Privacy Policy

This policy explains what personal data PipLog ("we", "us") collects when you use piplog.pro, the web app, the PipLog EA and the PipLog Link service, why we collect it, and the choices you have. Contact us about privacy at support@piplog.pro.

If a translation of this policy differs from the English version, the English version applies.

1. The short version

• We collect what we need to run your trading journal, and nothing for advertising.
• We don't sell your data, and we don't show ads.
• Your journal is private to you. It is shared only if you choose to share it.
• We never ask for your broker account password.

2. What we collect

Account data

Your email address, name (optional), password (stored only as a one-way hash), language and settings, and the dates you signed up and last logged in.

Trading and journal data

What you import, sync or type in: trading accounts (name, broker, currency, platform), trades (symbol, direction, volume, prices, times, profit, swap, commission, ticket numbers), price candles (open, high, low, close, volume and spread per bar) that you upload for charts and the market-cycle report, and your journal content: notes, setups, mistakes, emotions, ratings, tags, chart screenshots, checklists, daily journals and backtests.

PipLog EA and Link data

If you use the EA: the MetaTrader 4 or 5 account number (login) and server you register, the EA version and when it last connected, the trading limits set on the EA's panel (daily loss limit, trades per day, open positions), and the trades, history, chart screenshots and price candles it sends. The EA does not send your broker password.

Payment data

When you subscribe: the plan, amount, currency, invoice ID and payment status from our payment provider, Plisio. We don't receive card details. Crypto payments are recorded on a public blockchain by their nature.

Signup source

When you first visit the site, a cookie remembers the campaign that brought you (utm parameters or a referral code), the first page you saw and the website that linked to you (for example google.com). When you register, we save this on your account so we know which channels work. The cookie is deleted at registration.

Invitations and promo codes

If you sign up with a friend's invite code, we record who invited you, and later whether you became active (imported trades or linked the EA) and whether you paid, so we can give your friend their reward days. Your friend only sees counts, never your name or email. If you use a promo code, we record which one. To stop people inviting themselves, we keep a one-way, keyed hash of the IP address you last signed up or signed in from. It can be compared with another hash but can't be turned back into your IP address.

Emails

We send account emails (a welcome email and password reset links) and, unless you turn them off, tips about getting started, a reminder before your trial ends, a weekly summary for Free accounts and a note if you haven't been back for a while. Some of these use your trading stats, for example your net result for the week or your costliest habits. We record which emails we sent you and when, so you never get the same one twice, and we keep a copy of the subject and text of every email and Telegram message we send you (and of the commands you send the bot) so we can check that they arrived and help you when something goes wrong. You can turn the optional emails off in Settings or with the unsubscribe link in any of them. For a password reset we store only a one-way hash of the link, and it expires after one hour.

Technical data

Your IP address and browser details reach our hosting provider with every request. We use the IP address briefly for security and rate limiting. We keep an activity log of what happens in your account: sign-ins (also failed attempts with your email address), sign-ups, password changes and the changes you make (for example adding, editing or deleting a trade, an import, or a settings change). Each entry has the time, your browser and system, your country, and a one-way, keyed hash of your IP address, never the IP address itself. We use it for security and support. If you turn on notifications, we store your browser's push subscription. If you connect the Telegram bot, we store your Telegram chat id and username so we can send you the reports and warnings you chose.

Analytics

We use Vercel Web Analytics and Speed Insights to count page views and measure page speed; they don't use cookies. We also use Microsoft Clarity, which records how pages are used (clicks, scrolling and session replays) so we can find and fix confusing screens. Text you type into form fields is masked before it leaves your browser, but a replay can show other content that was on the screen. Microsoft processes this data as described in the Microsoft Privacy Statement.

3. Why we use it

• To provide the Service (performing our contract with you): your journal, analytics, imports, EA licensing and sync, notifications you ask for, and support.
• For billing: processing payments and keeping payment records.
• For security: preventing abuse, fraud and unauthorised access (our legitimate interest).
• To improve PipLog: understanding which pages and channels bring people in, which features are used and where people get stuck (our legitimate interest, or your consent where the law requires it).
• To follow the law: for example tax and accounting records, or a valid legal request.

We don't use your trading data to trade, advertise, or train third-party AI models.

4. Who can see your data

• You. Your journal is private by default.
• Our service providers, who process data only on our instructions:

• PipLog administrators, only when needed for support, security or billing.
• Authorities, only when the law requires it.

These providers may process data in the United States, the European Union and other countries. Where required, transfers are covered by appropriate safeguards such as standard contractual clauses.

5. How long we keep it

• Account, trading and journal data: while your account exists. When you ask us to delete your account, we delete it within 30 days. Copies in backups expire within a further 30 days.
• Payment records: as long as tax and accounting law requires.
• Signup-source cookie: up to 60 days, or until you register.
• Invitation records and the IP hash: while your account exists. The IP hash is replaced each time you sign in.
• Activity log and message history: 180 days, then deleted. Entries about your account are also deleted when your account is.

6. Cookies and local storage

PipLog sets only the cookies below, and none of them are for advertising.

Microsoft Clarity sets its own cookies (such as _clck and _clsk, for up to a year) to group page views into a session. The app also stores a few preferences in your browser's local storage, such as the theme and checklist state.

7. Your rights

Depending on where you live (for example under the GDPR or UK GDPR), you can ask to access, correct, delete or export your data, to restrict or object to some uses, and to withdraw consent you gave. You can change your profile in Settings and export your trades as CSV at any time. For everything else, email support@piplog.pro from your account's email address. We will reply within 30 days.

You also have the right to complain to your local data protection authority.

8. Security

We use HTTPS everywhere, store passwords only as hashes, keep sign-in cookies inaccessible to scripts, limit every database query to the signed-in user's own data, store screenshots privately, and encrypt our backups. No system is perfectly secure, so please use a strong, unique password.

9. Children

PipLog is for adults. We don't knowingly collect data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.

10. Changes

We may update this policy. The date at the top shows the latest version. If a change is significant, we will tell you in the app or by email before it applies.

11. Contact

PipLog, support@piplog.pro.