Privacy Policy

Last updated: [DATE]

This Privacy Policy explains what information SignalForge (operated by [Legal Entity Name], "we", "us") collects, how we use it, and the choices you have. SignalForge is a paper-trading journal — we never require or process real brokerage credentials, bank details, or KYC identity documents, because no real money ever moves through the Service.

1. Information we collect

Category	Examples	Why
Account data	Email address, hashed password	Authentication, account recovery
Billing data	Subscription plan, billing status	Handled by our payment processor (Stripe) — we do not store card numbers ourselves
Usage data you create	Trades you open/close, signals you act on, watchlist entries, Discipline Score inputs	Core product functionality — this is your journal
Technical data	IP address, browser type, session cookie (sf_token)	Keeping you logged in, basic abuse prevention

2. How we use information

• To operate and maintain your account and journal
• To process subscription billing (via Stripe)
• To send account-related emails (e.g. trial ending, password reset)
• To monitor for abuse and keep the Service secure
• To improve the product based on aggregate, non-identifying usage patterns

We do not sell your personal data, and we do not share your individual trade/journal data with other customers or third parties for marketing purposes.

3. Data isolation between customers

Each customer's trades, signals, and journal entries are logically isolated by account (tenant) at the database layer. Other customers cannot see your data, and you cannot see theirs.

4. Third-party services

• Stripe — payment processing. Stripe's own privacy policy governs data you enter directly into their checkout.
• Binance API / Pyth Network — public market price data only. No personal account data is sent to these providers.
• Email/notification providers (if you enable alerts) — used only to deliver the alerts you opt into.

5. Cookies

We use a single essential session cookie (sf_token) to keep you logged in. We do not use third-party advertising or tracking cookies.

6. Data retention

We retain account and journal data for as long as your account is active. If you close your account, we delete or anonymize your personal data within a reasonable period, except where retention is required for legal or accounting purposes (e.g. billing records).

7. Your rights

You can request a copy of your data or request deletion of your account at any time by emailing [support email]. Depending on your location, you may have additional rights (access, correction, portability, objection) under applicable law (e.g. GDPR, CCPA).

8. Security

Passwords are stored hashed, never in plain text. Access to production data is limited to what's needed to operate the Service. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Children's privacy

The Service is not directed to anyone under 18. We do not knowingly collect data from minors.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Service or by email.

11. Contact

Questions about this Privacy Policy or your data? Email [support email].