to this. Our servers are not involved in the sign-in.
Notifications: for push notifications we pass your device's push identifier and the message text (e.g. “Insight ready”, “3 trades waiting for your journal”, for daily limits the name of the strategy) to Expo's push service; Expo forwards them to the Apple Push Notification service. You can switch off each type individually or all of them in the app under Account → Notifications; without your permission in iOS, no messages are delivered.
Evening check (only if switched on): at a daily random time around your chosen time we send a silent message that briefly starts the app in the background. It then syncs your trades with Tradovate. Afterwards we check whether there are trades without a journal entry today, or whether you didn't trade at all, and send you a message if so.
App updates: the app downloads updates from Expo's servers. Expo processes technically necessary data such as IP address, app version and device type.
No tracking: the app contains no analytics, advertising or tracking tools and does not use an advertising ID.

16. Changes to this policy

We adapt this policy when Tradoloom or the legal situation changes. In the event of material changes, we will inform you in the app or by e-mail.