Privacy Policy
1. Information we collect
- Account data: email address, display name, and a hashed password (scrypt — we cannot read your password).
- Trading and journal data: trades, fills, tags, notes, settings, strategy criteria, and prop-account parameters you enter, import, or sync.
- Broker/platform credentials (optional): credentials or tokens you supply to sync connected accounts, encrypted at rest with AES-256-GCM and used only for read-only retrieval of your fills and account data.
- Billing references: a Stripe customer ID and subscription status. Full card details go directly to Stripe and never reach our systems.
- Technical data: session cookies (HttpOnly, Secure — used only to keep you signed in; no advertising or cross-site tracking cookies) and standard server logs (IP address, timestamps, request paths) kept for security, debugging, and abuse prevention.
- Communications: messages you send us (support, feedback).
2. How we use information
We use your information only to: provide and operate the Service (authentication, storage, analytics on your own data, account sync, rule tracking); process subscriptions through Stripe; send transactional email (verification, password reset, billing and service notices); secure, debug, and improve the Service, including through de-identified aggregate statistics; and comply with law. If you use AI analysis features, aggregated trading statistics — never credentials, never payment details, never your email — are sent to our AI provider to generate the analysis. The conversational coach ("Fabius") is the exception to "aggregated": it sends your individual coaching conversation history and detected behavioral patterns, as described in Terms of Service Section 11 and in "Service providers" below. Credentials, payment details, and your email address are never sent to the AI provider by any feature.
3. What we do not do
We do not sell or rent your personal information. We do not run ads or share data with advertisers or data brokers. We do not share your trading records with prop firms, brokers, employers, or other users. We do not use your individually identifiable data to trade or to build products unrelated to serving you.
4. Service providers
These providers process data on our instructions, only as needed for their function: Render (application hosting, US); Cloudflare (DNS and network); Stripe (payments); Resend (transactional email); Anthropic (AI coaching features — aggregated trading statistics for thesis, critique, and recap analysis, and, for the conversational coach "Fabius," your individual conversation history and detected behavioral patterns; conversation data is processed per Anthropic's privacy policy at anthropic.com/privacy; DPA acceptance pending before Fabius activation); and the broker/platform APIs you choose to connect (e.g. ProjectX/TopstepX, Tradovate). We may also disclose information if required by law or to protect the rights, safety, or security of War Board, our users, or the public, and in connection with a merger, sale, or reorganization of the business (your data remains subject to this policy or one at least as protective).
5. Retention and deletion
We keep your data while your account exists. If you delete your account, your trades and settings are permanently removed from active systems; encrypted backups containing residual copies roll off on our rotation schedule. Server logs are retained for a limited period for security purposes. You can export your data (CSV/JSON) at any time before deletion.
6. Security
Passwords are hashed with scrypt; broker credentials are encrypted at rest with AES-256-GCM; data in transit is protected by HTTPS/TLS; sessions use HttpOnly, Secure cookies with 30-day expiry; access to production systems is restricted. No security is absolute. If a breach affects your personal information we will notify you and regulators as applicable law requires.
7. Your rights and choices
You can access, correct, export, and delete your data directly in the app, or by emailing support@war-board.com. Depending on your state of residence (including under the Delaware Personal Data Privacy Act and similar state laws), you may have statutory rights to access, correct, delete, obtain a portable copy, and opt out of certain processing; we honor verified requests as those laws require and will not discriminate against you for exercising them. We do not sell personal data or process it for targeted advertising.
8. Children
The Service is for adults 18 and older. We do not knowingly collect personal information from anyone under 18; if we learn we have, we will delete it.
9. International users
The Service is operated from the United States and intended for U.S. users. If you use it from elsewhere, you consent to processing and storage in the United States.
10. Changes; contact
Material changes to this policy will be announced in-app or by email before they take effect. Questions or requests: support@war-board.com.