Market MasteryPrivacy Policy
Last updated 27 September 2026
This explains what Market Mastery stores about you, why, where it lives, and how to get rid of it. It describes what the software actually does rather than what a template says it might.
1. Who we are
Market Mastery is a trading journal operated by Market Mastery Journal Ltd, a company registered in England and Wales, company number 17476570, whose registered office is at 195-197 Wood Street, Suite RA01, London E17 3NU, United Kingdom. That company is the data controller for the personal data described here, and is registered with the UK Information Commissioner's Office under reference ZC259458.
Contact: hello@marketmasteryjournal.com, or by post at the registered office above.
2. What we collect
| Data | Where it comes from |
|---|---|
| Username, email address, password (hashed with argon2id - never stored in a readable form) | You, at registration |
| If you turn on Face ID / Touch ID unlock: a public key for each device you add, the device's name, and when it was added and last used. Never your face or fingerprint - your device checks those itself and they never leave it. | Your device, when you turn it on in Settings |
| Trades, notes, playbooks, tags, account names and balances | You, or synced from a broker you connect |
| Screenshots you attach to trades | You |
| Broker credentials and session tokens | You, when connecting an account |
| Session records: sign-in time, last activity, browser user-agent | Automatically, when you sign in |
| Subscription status, renewal date, Stripe customer reference | Stripe, when you subscribe |
| Waitlist: your email address, whether you agreed to marketing, and when | You, if you join the waitlist |
We do not use advertising trackers or third-party analytics, and we do not sell or share your data with anyone for marketing.
We never see your card details. Payment happens on Stripe's own pages; your card number never reaches our servers.
3. Why we are allowed to hold it
- To perform our contract with you - your account, your journal, your subscription. Without this data there is no product.
- Legitimate interests - keeping the service secure, preventing abuse, and keeping backups so your journal survives a failure.
- Legal obligation - retaining payment and tax records for the period UK law requires.
4. The waitlist
If you give us your address on the waitlist, we store it to tell you about the launch and about the product. Nothing else, and it is never sold or shared.
The marketing box is not ticked for you. If you leave it alone we keep your address on the list but send you no marketing. If you tick it, we record the wording you agreed to and the moment you agreed - because consent to marketing has to be evidenced, not assumed.
Every marketing email carries a one-click unsubscribe link. Using it stops the email immediately. We keep the row, marked unsubscribed, rather than deleting it: a deleted record cannot prove you asked us to stop. Ask us and we will erase it entirely.
5. Broker connections
If you connect a broker account, we store the credentials or session token needed to fetch your trade history. These are encrypted at rest with a key held separately from the database.
We use this access only to read your trading history. We never place, modify or cancel trades, and we never move money.
You can disconnect a broker at any time from the Accounts page, which deletes the stored credentials. Trades already imported stay in your journal until you delete them.
6. Who else touches your data
| Processor | What for | Where |
|---|---|---|
| Render | Application hosting and the database | EU (Frankfurt) |
| Cloudflare R2 | Screenshot storage, and encrypted backups | EU |
| Stripe | Payments and subscription billing | EU / US, under approved transfer safeguards |
| Resend | Sending confirmation and password-reset email | EU / US, under approved transfer safeguards |
Each is bound by its own data processing terms and may use your data only to provide that service to us.
7. How long we keep it
- Your journal - until you delete it, or until you delete your account.
- Backups - a nightly snapshot is kept for 30 days, then automatically destroyed. A deleted account may persist in backups for up to 30 days before ageing out.
- Payment records - retained by us and by Stripe for as long as UK tax law requires, currently six years.
- Sign-in sessions - expire after 30 days, or immediately when you sign out.
8. Your rights
Under UK GDPR you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; or provide it in a portable format. You can also withdraw consent where we rely on it.
Two of these need no request at all. Export is built into the app - Settings, then export, and you get everything you have entered as a file you keep. Deletion is a button, described below.
For anything else, email us. We will respond within one month.
9. Deleting your account
Settings → Delete account. You will be asked for your
password and to type DELETE, because a session cookie alone should
not be enough to destroy your journal.
This is immediate and cannot be undone. It removes your account, every trade, note and playbook, every screenshot from storage, every broker connection, and every sign-in session. Any active subscription is cancelled first, so you are not billed for an account that no longer exists.
Backups age out within 30 days as described above. Records we must keep for tax purposes are retained by Stripe.
Export anything you want to keep before you do this. There is no recovery.
10. Security
- Passwords are hashed with argon2id. We cannot read them, and a database breach would not reveal them.
- Broker credentials are encrypted at rest with a separately held key.
- Face ID / Touch ID unlock uses passkeys (WebAuthn). We keep only a public key, which cannot unlock anything on its own. Adding a device needs your password, and we email you whenever one is added; you can remove any device in Settings.
- All traffic is served over HTTPS.
- Session cookies are HttpOnly, Secure and SameSite, so a script on a page cannot read them.
- Every query for your data is filtered by your user ID. No user can read another user's journal or screenshots.
- Screenshot storage is private - files are not reachable by URL and are served only after checking they belong to you.
No system is perfectly secure. If a breach affects your rights we will tell you, and the Information Commissioner's Office, without undue delay.
11. Cookies
We set one cookie: your sign-in session. It is strictly necessary to keep you signed in, so it needs no consent banner.
We also use your browser's local storage to remember display preferences - your theme, your chosen currency, which panels you have open. That never leaves your device.
No advertising cookies. No third-party trackers. No analytics.
12. Changes
If this policy changes in a way that materially affects you, we will email you before it takes effect. The date at the top always reflects the current version.
13. Complaints
Email us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113.