Privacy Policy

1. Who this policy covers

This Privacy Policy explains what Journex ("we", "us") collects when you use the Journex trade journal and analytics service, why we collect it, and what rights you have over it. Journex is currently an open beta operated by an individual developer based in Thailand (the data controller), not yet a registered company — that will be updated here once incorporation is complete. It applies to users wherever they are, including the European Economic Area and the UK (see §12).

2. What we collect

Account data — the name and email you register with, and a hashed (never plain-text) password.

Trading data — sent from your MT5 terminal by our read-only Expert Advisor (EA) when a trade closes: symbol, entry/exit price, stop-loss/take-profit, profit, open/close time, and derived metrics we calculate (MAE/MFE, R:R, capture efficiency, etc.), plus account-level metadata you provide (broker name, timezone, initial balance, account type). The EA never reads or transmits your MT5 account password, and cannot place, modify, or close trades.

Usage & log data — IP address and timestamps in our server access logs for requests to the app and API, used for security and abuse prevention. Requests from the EA to the trade webhook are excluded from access logging, and the per-account webhook token travels in a request header that is never logged.

Activity days — the calendar days (UTC) on which your EA sent a heartbeat or a trade, used to run the service status indicators and to determine the beta tester discount described in our Terms.

How you found us — optional, chosen when you sign up, plus the short campaign tag in the link you followed (e.g. ?ref=reddit). Only ever counted in aggregate to see which channels work.

Your time zone — taken from your browser when you sign up, so times and daily statistics are shown in your local time. You can change it in Settings.

AI narration data — if you view an AI-narrated insight, the already-computed statistics behind that insight (e.g. "average MAE 18 points, win rate 61%") are sent to our AI text-generation provider to produce the sentence you read. Raw trade lists and account credentials are never sent to the AI provider — only the aggregated numbers needed to describe that one insight.

3. How we use it

• To run the dashboards, statistics, and analytics that are the product itself;
• To generate AI-narrated summaries of your own already-computed statistics;
• To operate account security — authentication, rate limiting, detecting abuse;
• To communicate service updates and account notices (for example, a notice before an inactive account is removed under our Terms), and, if you ask, to help you with a support issue;
• To improve the product — for example, understanding which features are used, in aggregate.

4. Who we share it with

We do not sell your data, and we do not use advertising or tracking networks. We share data only with the infrastructure providers needed to run the service, each acting as a data processor on our behalf:

• DigitalOcean (Singapore) — hosts our API server and database.
• Vercel — hosts the Journex web app.
• Cloudflare — network protection and routing for our API and domain (traffic passes through Cloudflare), forwarding of mail sent to support@journexapp.com, and storage of encrypted daily database backups (R2).
• Resend — delivers account emails (verification, password reset, account notices).
• Anthropic (United States) — generates the text for AI-narrated insights, from the aggregated statistics described in §2 above, under Anthropic's own data-handling terms for API usage.

Setup video. The setup video on our help, home and setup pages is shown as an image we host ourselves. Nothing is loaded from YouTube until you press play; the video then plays from YouTube's privacy-enhanced domain (youtube-nocookie.com, operated by Google), and YouTube's own privacy policy applies to that playback.

We may also disclose data if required by law, or to protect the security of the service or its users.

5. Cookies & local storage

Journex does not use advertising or analytics-tracking cookies. Your login session is kept as a token in your browser's local storage (not a cookie), so that you stay signed in between visits. Clearing your browser's site data will sign you out.

6. Where your data lives

Your account and trading data is stored on servers located in Singapore. Encrypted backups are retained for 7 days on Cloudflare R2 before being automatically deleted. If you archive a trading account inside Journex, its trades are moved to a separate archive table rather than deleted — archiving does not currently support restore, so export a CSV first if you might want the data back in its original, active form.

7. How long we keep it

We keep your account and trading data for as long as your account is active. If you ask us to delete your account, we delete your account record and trading data from the live database; a copy may persist in encrypted backups for up to 7 days until that backup cycle expires. We recommend exporting a CSV of your trades before requesting deletion, since deletion cannot be undone. During the open beta, accounts that never received a trade may also be deleted when the user limit is reached, after at least 7 days' email notice (see our Terms).

8. Your rights

Under Thailand's Personal Data Protection Act (PDPA) — and, if you are in the EEA or the UK, the GDPR / UK GDPR — you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data (most of this you can already edit yourself in Settings);
• Export your trading data at any time using the CSV export feature in the app;
• Delete your account and associated data;
• Withdraw consent you previously gave, where processing is based on consent;
• Object to or restrict processing based on our legitimate interests;
• Complain to Thailand's Office of the Personal Data Protection Committee (PDPC), or to the data protection authority where you live, if you believe we've mishandled your data.

To exercise any of these rights, email us at the address below. We answer within 30 days.

9. Security

Data in transit is encrypted (TLS/HTTPS). Passwords are hashed, never stored in plain text. Each trading account has its own webhook token rather than one shared secret, and changing your password immediately revokes all previously issued login sessions. As a beta product, some protections common at larger scale — such as two-factor authentication — are not yet built; we track this openly as a known gap and will close it as the product grows.

10. Children

Journex is not directed at, and should not be used by, anyone under 18 years old. We do not knowingly collect data from anyone under 18.

11. Changes to this policy

We may update this policy as the service evolves. If we make a material change to how we handle your data, we'll update the "last updated" date below and, where practical, let you know inside the app.

12. Users in the EEA and the UK (GDPR)

If you use Journex from the European Economic Area or the United Kingdom, the following also applies.

• Controller: the individual developer operating Journex, based in Thailand. Contact: support@journexapp.com.
• Legal bases: performance of a contract — running your account, storing and analysing the trading data you send, and account emails; legitimate interests — security, abuse prevention and server logs, and understanding product usage in aggregate; consent — only where we ask for it, and you can withdraw it at any time.
• International transfers: your data is stored in Singapore and processed by the providers listed in §4, some of which are in the United States. These transfers rely on the providers' data processing terms, including the European Commission's Standard Contractual Clauses where they offer them.
• Your rights also include data portability (the CSV export gives you your trades in a reusable format) and the right to lodge a complaint with the data protection authority in your country.
• We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. AI-narrated insights only describe your own statistics.

13. Contact

Questions, or want to exercise any of the rights in §8? Email support@journexapp.com.