Privacy Policy

1. What personal data we collect

When you use SubTrades, we collect:

• Your email address, to create and secure your account
• Trade data you import by CSV or broker integration
• Journal entries and notes you write in the app
• Basic usage data, such as pages visited and features used, to run and improve the product

We do not collect your broker login password. We only ask for data we need to provide the service.

2. Why we collect it

• To provide, secure, and improve the SubTrades service
• To generate AI insights based on your own trading data
• To send you important account notices

We do not sell your data. We do not use your trade data for advertising.

3. Consent and how to withdraw it

We process your personal data on the basis of the consent you give when you sign up and use SubTrades. You can withdraw your consent at any time from your account settings or by emailing hello@subtrades.in. Withdrawing consent does not affect processing we already carried out lawfully before you withdrew. After you withdraw, we stop processing your data and delete it, unless a law requires us to keep certain records.

4. Who can use SubTrades

SubTrades is only for users who are 18 years or older. Trading in financial markets, including futures and options, is restricted to adults. We do not knowingly collect personal data from anyone under 18. If we learn that we hold data belonging to a minor, we will delete it.

5. How long we keep your data

We keep your journal and account data for as long as you have an account with us, so it is there whenever you come back, even after a long break. We do not delete it just because you have been inactive. We permanently delete your personal data within 30 days when you ask us to, by deleting your account or withdrawing consent, unless a law requires us to keep certain records for longer, such as payment records that tax law requires us to retain.

6. Where your data is stored

Your data is stored using Supabase (PostgreSQL) on servers located in Mumbai, India. We use row-level security, so your data is reachable only through your own account.

7. Third-party services and transfers

We use the following services to run SubTrades:

• Supabase, for database and authentication, hosted in Mumbai, India.
• OpenAI (ChatGPT API), in the United States, to generate your AI reflection questions and insights. We send the relevant trade data and the notes you write, so the AI can respond to your actual trading. We do not send your name, email, phone number, or any government ID to OpenAI. Under OpenAI's API terms, this data is not used to train OpenAI's models and is retained only briefly for abuse monitoring before deletion. The DPDP Act permits such transfers, except to countries the Government of India restricts. If you would rather your notes were not processed this way, email hello@subtrades.in.

8. Cookies and analytics

We keep browser storage to a minimum and do not use advertising or cross-site tracking cookies:

• Product analytics (PostHog), to understand which features are used so we can improve the app. This is stored in your browser's local storage, not in advertising cookies.
• One functional cookie that remembers your sidebar layout preference in the app.
• Your login session, kept in your browser's local storage (not a cookie) to keep you signed in.

You can clear all of this at any time by clearing your browser's storage for the site. We do not sell your data or use it for advertising.

9. How we protect your data

We use reasonable security safeguards, including encryption of data in transit, access controls, and row-level security, to protect your data against unauthorised access, loss, or misuse.

10. Your rights under the DPDP Act

You have the right to:

• Access the personal data we hold about you
• Correct, complete, or update inaccurate or outdated data
• Request deletion of your account and all associated data
• Nominate another person to exercise your rights if you die or become unable to do so
• Withdraw your consent at any time
• Raise a grievance and have it addressed

To exercise any of these rights, email hello@subtrades.in. We will respond within the timelines required under the DPDP Act and its Rules.

11. Data breaches

If a personal data breach occurs, we will notify the Data Protection Board of India and the affected users, as required by the DPDP Act.

12. Grievance Officer and complaints

If you have any question or grievance about how we handle your data, contact our Grievance Officer:

Ravi, Grievance Officer
Email: hello@subtrades.in

We will respond within the timelines set under the DPDP Rules. If you are not satisfied with our response, you have the right to complain to the Data Protection Board of India.

13. The Echo browser extension

SubTrades Echo is an optional Chrome extension that lets you tag your emotional state and add short notes while you trade. When you connect it to your account, Echo receives your SubTrades account details (such as your email) and a secure access token, and stores that token on your device so it can sync on your behalf.

Echo syncs the tags and notes you choose to enter to your own SubTrades journal over an encrypted connection, where they are matched to your trades. That is all it sends. Echo does not read your broker screen, place trades, or access your money, and it never sells or shares your data with third parties.

You can disconnect or remove the extension at any time. Removing it stops any further syncing and clears the data Echo stored on your device.

14. Changes to this policy

We may update this policy from time to time. If we make a significant change, we will update the date below and, where appropriate, notify you.

15. Contact

For any privacy question or request: hello@subtrades.in