Privacy Policy

Last updated: August 19, 2026

1. Who this policy covers

This Privacy Policy explains what Journex ("we", "us") collects when you use the Journex trade journal and analytics service, why we collect it, and what rights you have over it. Journex is currently operated as a private, invite-only beta by an individual developer based in Thailand, not yet a registered company — that will be updated here once incorporation is complete.

2. What we collect

Account data — the name and email you register with, and a hashed (never plain-text) password.

Trading data — sent from your MT5 terminal by our read-only Expert Advisor (EA) when a trade closes: symbol, entry/exit price, stop-loss/take-profit, profit, open/close time, and derived metrics we calculate (MAE/MFE, R:R, capture efficiency, etc.), plus account-level metadata you provide (broker name, timezone, initial balance, account type). The EA never reads or transmits your MT5 account password, and cannot place, modify, or close trades.

Usage & log data — IP address and timestamps in our server access logs for requests to the app and API, used for security and abuse prevention. Requests to your account's trade-webhook URL are excluded from URL logging, because that URL contains a per-account security token.

AI narration data — if you view an AI-narrated insight, the already-computed statistics behind that insight (e.g. "average MAE 18 points, win rate 61%") are sent to our AI text-generation provider to produce the sentence you read. Raw trade lists and account credentials are never sent to the AI provider — only the aggregated numbers needed to describe that one insight.

3. How we use it

  • To run the dashboards, statistics, and analytics that are the product itself;
  • To generate AI-narrated summaries of your own already-computed statistics;
  • To operate account security — authentication, rate limiting, detecting abuse;
  • To communicate service updates, and, if you ask, to help you with a support issue;
  • To improve the product — for example, understanding which features are used, in aggregate.

4. Who we share it with

We do not sell your data, and we do not use advertising or tracking networks. We share data only with the infrastructure providers needed to run the service, each acting as a data processor on our behalf:

  • DigitalOcean (Singapore) — hosts our API server and database.
  • Vercel — hosts the Journex web app.
  • Cloudflare R2 — stores encrypted daily database backups.
  • Anthropic — generates the text for AI-narrated insights, from the aggregated statistics described in §2 above, under Anthropic's own data-handling terms for API usage.

We may also disclose data if required by law, or to protect the security of the service or its users.

5. Cookies & local storage

Journex does not use advertising or analytics-tracking cookies. Your login session is kept as a token in your browser's local storage (not a cookie), so that you stay signed in between visits. Clearing your browser's site data will sign you out.

6. Where your data lives

Your account and trading data is stored on servers located in Singapore. Encrypted backups are retained for 7 days on Cloudflare R2 before being automatically deleted. If you archive a trading account inside Journex, its trades are moved to a separate archive table rather than deleted — archiving does not currently support restore, so export a CSV first if you might want the data back in its original, active form.

7. How long we keep it

We keep your account and trading data for as long as your account is active. If you ask us to delete your account, we delete your account record and trading data from the live database; a copy may persist in encrypted backups for up to 7 days until that backup cycle expires. We recommend exporting a CSV of your trades before requesting deletion, since deletion cannot be undone.

8. Your rights

Under Thailand's Personal Data Protection Act (PDPA), you have the right to:

  • Access the personal data we hold about you;
  • Correct inaccurate data (most of this you can already edit yourself in Settings);
  • Export your trading data at any time using the CSV export feature in the app;
  • Delete your account and associated data;
  • Withdraw consent you previously gave, where processing is based on consent;
  • Complain to Thailand's Office of the Personal Data Protection Committee (PDPC) if you believe we've mishandled your data.

To exercise any of these rights, email us at the address below.

9. Security

Data in transit is encrypted (TLS/HTTPS). Passwords are hashed, never stored in plain text. Each trading account has its own webhook token rather than one shared secret, and changing your password immediately revokes all previously issued login sessions. As a beta product, some protections common at larger scale — such as two-factor authentication — are not yet built; we track this openly as a known gap and will close it as the product grows beyond a small, invited beta group.

10. Children

Journex is not directed at, and should not be used by, anyone under 18 years old. We do not knowingly collect data from anyone under 18.

11. Changes to this policy

We may update this policy as the service evolves. If we make a material change to how we handle your data, we'll update the "last updated" date below and, where practical, let you know inside the app.

12. Contact

Questions, or want to exercise any of the rights in §8? Email support@journexapp.com.