Privacy Policy

Summary

• Who: Trademate is a trading journal operated by Kennel & Eiser UG (haftungsbeschränkt), Zweibrücken. Contact for all data protection matters: [email protected].
• What and why: We process your account data and your trading journal, i.e. what you record yourself or have imported from your broker, in order to provide the app to you and to keep your journal in sync across your devices.
• Where: Our servers and our database are located in Belgium (Google Cloud). Some service providers also process data in the USA, in particular Google (sign-in, server logs, usage analytics), Anthropic (AI analysis "M8 AI"), MetaApi (MetaTrader connection) and Apple (notifications).
• Broker credentials: We store them encrypted and send them only to the provider you select; for MetaTrader, via our service provider MetaApi, which also stores your MetaTrader password. Depending on the provider, the recipient may also be located outside the EU, for example in the USA or the United Arab Emirates. We use the credentials solely to retrieve your trades.
• Only with your consent: M8 AI; usage analytics and advertising measurement in the app (Google, Apple); analytics cookies on the website; storage of your emotion data on trades on our server; your daily check-in; delivery of notifications via Apple (USA). You can withdraw any consent at any time (section 14).
• Deletion: If you delete your account, we delete all data on our servers, except a hash of the app download identifier of your Apple Account. We store it without your user ID, and it protects the free trial against repeated use (9.11). Copies in backups and logs are removed automatically after 7 and 30 days respectively (details and exceptions in section 9.18).
• We do not sell personal data.
• Your rights: access, rectification, erasure, restriction, data portability, objection and complaint to a supervisory authority (section 14).

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Kennel & Eiser UG (haftungsbeschränkt)
Alexanderstraße 6
66482 Zweibrücken
Germany

Commercial register: Amtsgericht (Local Court) Zweibrücken, HRB 33526
Managing directors authorised to represent the company: see Imprint (https://trademate-app.com/imprint)
Email for all data protection matters: [email protected]
Support: [email protected]

We have not appointed a data protection officer.

2. Overview

The following table summarises which data we process and for what purpose. The details are set out in the section indicated.

3. Legal bases

We process personal data only on one of the following legal bases:

• Consent, Art. 6(1)(a) GDPR: M8 AI (9.7), usage analytics and advertising measurement in the app (9.12), analytics cookies on the website (8.3 and 8.4), product emails (9.2).
• Explicit consent to the processing of special categories of personal data, Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR: emotional self-assessments on trades (9.4), the daily check-in (9.5).
• Contract, Art. 6(1)(b) GDPR: user account, profile, trading journal and synchronisation, broker connections, file import, notifications, subscriptions, sharing feature, widgets, support concerning your account.
• Legal obligation, Art. 6(1)(c) GDPR: demonstrating consent given (Art. 7(1) GDPR), handling requests concerning your data protection rights, retention of commercial and business correspondence (Sec. 257 HGB, German Commercial Code).
• Legitimate interests, Art. 6(1)(f) GDPR. Our interests in each case are:
  • secure and stable operation of the website and servers, defence against attacks and abuse, error analysis (8.1, 9.6);
  • protection against repeated failed MetaTrader sign-ins, which cause costs at our service provider (9.8);
  • unlocking our own support and test accounts and excluding them from automatic rules and analyses (9.11);
  • answering enquiries that are not part of a contract, and being able to provide evidence in the event of later queries (8.8);
  • fixing crashes and improving the app using data that Apple provides to us (9.17);
  • improving the app based on your voluntary feedback in surveys (9.19);
  • protecting the free trial against repeated use (9.11);
  • understanding how our service is used, on the basis of aggregated metrics (10);
  • presenting our service and communicating via Instagram (11).

  We will provide our balancing of interests to you on request. You can object to this processing (see the box in section 14).

In addition, the following apply to access to your device and to transfers to third countries:

• Sec. 25(1) of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG) (consent): storing and reading information on your device that is not strictly necessary, i.e. analytics identifiers in the app (9.12) and analytics cookies on the website (8.3 and 8.4).
• Sec. 25(2) no. 2 TDDDG (strictly necessary): storing and reading information on your device without which a function you have requested would not work. This includes your local journal and your settings, the sign-in session in the Keychain, the push token for notifications and the data for widgets you have set up. It also includes flags recording which notices and dialogs have already been shown to you and which surveys you have answered or closed, so that they do not appear repeatedly (9.19). It further includes reading your Apple Health values for the check-in if you allow it (9.5), the cookie storing your consent choice on the website, reading the one-time code from the link on our /reset-password page (8.7), a short-lived cookie during cTrader sign-in (9.8) and a flag by which the app recognises a fresh installation (9.18).
• Explicit consent to a transfer to a third country without an adequate level of data protection, Art. 49(1)(a) GDPR: transfer of your credentials and retrieval requests to providers and broker companies in such countries (9.8; to be obtained by 30 November 2026 at the latest) and delivery of notifications via Apple Inc., USA (9.10). For the other safeguards, see section 5.

4. Recipients

We disclose personal data only to the following recipients. We disclose data to public authorities only where we are legally obliged to do so.

a) Processors (process data only on our instructions; contract under Art. 28 GDPR):

b) Independent controllers (process data for their own purposes under their own privacy notices):

• Apple: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, for the App Store, in-app purchases, Sign in with Apple and crash and usage data (9.1, 9.11, 9.17); Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA, for the Apple Push Notification service (9.10); for Apple Ads attribution Apple Distribution International Ltd. (address above) (9.12).
• Google Ireland Limited (address above) for Sign in with Google (9.1) and processing in Google Ads (9.12).
• The provider (broker, exchange or trading platform) that you select for a broker connection; for MetaTrader, cTrader and TradeLocker, also the broker with which you hold your account (9.8).
• Ad networks that served an ad for Trademate: they receive an install notification from Apple without a user identifier (9.12).
• Recipients you choose yourself, such as an app in the share sheet (9.13) or your email provider when you write to us.

c) Joint controllers (Art. 26 GDPR):

• Meta Platforms Ireland Limited for statistics on our Instagram profile (11).

Data we do not collect from you directly: We receive your trading history and other account details from your broker (9.8), purchase and subscription data as well as crash reports from Apple (9.11, 9.17), with Sign in with Apple or Google your name and email address from Apple or Google (9.1), with Apple Ads attribution campaign details from Apple (9.12) and aggregated statistics on our Instagram profile from Meta (11).

5. Transfers to third countries

Some recipients are located outside the EU or the European Economic Area (EEA), or process data there. This concerns:

EU-U.S. Data Privacy Framework: In Implementing Decision (EU) 2023/1795 of 10 July 2023, the European Commission found that companies in the USA certified under the DPF ensure an adequate level of data protection. The General Court of the European Union upheld the decision on 3 September 2025 (Case T-553/23); an appeal is pending before the Court of Justice (Case C-703/25 P). You can check whether a company is certified at https://www.dataprivacyframework.gov/list. Should the decision cease to apply, the Standard Contractual Clauses of the European Commission (Implementing Decision (EU) 2021/914) agreed with Google and Cloudflare will apply.

Standard Contractual Clauses: You can obtain a copy of the Standard Contractual Clauses agreed in each case, or available to us, on request to [email protected].

Apple and Google as independent controllers transfer data they collect under their own responsibility (e.g. for App Store purchases or when you sign in with Apple or Google) to third countries under their own rules; according to Apple, it bases such transfers on Standard Contractual Clauses.

6. Retention and erasure

We store personal data only for as long as is necessary for the respective purpose or as required by a legal obligation. In detail:

Since Apple handles the payments for subscriptions and acts as the merchant towards you, we do not keep any invoice or payment data about you.

7. Data security

We protect your data with technical and organisational measures under Art. 32 GDPR, in particular:

• Encryption in transit: The app, the website and our servers communicate exclusively in encrypted form (TLS).
• Broker credentials: We store the API keys, secrets, passwords and tokens of your broker connections on our server, encrypted with AES-256-GCM. The key is kept separately from the database in Google Cloud Secret Manager. We store non-secret connection details (e.g. server, environment, for Capital.com your login email address) unencrypted.
• Database: Google Cloud stores the database in encrypted form.
• On your device: Your sign-in session is stored in the device's Keychain.
• Photos: When you add a photo, the app re-encodes the image. This removes metadata such as the location where it was taken (GPS). If an image cannot be re-encoded, the app does not add it.
• Passwords: We do not receive your Trademate password; it is held only as a hash at Firebase Authentication (9.1).
• Access control: Only two administrator accounts of our company and technical service accounts have access to the database and server logs. Each broker connection is assigned to exactly one Trademate account; other users' data cannot be retrieved through it.

No end-to-end encryption: Your journal data is stored on our servers in readable form because we process it for synchronisation and analyses (e.g. M8 AI). Our server decrypts broker credentials in order to send them to your broker. We therefore encrypt data in transit and at rest, but not end-to-end.

8. Website

On trademate-app.com we do not embed any third-party content or scripts other than the services named in this section. If you open this privacy policy or our terms of use from within the app, you are visiting our website; this section applies to that visit.

8.1 Hosting and delivery

Our website is hosted and delivered via Cloudflare Pages of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. The website's source code is kept on GitHub; GitHub does not receive any visitor data in the process.

• Data: When you visit the website, Cloudflare processes technically necessary data, in particular IP address, date and time, the address (URL) requested, referrer, user agent (browser and operating system) and connection data. Cloudflare obfuscates email addresses on our pages with a small script to protect them from spam.
• Purpose: delivery of the website, caching, protection against attacks.
• Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is to provide the website securely and quickly.
• Processor: Cloudflare acts as our processor under the Cloudflare Data Processing Addendum.
• Third country: Cloudflare is certified under the DPF; should the adequacy decision cease to apply, Standard Contractual Clauses apply in the alternative (section 5).
• Retention: Cloudflare processes the access data as our processor only to deliver and secure the website and deletes it as soon as it is no longer needed for this; Cloudflare does not state a fixed period. We do not keep access logs of our own.

8.2 Consent management (Cookiebot)

We obtain consent for non-essential services via the Cookiebot consent banner of Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Until you have given your consent, Cookiebot blocks the services that require consent. You can change or withdraw your choice at any time via the "Cookie settings" link in the footer of every page. There you will also find the complete list of cookies with provider, purpose and duration.

• Data: consent ID, date and time, your choice, user agent, referrer, URL visited, language and IP address or the approximate location derived from it. We store your choice in the "CookieConsent" cookie in your browser, duration 12 months.
• Legal basis: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (demonstrating consent); for the cookie, Sec. 25(2) no. 2 TDDDG.
• Processor and location: Usercentrics acts as our processor. According to Usercentrics, the data is processed in Microsoft Azure data centres in the EU (Ireland, with Amsterdam as fallback location).
• Retention: Usercentrics deletes the consent records after 12 months.

8.3 Google Tag Manager

Only with your consent (category "Statistics") do we load Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager is a tool we use to embed Google Analytics (8.4); it does not itself analyse usage data, but when it loads, Google receives your IP address and browser data.

• Legal basis: your consent, Art. 6(1)(a) GDPR in conjunction with Sec. 25(1) TDDDG. Tag Manager is not technically necessary and therefore requires consent (as also held by the Administrative Court of Hanover (Verwaltungsgericht Hannover), judgment of 19 March 2025, 10 A 5385/22).
• Processor: Google acts as our processor under the Google Ads Data Processing Terms.
• Third country: A transfer to Google LLC in the USA is possible; Google LLC is certified under the DPF (section 5).
• Withdrawal: at any time via "Cookie settings" (8.2).

8.4 Google Analytics 4

Only with your consent (category "Statistics") do we use Google Analytics 4 from Google Ireland Limited, via Tag Manager, to measure how our website is used.

• Data: identifiers in the cookies "_ga" and "_ga_<ID>" (duration 2 years each), pages and addresses visited, referrer, device and browser information, an approximate location derived from the IP address, and events such as page views or clicks on promotional offers. According to Google, Google Analytics 4 does not log IP addresses and discards the IP addresses of users in the EU after determining their location.
• Purpose: audience measurement and improvement of the website.
• Legal basis: your consent, Art. 6(1)(a) GDPR in conjunction with Sec. 25(1) TDDDG.
• Processor: Google acts as our processor under the Google Ads Data Processing Terms.
• Third country: DPF; should it cease to apply, Standard Contractual Clauses apply in the alternative (section 5).
• Retention: event data 2 months, user data 14 months.
• Withdrawal: at any time via "Cookie settings" (8.2).

8.5 Advertising

We do not use advertising services such as Google Ads conversion tracking or pixels of other advertising networks on our website. If we want to use such services in the future, we will obtain your consent beforehand and update this privacy policy. If you click a link to the App Store, you leave our website; from then on, Apple's privacy policy applies.

8.6 Fonts

We deliver the fonts of our website together with the website itself (8.1). No connection to servers of Google or other font providers is established for this when you visit our website.

8.7 Password reset and email confirmation

If you select "Forgot password?" in the app or register with an email address, Google (Firebase Authentication, 9.1) sends you, on our behalf, an email with a link to our page trademate-app.com/reset-password. The link contains a one-time code. The page shows your email address and transmits your new password or the confirmation of your email address directly to Firebase Authentication. For this, the page calls the Firebase Authentication interface (identitytoolkit.googleapis.com, Google) directly; it does not load any software libraries or other files from Google. The page does not load any analytics or advertising services, and if you leave it via a link, your browser passes on only our domain, not the address containing the code. We do not store anything on the website in the process.

• Legal basis: Art. 6(1)(b) GDPR (management of your user account). The page stores nothing in your browser (no cookies, no local storage).
• Third country: Firebase Authentication is operated in the USA (DPF, section 5).

8.8 Contact by email

If you write to us at [email protected] or [email protected], we process your email address, your name (if given), the content of your message and technical information from your email program. This also applies to applications for our partner programme, such as information about your channels and your reach.

• Purpose: handling your enquiry, including requests concerning your data protection rights.
• Legal basis: Art. 6(1)(b) GDPR if your enquiry concerns your user account or a contract; Art. 6(1)(c) GDPR for requests concerning your data protection rights and for commercial and business correspondence; otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries and in being able to show, in the event of later queries, what was discussed).
• Processor: Our mailboxes are operated by united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany, as our processor. united-domains operates the mailboxes and mail servers in Germany.
• Retention: We delete email enquiries three years after the end of the year in which your matter was concluded (Art. 6(1)(f) GDPR; our interest: evidence in the event of later queries or claims within the regular limitation period under Sec. 195 BGB, German Civil Code). Emails that qualify as commercial or business correspondence (e.g. concerning contracts in the partner programme) are kept for six years from the end of the calendar year (Sec. 257(1) nos. 2 and 3, (4) and (5) HGB; Art. 6(1)(c) GDPR). We document requests concerning your data protection rights and our reply for three years (Art. 5(2) GDPR).

9. App

9.1 User account and sign-in

To record your own data in Trademate, you need a user account (hereinafter "account" or "Trademate account"). You can register with an email address and password, with Sign in with Apple or with Sign in with Google.

At registration, the app links to this privacy policy ("privacy notice"): to the German version if the app language is German, otherwise to the English version.

Firebase Authentication: For registration and sign-in we use Firebase Authentication, a Google service. Our contracting party is Google Cloud EMEA Limited (section 4); Google processes the data as our processor under the Google Cloud Data Processing Addendum. According to Google, Firebase Authentication is operated exclusively in data centres in the USA; your sign-in data is therefore transferred to Google LLC in the USA (DPF; should it cease to apply, Standard Contractual Clauses in the alternative, section 5).

• Data: email address; password (only as a hash at Firebase; we never see it); name (optional; if you leave it blank when registering via Settings, we use the part of your email address before the "@" as your first name); a Firebase user ID; information on the sign-in method (Apple, Google, email); times of registration and sign-in; whether your email address has been confirmed; the app language (for the language of the emails); IP address and user agent for abuse prevention. According to Google, Firebase keeps logged IP addresses for a few weeks.
• Emails: Confirmation and password emails are sent by Google (Firebase) on our behalf (8.7).
• Confirmation: We create your account on our server only once you have confirmed your email address. There we store email address, first and last name, the Firebase user ID, an internal user ID and the dates of creation and last modification.
• Unconfirmed registrations: If you do not confirm your email address, we automatically delete the registration at Firebase after 30 days.
• Sign-in session: The app stores your sign-in session (tokens) in your device's Keychain and sends a short-lived sign-in token with every request to our server.

Sign in with Apple: Apple sends us a user identifier, your email address and, only at first sign-in, your name. If you choose "Hide My Email", we receive a relay address generated by Apple. Apple (Apple Distribution International Ltd., Ireland) is independently responsible for the authentication.

Sign in with Google: Google sends us your Google account ID, email address, your name and the address (URL) of your profile picture. We do not store the profile picture on our server; the address remains only in the record at Firebase. Google Ireland Limited is independently responsible for the authentication.

• Purpose: providing and securing your user account.
• Legal basis: Art. 6(1)(b) GDPR; storage of the session on the device: Sec. 25(2) no. 2 TDDDG.
• Retention: until you delete your account (9.18). Google then also removes the data from live and backup systems within 180 days.

9.2 Profile information and information given during onboarding

Mandatory information:

• Date of birth: We ask for your date of birth at registration to check that you are at least 16 years old (section 13). We do not use it for any other purpose.
• Trading experience and goals in onboarding without the sample journal: In the onboarding that the app shows without the sample journal (e.g. on the Mac), you must select your trading experience and at least one goal to complete onboarding. When you register from within the sample journal, the app does not ask for this information.

Optional information:

• Profile photo: downsized and re-encoded without metadata, stored on your device and on our server so that it appears on all your devices. You can remove it at any time.
• Gender (only under Settings → "Personal Data").
• Trading frequency: In onboarding without the sample journal, the app asks how many trades you make per week (preset to 10). This information stays on your device; the app uses it to calculate the time saving it shows you.

We use gender, experience and goals exclusively for display in your profile. The app additionally stores your goals on your device. The local copy of your goals and your trading-frequency answer remain on the device until you delete your account or the app (9.18). We receive your name at registration (9.1). Your trading goals and risk limits (e.g. monthly goal, daily risk limit) are part of your journal (9.3). You cannot change your name and email address in the app; please write to us for this (section 14). You can change your date of birth, gender and experience in the app, but not remove them; to remove them, an email to us is sufficient.

• Purpose: display in your profile; age verification.
• Legal basis: Art. 6(1)(b) GDPR.
• Retention: until you delete your account.

Consent to product emails: At registration or when signing in with Apple or Google, you can tick the box "Yes, send me tips, offers and news from Trademate by email. You can unsubscribe at any time in Settings or via the link in every email." It is not pre-ticked. This refers to emails from Trademate with tips on using the app, offers for our subscriptions and news about Trademate. Later you will find the "Email updates" switch under Settings → General → "Notifications" in the "Email" section (on iPhone, iPad and Mac, when you are signed in).

• Switching on: If you switch it on, the app first shows a window with the same consent text, a link to this privacy policy and the equally weighted buttons "Agree" and "Cancel". Only "Agree" gives your consent.
• Confirmed email address: We send product emails only to the email address of your account, once it has been confirmed (via the confirmation link or by Apple or Google).
• Record: We store your choice together with the time and the version of the consent text and, if you withdraw, the time of the withdrawal. Consents from app versions up to 1.9 are stored without the version of the consent text. We do not use these, or consents given to the first version of the text, for any mailing; where applicable, we will ask you in the app to give your consent again.
• Withdrawal: at any time with one tap on the same switch, without any further prompt, or via the unsubscribe link that every product email will contain.

We do not currently send such emails and do not use an email delivery service for them. Before the first mailing, we will name the service provider here.

• Legal basis: your consent, Art. 6(1)(a) GDPR; record of consent: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.
• Retention: the consent until you withdraw it; the record (times, text version) until you delete your account.

9.3 Trading journal

The trading journal is Trademate's core function. We process the data that you record, import or have retrieved from your broker:

• Trades: symbol, asset class, direction (long/short), quantity, entry and exit price, entry and exit time, status, profit/loss (including manually overridden values), fees, take profit and stop loss, strategy, confluences, risk-reward ratio, partial exits and order executions, notes (free text), emotional self-assessments (on our server only with consent, see 9.4), photos with a timeframe label, origin (manual, import, broker) and, for broker trades, the trade or position number at the broker.
• Sub-accounts: name, type (e.g. backtesting, funded, live), starting capital, breakeven threshold, profit target, trailing drawdown, loss limit.
• Saved filters ("Lens"): name, filter settings, period, an entry-time window, the selected sub-accounts, notes. If you delete a saved filter, we note its identifier and the time on our server so that a device with an older state does not restore it. We delete this marker together with your account. The app also remembers the identifiers of deleted filters on your device.
• Trading rules: your rule text (free text), category, sub-account and, where applicable, the M8 analysis from which you adopted the rule.
• Goals and risk limits: monthly and yearly goal, daily and weekly risk limit.
• Lists and settings: your strategies and confluences, asset classes and tick values per symbol, custom timeframes, display, language, currency, number and date format, the assignment of your broker connections to sub-accounts.

Mood values, emotion tags, your "Emotion Factors" list and emotion conditions in saved filters are governed not by this section but by section 9.4 (explicit consent).

Photos: Screenshots that you add to a trade (photo picker, camera or, on the Mac, drag and drop) are downsized and re-encoded by the app; this removes metadata such as the location where they were taken (see section 7). The photos are part of the trade record and are stored, synced and deleted together with it. Please note that screenshots may show account numbers or account balances.

Storage on your device: The app stores your journal locally in a storage area that the app's widgets also use (App Group). There is no synchronisation via iCloud. If you have enabled device backup (iCloud Backup or backup via the Finder or iTunes), the local journal is part of that backup; Apple's terms apply to it.

Synchronisation: As long as you are signed in, the app transmits every change to your journal to our server immediately and downloads your data at launch and on refresh. This makes your journal available on all your devices (iPhone, iPad, Mac). You can record and import your own trades only with an account. If you delete an entry in the app, the app also deletes it on our server. Trades imported via an existing broker connection may be imported again by the next sync as long as they fall within the provider's retrieval period; to remove them permanently, disconnect the connection (9.8). If you delete a sub-account, we also delete its trades, the trading rules of this sub-account and M8 AI analyses relating to this sub-account; analyses covering all sub-accounts remain.

Under Settings → "Delete All Data" you delete all your trades, with notes, photos and emotion data, on the device and on our server. Your account, sub-accounts, rules, goals and saved filters remain. Here too, trades from a broker connection that still exists may be imported again by the next sync as long as they fall within the provider's retrieval period.

Sample journal: At first launch, the app shows a sample journal with made-up data. This data does not leave your device.

• Purpose: keeping and analysing your journal, sync across your devices.
• Legal basis: Art. 6(1)(b) GDPR; storage on the device: Sec. 25(2) no. 2 TDDDG.
• Recipients: Google Cloud as our processor (9.6). We do not pass the contents of your journal on to third parties; for M8 AI, see 9.7.
• Retention: until you delete the entry or your account.

9.4 Emotional self-assessments

For each trade you can record how you felt: with a mood value (called "Emotional State" in the app, on a scale from negative to positive) and with emotion tags from your "Emotion Factors" list; together we call these "emotion data". The default list includes, among others, "Few Sleep", "Stress at work", "Anxious", "Well rested" and "Ate healthy"; you can change and extend it. You can also use emotion data as conditions in saved filters.

Such information may, especially over a longer period and together with your trading results, allow conclusions to be drawn about your physical or mental health. As a precaution, we therefore treat it as health data within the meaning of Art. 9(1) GDPR.

• Consent: From app version 1.10, the app asks for your explicit consent before emotion data leaves your device: at your first emotion entry or, if your journal already contains emotion data, when the app starts. You choose "I consent" or "Only on this device". Both options are presented equally, and nothing is preselected.
• Legal basis: your explicit consent, Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR. Consent is voluntary. Without consent, the mood value, emotion tags, your "Emotion Factors" list and emotion conditions in saved filters remain on your device only; the app otherwise works in the same way.
• Data: mood value and emotion tags per trade, your "Emotion Factors" list, emotion conditions in saved filters.
• Storage location: always on your device; on our server in the EU (Belgium, 9.6) only with your consent, so that the data is available on all your devices.
• Recipients: no one other than Google Cloud as our processor. M8 AI receives only the proportion of your trades for which you have recorded emotion data, not the data itself (9.7). They are not included in usage analytics (9.12).
• Record: We store your choice (consent, refusal or withdrawal) with the time, the version of the consent text, the app version and the platform (section 6).
• Refusal and withdrawal: You can withdraw your consent at any time under Settings → "Trading Settings" → "Sync emotion entries". If you refuse ("Only on this device") or withdraw, we delete your mood values, emotion tags, your "Emotion Factors" list and emotion conditions in saved filters on our server and no longer sync them. On your devices running the current app version they remain stored until you delete them yourself; they no longer leave the device. Devices running an older app version take over the state of our server at the next sync; the emotion data is then lost there. Please therefore update the app on all your devices first. If you are offline, the app transmits your choice as soon as you are online again. The lawfulness of processing carried out before the withdrawal remains unaffected.
• Retention: on our server until you delete the data, withdraw your consent or delete your account. On your device the same applies as for the rest of your journal (9.3, 9.18).

9.5 Daily check-in

You can fill in a short daily check-in in the app to record how you are doing. The default questions are: hours slept last night (0 to 14 hours), recovery (scale 1 to 5), whether you worked in your main job (yes/no), energy (1 to 5) and stress (1 to 5). You can adjust, deactivate and delete questions and create your own questions (up to 20 questions in total). The app links your answers to the trades of the same trading day; the entry time of a trade is decisive, and a trading day runs from 04:00 to 04:00 your local time. The values appear in the trade view and can be used in your analyses and saved filters. For individual trades you can enter different values.

• Data: your answers (numerical value, yes/no or selected option) with trading day, time zone and time of completion; your questions, including earlier versions and the titles, labels and units you assign yourself; per-trade overrides; time and version of your consents; check-in conditions in saved filters. There are no free-text answers.
• Special categories: Information on sleep, recovery, energy and stress as well as your own questions (e.g. "Migraine?") may be health data (Art. 9(1) GDPR). We treat all check-in data as such.
• Purpose: display and analysis for you yourself in the app. We do not analyse check-in data across users.
• Legal basis: your explicit consent, Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR. The app asks you before your first check-in; nothing is preselected. The check-in is voluntary; all other functions of the app work without it. If we change the consent text materially, we will ask you again.
• Storage location: on our server in the EU (Belgium, 9.6) and on your device. The local file is excluded from device backups (iCloud Backup, backup via the Finder, Time Machine). On iPhone and iPad it is protected by iOS Data Protection; on the Mac it can be read only by your user account. The app links the file to your account and discards it if another account signs in.
• Recipients: Google Cloud as our processor. No disclosure to third parties and no advertising. We do not transmit any check-in data to M8 AI (9.7). Notification texts, usage analytics and our server logs contain no check-in answers.
• Reminder: If you wish (off by default), we remind you of the check-in on the weekdays and at the time you choose, at most once per trading day, only as long as you have a subscription, and not if you have already checked in. The notification is delivered by our server via the Apple Push Notification service (9.10), only with your consent to the transfer to Apple. It contains no answers but, technically, the date of the trading day. You switch the reminder on and off under Settings → "Daily check-in" or under Settings → General → "Notifications" → "Daily check-in reminder"; both are the same switch, and it applies to your account, not just to one device. We process your reminder settings (on/off, time, weekdays, time zone) and the reminder itself on the basis of Art. 6(1)(b) GDPR; when you withdraw your check-in consent, we delete the settings.
• Apple Health (optional): On iPhone and iPad you can link individual number questions to a value from Apple Health under Settings → "Daily check-in" → "Apple Health" (sleep, heart rate variability, resting heart rate, steps or exercise minutes; sleep is preset). The app reads these values only after you allow it in Apple's dialog, read-only and only on your device, and suggests them as answers in the check-in. A value is stored and sent to our server only when you finish the check-in, and then like an answer you entered yourself; you can change it before and afterwards. We read no other data from Apple Health, write nothing to Apple Health and do not use data from Apple Health for advertising. You can revoke access at any time in the Health app or the iOS settings; withdrawing your check-in consent disconnects it in the app. Reading the values on your device is based on Sec. 25(2) no. 2 TDDDG.
• Export: Under Settings → "Daily check-in" → "Export check-in data" you can export your check-in data as a CSV file. The app creates the export file only temporarily and deletes it again.
• Withdrawal: at any time under Settings → "Daily check-in" → "Check-in consent". When you withdraw consent, we immediately delete all check-in data on our server and on your device, including check-in conditions in saved filters, and stop the reminder. The lawfulness of processing carried out before the withdrawal remains unaffected.
• Retention: until you delete a question (together with its answers), withdraw your consent or delete your account; we delete individual days on request.

9.6 Server infrastructure

Our servers and our database are operated for us by Google Cloud as processor (contracting party: Google Cloud EMEA Limited, section 4; processing under the Google Cloud Data Processing Addendum):

• Application server: Google Cloud Run in the europe-west1 region (Belgium).
• Database: Google Cloud SQL (PostgreSQL) in the europe-west1 region (Belgium). This is where your account, profile and journal data, including photos, and the encrypted broker credentials are stored (for the key, see section 7).
• Backups: Google creates a daily backup of the entire database. We keep the last 7 backups; each older one is deleted automatically. Point-in-time recovery is not enabled. The backups are stored in Google's "EU" location (multiple regions within the EU). Deleted data may therefore persist in backups for up to 7 days.
• Automated tasks: Every day we clean up MetaApi accounts that are no longer needed, remove broker connections under the 14-day rule (9.8), delete sync logs older than 90 days as well as expired cTrader sign-in states and MetaTrader failed attempts (9.8), and delete registrations whose email address has not been confirmed for 30 days (9.1); every minute the server checks whether notifications are due (9.10).

Server logs: Logs are created every time the app accesses our server.

• Content: your IP address, date and time, the address (URL) requested including technical parameters, the user agent (app version, operating system and networking library version), response status and duration, your internal user ID, error messages and technical identifiers such as App Store transaction IDs or the account number and server of your broker connection. We do not write credentials, the contents of your trades, notes or photos to the logs. One exception is the authorisation code during cTrader sign-in (9.8): it is part of the address requested, can be used only once and only together with our application key.
• Purpose: operation, security, error analysis.
• Retention: 30 days, then automatic deletion.
• Storage location: The storage location of the logs is not limited to the EU. Transfers to Google LLC in the USA are covered by the DPF; for other third countries, the Standard Contractual Clauses of the Google Cloud Data Processing Addendum apply (section 5).

Protection against overload: To prevent abuse and overload, our server counts requests per IP address or user ID in memory only; the counters expire after 10 minutes of inactivity.

Legal basis: Art. 6(1)(b) GDPR (provision of the app); logs, backups and abuse prevention: Art. 6(1)(f) GDPR (our legitimate interest: secure and error-free operation).

9.7 M8 AI

"M8 AI" (marked "Beta" in the app) produces, at your request, written analyses of your own trading behaviour and suggests rules that you can adopt. For this, our server sends a statistical summary of your journal to Anthropic's AI language model "Claude", which generates the text from it.

Consent: Before any data goes to Anthropic, we ask for your consent in the app ("Enable M8 AI"). The consent text lists what is transmitted and what is not. Our server stores every consent and every withdrawal with the time, the version of the consent text, the app version and the platform, and transmits nothing without valid consent. If you agreed to an earlier version of the consent text, the app asks for your consent again. You can withdraw your consent at any time under Settings → "M8 AI" → "Turn off M8 AI".

What is transmitted (period: the last 90 days, at most 2,000 trades, from the sub-accounts you select):

• performance metrics: number of trades, winners and losers, win rate, average win and loss, expectancy, profit factor, net result, longest losing streak, average holding time of winners and losers, number of trading days and trades per day;
• breakdowns by entry hour, weekday, asset class and direction (long/short);
• behavioural patterns: days with more than five trades and their result, trades after a loss on the same day, oversized positions compared with your usual size;
• trend: result and win rate for the last 30 days compared with the 60 days before;
• the up to eight symbols with the greatest impact on your result, each with its result;
• your confluences verbatim, provided they appear on at least two trades;
• up to 20 of your trading rules verbatim, from all sub-accounts;
• coverage rates: proportion of trades with a note, screenshot or emotion data (only with your consent under 9.4);
• your time zone, the analysis period and the language in which M8 AI should respond.

We transmit amounts as plain numbers without a currency.

What is not transmitted: your name, your email address, your user ID or any other identifier; the names of your sub-accounts; individual trades; the content of your notes; screenshots; your mood values and emotion tags; your broker credentials.

Even without a name or user ID, this data remains personal data: it comes from your account, is requested specifically for you, and we store the result linked to your account.

When data is transmitted: only when you request an analysis (in older app versions, when opening M8 AI), at the earliest 7 days after your last stored analysis, in no case more than 8 times per calendar month (a withdrawal counts like an analysis for this limit), and only if there are at least 5 trades with a profit or loss in the period. When a new analysis is possible, we may notify you (9.10).

Recipient: We use Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland ("Anthropic"), as our processor (Art. 28 GDPR). This is based on Anthropic's Commercial Terms of Service (version of 17 June 2025) and Data Processing Addendum (version of 24 February 2025). Under these, Anthropic processes the data only to provide the service and on our instructions, does not sell it and does not combine it with other data.

• Place of processing: Anthropic stores the data in the USA. The response may be computed in the USA or in other countries where Anthropic or its sub-processors (including Google Cloud Platform, Amazon Web Services, Microsoft Azure) operate data centres. The current list of sub-processors: https://trust.anthropic.com/subprocessors.
• Third country: Anthropic Ireland has the data processed by Anthropic, PBC (USA) and other sub-processors; our server transmits it directly to their infrastructure in the USA. Anthropic is not certified under the EU-U.S. Data Privacy Framework. In the Data Processing Addendum, Anthropic has undertaken to impose contractual data protection obligations on its sub-processors (section C.2) and to support us in complying with the requirements for transfers to third countries (section I.4); you can find the Data Processing Addendum at https://www.anthropic.com/legal/data-processing-addendum. The agreement between Anthropic Ireland and Anthropic, PBC is not public. We have asked Anthropic which safeguard under Art. 46 GDPR it is based on; we will add this information here as soon as we have it.
• Retention at Anthropic: According to Anthropic, inputs and outputs are deleted automatically within 30 days. If Anthropic's safety systems flag a request as a possible violation of Anthropic's Usage Policy, inputs and outputs may be kept for up to 2 years and the associated classification scores for up to 7 years. We do not have a zero data retention agreement.
• No AI training: Under the Commercial Terms of Service, Anthropic may not use the transmitted content (inputs and outputs) to train its models. We have not activated Anthropic's optional data sharing ("Development Partner Program").

Stored by us: the text of the analysis (including the metrics and rule suggestions mentioned in it), period, number of trades analysed, language, names and identifiers of the selected sub-accounts, and the model used and number of tokens processed (for our cost accounting). The app keeps a copy of your analyses on the device until you sign out or turn off M8 AI.

• Retention by us: until you withdraw your consent or delete your account; we delete individual or all analyses immediately on informal request (section 14). If you withdraw your consent, we no longer transmit any data to Anthropic and delete your previous analyses on our server and in the app. Rules that you have adopted from an analysis remain in your journal as your own rules (9.3) until you delete them. If you delete a sub-account, we also delete the analyses relating to that sub-account (9.3).
• Legal basis: your consent (Art. 6(1)(a) GDPR) for the transmission to Anthropic, the creation of your analyses and their retention in your account; for the record of your consent, Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.
• Note: AI analyses may be inaccurate and are not investment advice (section 12).

Anthropic's privacy policy: https://www.anthropic.com/legal/privacy

9.8 Broker connections

You can have your journal filled automatically by connecting an account with a broker, an exchange or a trading platform ("provider"). A connection is only established if you set it up yourself; without a connection, you can record trades manually or import them (9.9).

Process:

• Input: In the app, you enter the credentials required by the respective provider (table below) and, optionally, a name for the connection. The app transmits them in encrypted form (TLS) to our server.
• Storage: Our server stores the credentials encrypted with AES-256-GCM (section 7).
• Retrieval: When connecting and at every sync, our server decrypts the credentials and uses them exclusively to retrieve your trading history from the selected provider. We do not place orders or trigger withdrawals.
• Signature only: For Binance, Bybit, Kraken, OKX and Robinhood, we do not send the secret or private key to the provider, only a signature generated with it.
• Timing and period: Syncs are triggered by the app: directly after connecting, at app launch (except for MetaTrader) and when you refresh. At the first retrieval we fetch data going back up to two years, depending on the provider.
• Display in the app: The app retrieves the list of your connections with name, status, time of the last sync and the non-secret connection details (e.g. server, environment, for Capital.com your login email address), as well as the sync logs. Our server does not return secret credentials to the app in plain text. During a cTrader sign-in, the app stores the name of the connection and the sign-in state locally until the sign-in is complete.

Data processed:

• credentials as per the table, the name of the connection and technical details such as server, platform, environment (live/demo), region or account ID;
• closed trades or executions retrieved from the provider (instrument, direction, quantity, prices, times, result, fees, trade or position number). We do not store open positions;
• further account details that we receive during retrieval depending on the provider, such as account number, account name, account balance, account currency, for Tradovate your name and for Interactive Brokers the entire account statement in the form you have configured. We process this information in memory only; we store only the trades and the identifiers needed for the connection (e.g. the account ID for Capital.com);
• sync logs: time, result, number of trades imported and error messages from the provider; we delete them after at most 90 days.

Recipients (provider information as of 9 October 2026): The providers process your data as independent controllers; for cTrader, this is your broker, for which Spotware operates the platform as a service provider. The basis is your own contractual relationship with the provider; its privacy notices apply. Which company is your contracting party depends on your account with the provider; the table names the company with which you typically hold your account.

Note on permissions: Some credentials technically also allow trading actions, such as the MetaTrader master password, the cTrader authorisation, the OANDA token or, for Tradovate and TradeLocker, the account password. Where possible, therefore, grant read-only access only: for MetaTrader, the investor password; otherwise, API keys without trading and withdrawal rights.

cTrader: You sign in on Spotware's page and grant authorisation there. Trademate requests the "trading" permission, which would technically also allow trading actions; we use it exclusively to read your trading history. During sign-in, we set a technically necessary cookie in your browser (tm_ctrader_state, duration 10 minutes, Sec. 25(2) no. 2 TDDDG). In addition, we store on our server a sign-in state containing your user ID, Spotware's authorisation code and the name of the connection. It is valid for 10 minutes. Once sign-in is complete, we delete it; abandoned sign-ins are deleted by the daily clean-up.

MetaTrader via MetaApi: For MetaTrader, we use the MetaApi service of HLC Cloud LLC, 1309 Coffeen Avenue STE 1200, Sheridan, Wyoming 82801, USA (metaapi.cloud, data protection contact: [email protected]), as our processor.

• Process: Using your credentials (account number, password, server, platform, name of the connection), MetaApi creates a cloud terminal, signs in to your broker's server on our behalf and transmits your trading history to us.
• Storage at MetaApi: MetaApi stores your credentials for as long as the MetaApi account exists. On our server we record which MetaApi account we created for which connection of your account.
• Location: We operate access to your MetaTrader account in MetaApi's London region (United Kingdom); MetaApi does not document where the interface for creating accounts is operated. According to MetaApi, its servers are located in the United Kingdom and the USA. As HLC Cloud LLC is based in the USA, there is a transfer to the USA in any case.
• Contract: We have concluded a data processing agreement with HLC Cloud LLC, including the Standard Contractual Clauses of the European Commission (Module 2) (Art. 46(2)(c) GDPR).
• Assignment: Each MetaApi account is assigned to exactly one connection in your Trademate account; we do not use it for any other connection or any other account. At most one MetaTrader connection is possible per Trademate account.

Protection against failed attempts (MetaTrader): If the broker rejects your credentials twice within 4 hours, we block further attempts for 4 hours and store the times of the failed attempts for this purpose. We delete them after a successful connection, at your next attempt after the 4 hours have expired, at the latest at the daily clean-up after that, and with your account (Art. 6(1)(f) GDPR; our interest: avoiding abuse and unnecessary costs at MetaApi). If MetaApi rejects your credentials during setup, we delete the connection together with the trades imported through it; we delete the sync logs of this connection after at most 90 days.

Robinhood keys: If you wish, the app generates a key pair on your device. It copies the public key to the clipboard so that you can register it with Robinhood; it keeps the private key in the Keychain of this device (without syncing via iCloud Keychain) until the connection is complete. If you cancel the connection, sign out or delete your account, the app deletes the key.

Legal basis: Storing your credentials, transmitting them to the selected provider or to MetaApi and retrieving your trading data are necessary to provide the import function you have requested (Art. 6(1)(b) GDPR).

Transfers to third countries:

• Providers based in the EEA (Spotware as operator of the cTrader platform, TradeLocker and, for accounts in the EEA, Kraken, OKX Europe, Capital.com and Interactive Brokers, e.g. Interactive Brokers Ireland Limited or Interactive Brokers Central Europe Zrt.): no third-country transfer by us. For cTrader and TradeLocker we transmit only to the platform operator; the platform connects your account to your broker's systems on your broker's behalf. Where and with which service providers a provider technically operates its services, and whether it shares data within its group of companies, is decided by that provider as an independent controller (see its privacy notices).
• United Kingdom and other countries with an adequacy decision (e.g. OANDA Europe Limited or Interactive Brokers (U.K.) Limited): adequacy decision of the European Commission (Art. 45 GDPR; for the United Kingdom Implementing Decision (EU) 2021/1772, extended on 19 December 2025, valid until 27 December 2031).
• Providers in third countries without an adequate level of data protection: Binance and Bybit (United Arab Emirates), OKX for the "Global" region (Seychelles) and the "USA" region (USA), Robinhood, Topstep/ProjectX and Tradovate (USA). There is no adequacy decision of the European Commission for the UAE and the Seychelles. For the USA it applies only to companies certified under the EU-U.S. Data Privacy Framework; according to our check of 9 October 2026, Robinhood, Topstep, ProjectX and NinjaTrader are not on the official DPF list. Standard Contractual Clauses or other appropriate safeguards do not exist with these providers and cannot in practice be agreed, because they are your contracting parties, not ours.
• Providers where the country depends on your account (MetaTrader, OANDA, Kraken, Capital.com, Interactive Brokers): If the company with which you hold your account is located in the EEA or in a country with an adequacy decision, the bullets above apply. If it is located in a country without an adequacy decision, such as OANDA Corporation in the USA or a broker in the United Arab Emirates, the Seychelles, Australia or Singapore, the previous bullet applies for that country. For MetaTrader, our processor MetaApi signs in to your broker's server with your credentials on our instructions.
• Transition: For these transfers there is neither an adequacy decision nor a safeguard under Art. 46 GDPR. By 30 November 2026 at the latest, we will obtain your explicit consent in the app (Art. 49(1)(a) GDPR); without it, we will no longer sync these connections from then on. Your imported trades will be kept.
• MetaApi: see above.

Retention and erasure:

• Disconnecting: If you disconnect a connection, we delete the credentials, the connection details, the sync logs and all trades imported via this connection, including the notes, photos and emotion data that you added to these trades. For MetaTrader, we also delete the MetaApi account. Trades recorded manually or imported from a file are not affected.
• Deleting your account: The same applies to all connections (9.18).
• If you have never had a subscription: If you have never taken out a subscription (not even a free trial in the App Store), we remove your broker connections automatically in a daily run as soon as both your Trademate account and the respective connection are older than 14 days. In doing so, we delete credentials, sync logs and, for MetaTrader, the MetaApi account; trades already imported remain in your journal.
• MetaApi without sync: If there has been no successful sync for 7 days (for connections that have never synced: 7 days after setup), we delete the MetaApi account (with your password) at the daily clean-up. At the next sync, we create it again using the credentials stored with us.
• At the provider: We delete only our copy. We revoke neither the cTrader authorisation nor your API keys at the provider. Please therefore also revoke authorisations and keys in your account with the provider.
• Backups: Deleted credentials may persist in encrypted form in our database backups for up to 7 days (9.6).

Notifications about broker connections: When a MetaTrader sync is possible again or a sync has been completed, we may notify you (9.10).

9.9 File import

You can import trades from your broker's export files (CSV, currently 19 formats). The app reads the file exclusively on your device; the file itself is neither stored nor transmitted to us. Only the recognised trades are taken over (symbol, direction, quantity, prices, times, result, fees, asset class); they are synced like manually recorded trades (9.3). The import requires an account and a subscription.

Older app versions (before version 1.2) send the file to our server for processing. The server analyses it in memory and stores only the recognised trades, not the file. Such files may contain all the columns of your broker export, such as account number or name.

• Purpose: taking over your trades from broker exports into your journal.
• Legal basis: Art. 6(1)(b) GDPR.
• Retention: We do not store the file; section 9.3 applies to the trades taken over.

9.10 Notifications

Depending on the app version, notifications are either generated locally on your device by the app or delivered by our server via the Apple Push Notification service (APNs).

Locally generated notifications (older app versions): The app itself creates notices such as "new M8 AI analysis available", "MetaTrader sync possible again" (with the name of your connection) or "sync complete" (with the number of new trades) on your device. No data is transmitted to us or to Apple for this.

Notifications delivered by the server (newer app versions):

• Switches in the app: Under Settings → General → "Notifications" there is the main switch "Notifications" and, below it, one switch per kind: "M8 AI analysis ready", "MetaTrader sync available", "Sync complete", "Weekly recap", "Daily check-in reminder" and "Trial and subscription reminders". All of these switches except the daily check-in reminder are on by default. You still only receive notifications once you have also allowed them in iOS (9.15).
• Device or account: The main switch and the switches per kind apply only to the device in question; we store them with that device's registration. The exception is the daily check-in reminder: it is a setting of your account (9.5) and applies to all your devices. We do not deliver notifications to the Mac; there, the page shows only the daily check-in reminder and the email consent (9.2).
• Registration: Only if notifications are allowed in iOS, the main switch is on and you have consented to the transfer to Apple (see "Third country and consent") does the app transmit your device's push token to our server, together with app language, time zone, app version, the environment (test or production) and your switches per kind. If the weekly recap is switched on, the app creates its text for the current week on your device and also transmits it; it contains no amounts. We deliver a kind only to devices on which its switch is on.
• Push token with syncs: If you start a broker sync yourself, for example by refreshing, the app sends the push token with it so that only this device receives the "Sync complete" notification. It does so only if notifications are allowed in iOS and the main switch and "Sync complete" are on. For syncs that the app starts by itself (e.g. at app launch), it sends no push token. Our server uses the token only if it belongs to a device of your account on which "Sync complete" is on.
• Switching off: If you switch off the main switch or revoke the permission in iOS, the app deletes your device's registration on our server. If you switch off only individual kinds, the registration remains, and we store which kinds are off.
• Types and content:
  • new M8 AI analysis available (generic text);
  • MetaTrader sync possible again (generic text without the name of your connection);
  • sync complete, with the number of newly imported trades;
  • weekly recap on Saturdays at 10:00 your local time (only with a subscription and your own closed trades in that week). If you traded in the week up to at least Friday, it contains the number of days in profit, but no amounts; otherwise, a generic text.
  • reminder before the end of a free trial in the App Store, with the date and time it ends.

  We do not send notices about a new M8 AI analysis or a MetaTrader sync being possible again, or reminders about the end of a free trial, between 22:00 and 08:00 your local time. Whether the text appears on the Lock Screen depends on your "Show Previews" setting in iOS.

• Test notifications: To test the notification service, we send test notifications with generic text only to our own test and staff accounts.
• On our server: the registration of your device as described above and scheduled notifications with time, status, number of delivery attempts, last error and the information needed for the text (e.g. identifier of the connection, expiry date of a free trial including the Apple transaction ID, number of new trades and, for "sync complete", the push token of the device that triggered it).
• Recipient: Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA. Apple receives the push token, the text of the notification and technical identifiers and delivers the notification to your device. If your device cannot be reached, Apple holds the notification for between 1 and 24 hours depending on the notification type. Apple provides the service under its developer terms and also collects its own technical usage data in the process in order to improve the service; to that extent, Apple does not act as our processor bound by our instructions.
• Third country and consent: Notifications are delivered by Apple Inc., USA, via the Apple Push Notification service. The European Commission's adequacy decision on the EU-U.S. Data Privacy Framework does not cover this transfer because Apple Inc. is not certified (checked on 15 October 2026). Appropriate safeguards under Art. 46 GDPR, such as Standard Contractual Clauses, do not exist for this service either (checked on 15 October 2026). It is therefore not ensured that your data enjoys a level of protection at Apple Inc. essentially equivalent to EU law; in particular, Apple Inc. is not contractually bound to EU data protection standards in this respect, and your rights against Apple Inc. are harder to enforce. US authorities can access the data under US law. Against access by US intelligence services, the redress mechanism under Executive Order 14086 is open to you, which you can initiate through an EU data protection supervisory authority. We therefore deliver notifications via our server only if you have previously given your explicit consent to this transfer for your user account on the device concerned (Art. 49(1)(a) GDPR). The app asks you for it before it registers your device for notifications and informs you of these risks. We transfer the push token, the title and text of the notification, the kind of notification and, where applicable, a week or a day. The text may contain details about your journal, such as the number of new trades, the number of days in profit or the end of your trial, but no amounts and no answers from the check-in. We store the time and text version of your consent and of any withdrawal until you delete your account. You can withdraw your consent at any time with effect for the future by switching off the "Notifications" main switch on the device. The app then deletes the device's registration, and we no longer transfer any notifications for this device to Apple. The lawfulness of the transfers made until then remains unaffected.
• Legal basis: Art. 6(1)(b) GDPR; transfer to Apple Inc. (USA): your explicit consent, Art. 49(1)(a) GDPR; record of consent: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR; storing and reading the push token on your device: Sec. 25(2) no. 2 TDDDG.
• How to switch off: at any time in the app under Settings → General → "Notifications", either all notifications on this device with the main switch or individual kinds with their switch; the daily check-in reminder also under Settings → "Daily check-in". You can also switch notifications off in your device's system settings.
• Retention: We delete the registration of your device when you switch off the main switch in the app or notifications in iOS, when you sign out, when Apple reports the token as invalid or when you delete your account. The app continuously overwrites the weekly recap text; if the weekly recap is switched off, we store no text. We delete scheduled notifications with your account.
• Check-in reminder: If you have switched it on (switch "Daily check-in reminder", off by default), we remind you of your daily check-in on the weekdays and at the time you choose, only as long as you have a subscription (9.5). The text is generic and contains no answers; technically, we transmit the date of the trading day. Apple holds this notification for at most 2 hours.
• End of the free trial: About 24 hours before your free trial (9.11) ends, we remind you of this, with the date and time it ends.

9.11 Subscriptions and purchases

You take out subscriptions via Apple's App Store. The merchant is Apple (for customers in the EEA, Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland); Apple processes the payment under its own responsibility. We do not receive payment data such as card details. Links to subscription management in the app lead to Apple's App Store.

• Account identifier at purchase: At purchase, the app passes the internal ID of your Trademate account (a random identifier, "appAccountToken") to Apple. Apple returns it with the transaction. This lets us assign a subscription to exactly one Trademate account.
• Verification on our server: The app sends the transaction data signed by Apple to our server. We verify the signature and store: the original transaction ID, the assigned account, the account identifier from the purchase, the product, the expiry date, the status (active, expired, revoked), where applicable the date of a refund, whether it is a free trial, whether auto-renewal is switched on, the environment (test or production) and the time of the last verification. We do not store the purchase price or purchase date.
• Notifications from Apple: Apple informs our server directly about renewals, cancellations, expiry, refunds and changes to auto-renewal (App Store Server Notifications).
• Protection of the free trial: If a verified transaction, from the app or from a notification from Apple, contains the identifier that Apple assigns to your Apple Account and this app ("appTransactionId"), we store only a hash of it (SHA-256), not the identifier itself. Together with it, we store the time, the App Store environment and the occasion "subscription". We store the hash without your user ID and without any other information from your account. Its sole purpose is to ensure that an Apple Account that has already had a subscription does not receive a free trial without payment details. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to protect our free trial offer against repeated use, for example by deleting and re-registering.
• Retention of the hash: We delete the hash automatically 3 years after it was stored, even if you delete your account earlier. If we no longer offer a free trial, we delete it immediately. As long as your account exists, the hash can be attributed to your account via the time of your subscription or trial start and via later transactions. You then make requests about it as usual in relation to your account. After your account has been deleted and our logs have expired (at most 30 days), we can only attribute it to you if we again have Apple's confirmation of your app download or transaction data of your Apple Account (Art. 11(2), Art. 12(2) sentence 2 GDPR). Write to us and we will tell you what information we need. If you object to the storage (section 14), we delete the hash as soon as we can attribute it to you.
• Link to an account: A subscription unlocks exactly one Trademate account. If you delete the account to which an active subscription is assigned, you can assign the subscription to a new Trademate account by restoring purchases there with the same Apple ID.
• Our own test and staff accounts: Each time your subscription is verified, we match the email address of your account against a list of accounts that we ourselves use for support, testing and Apple's app review and that are unlocked without a subscription. We use the same matching for the weekly recap (9.10), the 14-day rule (9.8), surveys (9.19) and internal analyses (10). The legal basis is Art. 6(1)(f) GDPR; our interest is to unlock our own accounts and to exclude them from automatic rules and analyses.
• Reminder: In newer app versions, we remind you by notification before a free trial in the App Store ends (9.10).
• On your device: So that you stay unlocked during short periods offline, the app remembers your subscription status locally until you sign out.
• Legal basis: Art. 6(1)(b) GDPR.
• Retention: until you delete your account. Deleting your Trademate account does not end a subscription in the App Store; please cancel it in your Apple ID settings.

For the measurement of purchases in usage analytics, see 9.12.

Free trial without payment details: Once per Apple Account, you can use Trademate with its full range of functions for 7 days free of charge and without providing payment details. The trial starts automatically when the app would show you the subscription screen for the first time (usually shortly after registration) and ends exactly 7 days later. Nothing is charged afterwards; to continue using the app, you need a subscription.

• Data: start and end of your trial in your account; a notification scheduled about 24 hours before the end (9.10).
• Who gets it: accounts registered on or after 6 October 2026 to which no subscription has ever been assigned.
• Once per Apple Account: There is one trial per Apple Account, however many Trademate accounts or devices you use. To this end, when the trial starts, the app sends Apple's signed confirmation of your app download ("AppTransaction") to our server. Besides the appTransactionId, it contains among other things the date of the first download, the app version and a verification value of your device. We use this information only to verify Apple's signature and do not store it. Of the appTransactionId, as described above under "Protection of the free trial", we store only a hash, here with the occasion "trial". If a hash is already stored for your Apple Account, we do not start a new trial. We record this, with the time, in your account so that the app shows you the subscriptions instead. Without this confirmation from Apple, for example if you are not signed in to the App Store, no trial starts. The app then shows you the subscriptions.
• End: Our server determines when the trial ends. The app checks this when it opens and exactly at the end; so that this works without an internet connection and regardless of your device's clock, it keeps on your device the end time, the server time it last received together with your device's time and the reading of its continuously running system clock at that moment, and an identifier of the current device start-up. This information does not leave your device.
• Broker connections: While the trial is running, we do not remove your broker connections automatically; after that, the 14-day rule from 9.8 applies.
• Legal basis: The start and end of the trial and the note are based on Art. 6(1)(b) GDPR, the hash on Art. 6(1)(f) GDPR (see above).
• Retention: We store the start and end of the trial and the note until you delete your account. For the hash, "Retention of the hash" above applies.

9.12 Usage analytics and advertising measurement

Only with your consent do we use Google Analytics for Firebase from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The app asks for your consent with a separate prompt at first launch or during onboarding ("Allow" and "Not now" buttons; nothing is preselected); by tapping "Allow" you confirm that you are at least 16 years old (section 13). Without your consent, collection is switched off. If you agreed to an earlier version of the consent text, the app asks you again; until you answer, collection is switched off. You can also switch usage analytics on later under Settings → General → "Share Usage Analytics". The app then first shows a window with the consent text, a link to this privacy policy and the equally weighted buttons "Agree" and "Cancel" (as for product emails, 9.2); only "Agree" gives your consent.

Purposes: (1) improving the app by seeing which functions are used and how; (2) measuring the success of our advertising: purchases are imported into Google Ads as "conversions", and installs from Apple Ads campaigns are attributed.

Data:

• Identifiers: an app instance ID, a Firebase installation ID and the identifier for vendors (IDFV). These identifiers are stored on or read from your device. We do not collect the advertising identifier (IDFA); the app therefore does not ask for permission to track you across apps of other companies (App Tracking Transparency). We do not set a user ID and transmit neither names nor email addresses.
• Device and app information: device model, operating system and app version, language and region, and an approximate location derived from the IP address.
• Events, in summary:
  • account and onboarding: registration (with sign-in method), start and completion of onboarding, use of the sample journal;
  • usage: main areas of the app visited, creating and importing trades (only the origin, not the content), connecting a broker (only the type of broker), creating a filter, requesting an M8 AI analysis (only the number of sub-accounts selected);
  • subscription: showing and closing the subscription screen and offers, purchase (transaction ID, price paid, currency, product, place of purchase in the app);
  • collected automatically: first launch, session start, usage time, updates of the app and operating system;
  • from version 1.10: showing, closing (with the number of the question) and answering surveys, each only with the survey's identifier, never with your answers (9.19);
  • only in newer app versions: use of the sharing feature (what is shared, format, whether amounts are visible, and the target app, e.g. Instagram or WhatsApp), and showing and closing sharing prompts. These prompts appear after a winning trade, a green day, a personal best or a month in profit; the event therefore reveals that such a result has occurred, but not the amounts.
• We do not transmit the contents of your trades, notes, emotion data or broker credentials to Google.
• With your consent, we also record that you have started a free trial (9.11).

The data is pseudonymous, not anonymous: it can be linked to your device via the identifiers, and the transaction ID of a purchase can be linked to our subscription records.

Roles: For usage analytics, Google acts as our processor under the Google Ads Data Processing Terms. Insofar as purchases are imported into Google Ads as conversions and used there to measure and manage our ads, Google Ireland Limited is independently responsible for this (Google Ads Controller-Controller Data Protection Terms). We do not use the data for personalised advertising or remarketing; the app does not give Google permission for this.

On-device Google Ads conversion measurement: The Google SDK contains a function for on-device conversion measurement for iOS campaigns. We have switched this function off. We do not transmit hashed values of your email address or phone number.

Install attribution via Apple: After your consent, the Google SDK may also set a conversion value via Apple's SKAdNetwork or AdAttributionKit interfaces. Apple then reports to the ad network that served an ad for Trademate, without a user identifier, that the app was installed or used.

Apple Ads attribution (iPhone and iPad only): With your consent, the app retrieves an attribution token via Apple's AdServices interface and sends it to Apple (api-adservices.apple.com); in the process, Apple also sees your IP address. Apple tells us whether the install goes back to an Apple Ads campaign. Only if it does do we transmit to Google Analytics the identifiers of the organisation, campaign, ad group, ad and search term, the type of conversion and the country or region. The app remembers locally whether the attribution is complete and asks at most on 8 app launches. According to Apple, Apple stores attribution data for up to 21 days. The responsible entity on Apple's side is Apple Distribution International Ltd., Ireland, which according to Apple's privacy policy is responsible for personal data in the EEA.

• Legal basis: your consent, Art. 6(1)(a) GDPR; for storing and reading the identifiers on your device, Sec. 25(1) TDDDG.
• Third country: Google LLC in the USA is certified under the DPF; should the adequacy decision cease to apply, Standard Contractual Clauses apply in the alternative (section 5).
• Withdrawal: at any time with one tap under Settings → General → "Share Usage Analytics", without any further prompt. After that, the app no longer collects events, no longer requests Apple Ads attribution, resets the analytics identifiers on your device and deletes its local flags. Data already transmitted to Google remains stored at Google until the retention period expires. The lawfulness of processing carried out before the withdrawal remains unaffected.
• Retention: at Google event data 2 months, user data 14 months; at Apple up to 21 days (Apple Ads attribution). On your device, the app stores your choice together with the version of the consent text, a flag indicating whether the Apple Ads attribution is complete and, in newer app versions, flags so that one-time events are not counted twice (with your internal user ID; this is not sent to Google). The app deletes the flags when you withdraw consent and when you delete your account; your choice remains stored so that the app does not ask you again.

9.13 Sharing feature

You can create images of a trade or a trading day, and in newer app versions also of a week, a streak or a month, and pass them on or save them via your device's share sheet. Depending on the subject, the image contains symbol, direction, prices, times, quantity, result and counts such as green days, as well as the Trademate logo; it does not contain your name, email address, notes or account data. In newer app versions you can hide amounts and quantities with "Hide amounts"; in older versions the image always shows the result in your currency.

• Recipients: the app you select in the share sheet (e.g. Instagram, WhatsApp, Messages, Mail or AirDrop), or your photo library. We do not transmit the image ourselves. The respective provider is responsible for further processing.
• Newer app versions may point you to the sharing feature after certain results or in the weekly recap. For how this is recorded in usage analytics, see 9.12.
• Legal basis: Art. 6(1)(b) GDPR.

9.14 Widgets

The app's widgets (calendar, performance, recent trades) show daily results, equity curves and your last 10 trades (symbol, direction, result, date). The app stores the data for this on your iPhone or iPad only if you have set up at least one Trademate widget. If you remove the last widget, the app deletes this data the next time it is opened. The Mac app stores no widget data. The data does not leave your device. Widgets may be visible on the Home Screen, in StandBy on a locked iPhone and, if you use iPhone widgets on your Mac, on your Mac. When you sign out and when you delete your account, the app deletes this data immediately. Legal basis: Art. 6(1)(b) GDPR, for storage on the device Sec. 25(2) no. 2 TDDDG.

9.15 Permissions

The app requests permissions only when you use a function that needs them. Notifications are the exception:

• Notifications: On iPhone and iPad, iOS asks once at the very first launch of the app whether Trademate may send you notifications, before the usage analytics question, the sample journal and onboarding. Your answer does not change what happens next. If iOS has not asked you yet, the app also asks when you switch on notifications or a kind of notification, switch on the daily check-in reminder or use a function that can notify you (9.10). Before the app registers your device with our server for notifications, it additionally asks for your consent to delivery via Apple Inc. in the USA (9.10).
• Selecting photos: You select photos for trades and your profile picture in the system photo picker. The app does not need access to your library for this; it receives only the images you select.
• Adding photos: To save a sharing image to your photo library, the app asks for permission to add photos. It cannot read your library with this permission.
• Camera: when you take a photo for a trade directly from the app.
• Apple Health (iPhone and iPad only): when you connect Apple Health in the daily check-in. The app asks only for read access to the values you link to a question (sleep, heart rate variability, resting heart rate, steps, exercise minutes) and uses them only to suggest answers in the check-in (9.5). It writes nothing to Apple Health.

The app does not request access to location, contacts, calendars, microphone or Face ID, or permission for cross-app tracking. You can revoke any permission in your device's system settings.

9.16 Support requests from the app

Under Settings → "Contact Support", the app opens your email program with a message to [email protected]. Via "Request a broker" in the broker selection, it opens a pre-filled message that contains the app version, build number and platform (iOS or macOS) at the end; you can delete this information before sending. The app does not send anything itself; we only receive the message once you tap Send in your email program. Section 8.8 applies to the processing.

9.17 Data we receive from Apple

We do not integrate any crash analysis tools of our own. However, Apple provides us with the following data:

• Crash reports and usage statistics: only if you have enabled "Share With App Developers" in your device settings (Settings → Privacy & Security → Analytics & Improvements). The reports contain device model, operating system and app version, technical execution data and timestamps; according to Apple, we receive statistics in aggregated form or in a form that cannot be related to individuals. We use them exclusively to fix bugs and improve the app.
• Beta tests (TestFlight): If you take part in a beta test, we see the information with which you were invited (e.g. name and email address), your feedback including screenshots, device and operating system, and crash reports.
• Ratings: your display name, your rating and your review text in the App Store, as well as our replies. When the number of trades in your journal passes 3, 30 or 150 through trades newly recorded, imported or taken over from your broker, the app asks for a rating via the system rating dialog. The app does not store any counters of its own on your device for this. Apple controls how often the dialog appears at most (according to Apple, at most three times in 365 days). You can switch it off on iPhone and iPad under Settings > Apps > App Store > "In-App Ratings & Reviews", and on the Mac in the settings of the App Store app. You submit your rating directly to Apple.
• Legal basis: Art. 6(1)(f) GDPR; our legitimate interests are a stable app, beta tests and responding to ratings.
• Retention: We delete crash reports and feedback that we download from App Store Connect as soon as the bug has been fixed, at the latest after 12 months; otherwise, Apple's periods in App Store Connect apply.

9.18 Account deletion

How to delete your account: in the app under Settings → "Personal Data" → "Delete Account"; you confirm the deletion twice. If you signed in with Apple, you additionally confirm the deletion with Apple; if you cancel that confirmation, we do not delete your account. If a broker sync is running at that moment, our server refuses the deletion without changing anything; please try again after a few minutes. You can also ask us to delete your account by email to [email protected].

What we delete: all data relating to your account on our servers, namely account and profile data, settings, all trades with notes, photos and emotion data, sub-accounts, saved filters and the markers of deleted filters, trading rules, goals, M8 AI analyses, broker connections with credentials and sync logs, the state of an ongoing cTrader sign-in, registrations for notifications and scheduled notifications, subscription records, the start and end of a free trial, surveys shown to you, your answers and your opt-out from surveys, and the records of your consents. We also delete your sign-in data at Firebase Authentication and your MetaApi accounts; if deletion at MetaApi does not succeed immediately, the daily clean-up catches up within 24 hours. If you signed in with Apple or Google, we revoke that sign-in at Apple or disconnect Trademate from your Google account.

Together with your account, we also delete all check-in data and your check-in consents.

What does not disappear immediately:

• database backups: up to 7 days (9.6);
• server logs with your internal user ID: up to 30 days (9.6);
• Firebase Authentication: Google also removes the data from its backups within 180 days (9.1);
• data transmitted to Anthropic: according to Anthropic's retention periods (9.7);
• usage analytics at Google: until the configured retention period expires (9.12);
• emails you have written to us: according to the periods in 8.8;
• the hash of your Apple Account's app download identifier, stored without your user ID: according to the period in 9.11;
• data at Apple (App Store, purchases, notifications) and at your broker: according to their own rules.

What you should do yourself:

• cancel an active subscription in your Apple ID settings; account deletion does not end it;
• if, exceptionally, disconnecting the sign-in with Apple or Google does not succeed (for example without an internet connection), remove Trademate yourself in your Apple ID or Google account settings;
• revoke authorisations and API keys at your brokers (9.8).

On your device:

• The app removes on account deletion: your journal, your profile photo, your settings, the M8 AI cache, the widget data, the goals selected in onboarding and your trading-frequency answer (9.2), the assignment of broker connections to sub-accounts, the identifiers of deleted saved filters (9.3), the information on the end of the trial (9.11), the flags for one-time analytics events and for Apple Ads attribution, dates of sharing prompts already shown, the Google sign-in session and a private key generated for Robinhood; it resets the analytics identifiers and signs you out.
• Remaining on the device: your choice regarding usage analytics, your notification switches on this device together with the device's push token and the flag that iOS has already asked about notifications (9.10, 9.15), the flag indicating whether the app tour has already been shown and the flags for surveys already answered or closed (9.19). They contain no information about your account and remain until you delete the app.

Reinstallation: On iPhone and iPad, at the first launch after a reinstallation the app recognises that it has been newly installed, deletes leftover Keychain entries and ends any sign-in that still exists. On the Mac, deleting the app does not remove all of its data; please sign out there before deleting the app.

Unconfirmed registrations: You cannot delete a registration whose email address you never confirmed in the app. We delete it automatically after 30 days (9.1); on request by email, also immediately.

9.19 In-app surveys

From version 1.10, the app occasionally shows a short survey, for example about a feature or about how likely you are to recommend Trademate. Taking part is voluntary: you can close any survey with "Later", skip questions unless they are marked as required, and opt out of surveys altogether.

• When a survey appears: At quiet moments, the app asks our server whether a survey is intended for you: when you open the app, when you open a main area (e.g. Analytics or Lens) or after certain actions (e.g. adding a trade or connecting a broker). In doing so, it transmits the occasion, the app version, the platform (iOS or macOS) and the language. Whether our server offers you a survey is decided on the basis of this information, the age of your account, your subscription status (subscription, free trial or none) and a random group derived from your internal user ID, which is used to show a survey to only some users. You see at most one survey at a time and several days between two surveys. You can answer each survey only once; if you close it with "Later", it does not appear again. If the app is closed in the middle of a survey, the survey appears one last time, at the earliest on the next day. Surveys never appear during onboarding, in the sample journal or over the subscription screen.
• What we store: for each survey shown to you, when it was first and last shown, how often, and whether and when you closed or answered it; for an answered survey, your answers (selected options, ratings and any free text) with the time, app version, platform and language. This data is linked to your account so that each account answers a survey only once and it does not appear twice on any of your devices.
• Free text: We do not ask about your health, your mood, your financial circumstances or other people. Please do not include any information about your health, your mood or other people in free-text fields; the app reminds you of this at the input field. If, when reading, we nevertheless find such information, we delete these passages within 7 days.
• Analysis: We analyse the answers in aggregated form (distributions, averages, recommendation score) and read free-text answers. Exports of the answers contain neither email addresses nor user IDs. We exclude answers from our own test and staff accounts (matching as in 9.11).
• Recipients: none; Google Cloud only as our processor (9.6). Usage analytics (9.12) receive, only with your consent, merely the events "shown", "closed" and "answered" with the survey's identifier, never your answers.
• Opting out of surveys: via "Don't show surveys again" on the first page of every survey or under Settings → General → "Surveys". We then store the time of your opt-out in your account; our server no longer offers your account a survey on any device until you turn surveys back on in the settings. Answers already given remain stored; we delete them on request (section 14).
• On your device: The app keeps which surveys you have already answered or closed on this device, so that they do not appear again.
• Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is to improve the app based on your voluntary feedback. You can object at any time (Art. 21 GDPR): for future surveys, it is enough to opt out of surveys. If you want us to stop using answers you have already given, write to us; we will then delete them (section 14). For the flags on your device: Sec. 25(2) no. 2 TDDDG.
• Retention: surveys shown and opt-out until you delete your account, the opt-out also until you turn surveys back on. We separate your answers from your account no later than 3 months after the end of the survey concerned and delete your free text at that point; we then keep the other answers (ratings, selected options) without user ID and with the date only for up to 3 years. We keep aggregated results without names, email addresses or user IDs for 3 years.

10. Internal statistical analyses

To understand how Trademate is used, we analyse data from our database internally in aggregated form, for example how many newly registered accounts per week complete onboarding, connect a broker, use M8 AI or take out a subscription.

• Data: time of registration, completion of onboarding, time of the M8 AI consent and of the analyses, start and end of a free trial, subscription data (product, periods, environment, refund if any), whether trades come from a broker and whether broker connections or devices registered for notifications exist. We use email addresses only to exclude our own test and staff accounts.
• Process: The query runs with read-only access. The result is weekly counts without names, email addresses or user IDs.
• Recipients: Google Cloud as a processor (9.6).
• Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is to improve our service and run it economically. You can object (section 14).
• Retention: The source data follows the periods in section 6. We keep the aggregated results for 3 years.

11. Instagram presence

We maintain a company profile on Instagram (https://www.instagram.com/trademate_com/), a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). In the app, we link to it under Settings → "Follow us on Instagram". The app itself does not transmit any data in this context; only when you tap the link does Instagram or your browser open.

• Processing by Meta: When you visit our profile, Meta processes your data (e.g. IP address, device and browser data, your Instagram account if you are signed in) under its own responsibility in accordance with Meta's privacy policy.
• Our processing: If you follow us, comment or send us a message, we see your Instagram name, your profile picture and your message. We do not store messages and comments that you send us on Instagram outside Instagram; they remain there until you or we delete them.
• Statistics ("Insights"): Our profile is a professional account; Meta therefore automatically creates aggregated statistics (Insights) on the use of the profile, which we can view. Insofar as Meta creates statistics on the use of our profile and provides them to us, we are joint controllers with Meta (Art. 26 GDPR; CJEU, judgment of 5 June 2018, C-210/16). The details are set out in the "Page Insights Controller Addendum" (https://www.facebook.com/legal/terms/page_controller_addendum). Under it, Meta assumes primary responsibility, in particular for the information obligations, data subject rights and the notification of personal data breaches; the lead supervisory authority is the Irish Data Protection Commission. You can exercise your rights under Art. 26(3) GDPR against both Meta and us; we forward requests concerning the statistics to Meta within 7 days. We receive only aggregated statistics, not data on individual persons.
• Third country: Meta may transfer data to Meta Platforms, Inc. in the USA; that company is certified under the DPF.
• Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is presenting our service and communicating with interested parties.

12. AI-assisted analysis; no automated individual decision-making

We calculate the statistics and analyses in the app on your device or on our server exclusively for you, from your own data.

Beyond this, M8 AI (9.7) has aggregated metrics of your trading behaviour analysed by a language model from Anthropic. In the process, personal aspects are analysed automatically, in particular behavioural patterns such as results by time of day, by position size or after losses; M8 AI therefore constitutes profiling within the meaning of Art. 4(4) GDPR. This is how it works: our server calculates the metrics listed in 9.7, sends them to the model with a fixed set of instructions, and the model generates a text with observations, strengths and rule suggestions from them.

The result is a non-binding suggestion. You alone decide whether to adopt a suggestion; you can also choose not to use the function at all. The texts are AI-generated and may be factually wrong, incomplete or misleading; please check statements yourself before relying on them. They are not investment or financial advice and contain no recommendation to buy or sell financial instruments; they relate exclusively to your own past trading behaviour.

We do not take any decision based solely on this automated processing that produces legal effects concerning you or similarly significantly affects you (Art. 22(1) GDPR). In particular, we do not use M8 AI analyses for decisions about your contract, your access to the app, your terms or your creditworthiness.

The check whether a subscription is assigned to your account (9.11), the check of the minimum age based on the date of birth you have given (13), the removal of broker connections under the 14-day rule (9.8), the check whether your Apple Account has already used the free trial (9.11) and the selection of whether you are offered a survey (9.19) also run automatically, but without any evaluation of you as a person.

13. Minors

Trademate is intended for persons aged 16 or over. At registration, we ask for your date of birth; the picker does not allow a date that would make you younger than 16, and our server does not store such a date. For accounts without a date of birth, the app asks for it at launch. If the date of birth of an account shows an age under 16, the account cannot be used; the app then only offers to delete it or to sign out. If we learn in another way that an account is being used by a person under 16, we delete it. If you are under 18, you need the consent of your parents or legal guardian for a subscription (see our Terms of Service); you can use Apple's "Ask to Buy" feature for this.

The app asks the question about usage analytics and advertising measurement (9.12) at first launch, before you create an account and before we know your age. By tapping "Allow" you confirm that you are at least 16 years old; if you are younger, choose "Not now". If you state in the app that you are under 16, or if the date of birth of your account shows an age under 16, the app immediately switches off usage analytics and advertising measurement and resets the analytics identifiers on your device. Data that Google has received up to that point can then no longer be attributed to any identifier on your device and is deleted once the retention period stated in 9.12 has expired.

14. Your rights

Under the GDPR, you have the following rights:

• Access (Art. 15 GDPR) to the data we process about you, including a copy.
• Rectification (Art. 16 GDPR) of inaccurate or incomplete data. We change your name and email address on request, as this is not possible in the app.
• Erasure (Art. 17 GDPR). You can delete your account yourself in the app (9.18).
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR). The app does not currently offer an export function (exception: your check-in data, 9.5). On informal request by email, we will provide your data to you as a JSON or CSV file.
• Objection (Art. 21 GDPR), see the box below.
• Withdrawal of consent (Art. 7(3) GDPR) at any time with effect for the future, as easily as you gave it. The lawfulness of processing carried out before the withdrawal remains unaffected. You withdraw consent:
  • M8 AI: Settings → "M8 AI" → "Turn off M8 AI" (9.7);
  • usage analytics and advertising measurement in the app: Settings → General → "Share Usage Analytics" (9.12);
  • product emails: Settings → General → "Notifications" → "Email updates" (9.2);
  • emotion data on our server: Settings → "Trading Settings" → "Sync emotion entries" (9.4);
  • services on the website: "Cookie settings" link in the footer of every page (8.2);
  • delivery of notifications via Apple: per account and device under Settings → General → "Notifications" → main switch off (9.10); the main switch only affects notifications, not the "Email updates" switch in the same menu;
  • transfer to providers and brokers in third countries: by email; to be obtained by 30 November 2026 (9.8);
  • daily check-in: Settings → "Daily check-in" → "Check-in consent" (9.5);
  • any consent also informally by email.

To exercise your rights, an informal message to [email protected] is sufficient. To protect your data, we may ask you to prove your identity, for example by writing from the email address of your account.

Right to lodge a complaint (Art. 77 GDPR): Without prejudice to any other remedy, you can lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority competent for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate)
Hintere Bleiche 34, 55116 Mainz, Germany
Phone: +49 6131 8920-0
Email: [email protected]
https://www.datenschutz.rlp.de

15. Obligation to provide data

There is no statutory obligation to provide us with data. However, for registration and for using your own data in Trademate, we need:

• your email address and a password, or sign-in via Apple or Google (9.1),
• your date of birth to verify the minimum age (9.2, 13).

This information is necessary for entering into and performing the user contract; without it, we cannot set up an account for you. In onboarding without the sample journal (e.g. on the Mac), you must also select your trading experience and at least one goal to complete onboarding; we only display this information in your profile, and you can change it later in Settings (9.2). All other information (e.g. profile photo, gender, trading frequency, notes, photos, emotion data, broker connections) is voluntary; if you do not provide it, only the respective function is unavailable to you. Consents (section 3) are voluntary; you can also use Trademate without them, only the respective function (e.g. M8 AI) is not available.

16. Changes to this privacy policy

We update this privacy policy when our data processing or the legal situation changes. You can find the current version on our website at https://trademate-app.com/privacy (German version: https://trademate-app.com/datenschutz); the app links there, to the German version if the app language is German. If a processing operation based on your consent changes materially, we will ask for your consent again in the app.