Privacy Policy

1. Summary

SoloTrade.io is a small, self-funded platform. We collect the minimum we need to run the service: your name, email address and profile picture from Google when you sign in; the strategies, backtest runs and practice sessions you create; anything you send us through the feedback form; and ordinary server logs.

We do not sell your data and we do not run advertising. We do not use tracking cookies: the only analytics we use is Google Analytics, and it stays off until you accept it. If you use the AI strategy review, a description of your strategy and its results is sent to our AI provider (DeepSeek) so the review can be generated — that is described in detail below.

2. Who is responsible for your data

SoloTrade.io is the controller for the personal data described in this policy — that is, we decide what is collected and why. You can reach us about anything on this page using the contact details at the end of it, and we will respond.

3. What we collect

• Account data, from Google sign-in: your name, email address, profile picture URL and the Google account identifier. We never see or store your Google password. NextAuth also stores a session record so you stay signed in.
• Content you create: the strategies you build (rules, position model, cost assumptions), your backtest runs and their results, your training-ground sessions, and any notes or plans you save.
• Feedback you send: the message you write, the category you pick, the page you were on, and — if you are signed in — a link to your account so we can reply. Your reply thread is visible to you on your account page.
• Technical data: the IP address, browser user-agent and timestamps recorded in ordinary web server logs when your browser makes a request. These are kept for security and troubleshooting.
• Payment data: payments are processed by our payment provider (Creem). We receive the payment status and the identifiers needed to enable a plan — never your full card details.
• Analytics data, only if you accept it: a random client identifier and the pages you visit, collected by Google Analytics. Declining — or withdrawing consent later — stops the collection.

4. How we use it

• To create and secure your account and keep you signed in.
• To run backtests and practice sessions, and to store the results you asked us to keep.
• To generate the AI strategy review, when you use that feature.
• To reply to your feedback and to diagnose problems you report.
• To keep the service safe and available — detecting abuse, scraping, or attempts to bypass limits.
• To understand, in aggregate, which features are used, so we know what to improve — from our own server logs, and (only if you accept it) Google Analytics.

5. AI features and what gets sent to the model provider

When an AI strategy review runs, we send the model provider a description of your strategy — its rules, position sizing, cost assumptions, the data window and the result metrics — together with a fixed instruction set. We do not send your name, email address or any other account identifier with it.

The review text that comes back is stored so you can read it again without paying for it twice. It is not used to train SoloTrade's own models, and it is not shown to other users.

6. Third parties that process data for us

Running the platform means relying on other companies. These are the categories and purposes; each one only receives what it needs for its job.

• Google — account sign-in and identity. Receives your credentials and returns your profile data to us.
• DeepSeek (AI provider) — generates the strategy review. Receives the strategy description and results described above.
• Twelve Data and Binance — historical market data. We request prices from them; they do not receive your personal data.
• Finnhub (financial news), FMP (earnings and dividend calendar), Pexels and Pixabay (article imagery) — content sourced by our scheduled jobs, not by your requests. No personal data is sent to them.
• Our hosting provider — the server on which the site, the database and the data files live.
• Google Analytics — measures aggregate page usage. Receives a random client identifier, the pages you visit and technical details about your browser, and only after you accept it in the consent banner.

7. Legal bases for processing

Where the GDPR applies, we rely on: performance of a contract (running the service you signed up for, including backtests and storage of your results); legitimate interests (keeping the service secure, preventing abuse, and understanding aggregate usage from our own logs); and consent where it is required — which today means Google Analytics, since it stays off until you accept it and you can withdraw at any time.

8. How long we keep things

• Account data: while your account exists, plus a short period afterwards in routine backups.
• Backtest and practice records: until you delete them, or until your account is deleted.
• Stored AI reviews: kept alongside the run they belong to, and removed when that run is deleted.
• Feedback, including our reply: until you delete it or your account is deleted.
• Server logs: for a short operational window, unless a security incident requires us to keep specific entries longer.

9. Your rights — and how to actually use them

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to certain processing, receive a portable copy, and withdraw consent. We do not sell or share personal data for advertising, so there is nothing to opt out of on that front.

Some of these you can exercise directly, without asking: on your account page you can delete individual backtest records, practice sessions and feedback entries — and each deletion removes the stored record together with the data files attached to it. Your preferences and account details are editable in the same place.

For anything else — for example, deleting your whole account, or getting a copy of your data — send us a request using the contact details at the end of this page and we will action it.

10. Security

We use industry-standard measures appropriate to a service of this size: encrypted connections (HTTPS), passwordless sign-in, so there is no password of ours to leak; administrative access behind a separate secret; and access tokens stored in httpOnly cookies that client-side scripts cannot read. No system is perfectly secure, so we cannot promise absolute security.

11. International transfers

Our servers and the providers listed above may process data outside your country, including in the United States. Where personal data leaves the EEA or the UK, we rely on the transfer mechanisms those providers put in place, such as standard contractual clauses.

12. Children

The service is not directed at children, and we do not knowingly collect personal data from anyone below the minimum age set out in our Terms of Service. If you believe a child has created an account, tell us and we will remove it.

13. Changes to this policy

If we change how we handle personal data, we will update this page and its “last updated” date, and we will give notice on the site before the change takes effect if it is material. Continuing to use SoloTrade after that means you accept the updated policy.