← NOXX

Privacy policy

What personal data we hold, why, and what you can do about it.

Last updated: [DD MONTH YYYY]

Draft — not yet in force. This page is awaiting company details (company name, tax ID, registered address, company registry, contact email, privacy email, hosting provider, database provider, last updated) and review by a qualified lawyer. Anything shown in square brackets is a placeholder.

1. Controller

The data controller is [COMPANY LEGAL NAME, S.L.], tax ID [CIF / NIF], registered address [STREET AND NUMBER], [POSTCODE] [CITY], [PROVINCE], Spain. For anything in this policy, write to [privacy@example.com].

This policy is given under Regulation (EU) 2016/679 (GDPR) and Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD).

2. What we collect

When you create an account

  • your email address;
  • an authentication record held by our authentication provider — we never see or store your password in readable form;
  • a display name, if you set one.

What you put in the journal

  • trades you record: instrument, direction, prices, size, profit and loss, times, tags and notes;
  • accounts you define, including a name, broker or prop firm, and starting balance;
  • screenshots you upload, stored in a private bucket readable only by your account;
  • day notes.

We do not connect to your broker. Everything in the journal is what you typed or uploaded.

Preferences

Your timezone, currency/percentage choice and alert settings. Some are stored on your own device in browser storage; those never reach our servers.

What we do not collect

No advertising identifiers, no third-party analytics or tracking pixels, no behavioural profiling, and no special-category data. We do not sell personal data and never have.

3. Why, and on what legal basis

  • To provide the service — holding your account and journal so you can sign in and see your records. Legal basis: performance of a contract (art. 6(1)(b) GDPR).
  • To keep the service secure and working — authentication, abuse prevention, diagnosing faults. Legal basis: our legitimate interest in a secure, functioning service (art. 6(1)(f)).
  • To contact you about the service — material changes, security notices. Legal basis: contract and legitimate interest.
  • To meet legal obligations, where one applies. Legal basis: art. 6(1)(c).

We do not send marketing email. If that ever changes it will be on opt-in consent you can withdraw at any time.

4. Who processes it

We use a small number of providers, each bound by a data processing agreement and acting only on our instructions:

  • [HOSTING PROVIDER, e.g. Vercel Inc.] — application hosting and delivery.
  • [DATABASE PROVIDER, e.g. Supabase Inc.] — database, authentication and file storage.

Economic calendar data is fetched from a third-party feed by our server. That request carries no personal data about you.

5. International transfers

Our providers may process data outside the European Economic Area. Where they do, the transfer relies on an adequacy decision or on the European Commission’s Standard Contractual Clauses together with any additional safeguards required. You can ask us for details of the mechanism in use.

6. How long we keep it

  • Account and journal data — while your account is open.
  • After you delete your account — removed from live systems promptly, and from encrypted backups as those backups age out, within 30 days.
  • Records we must keep by law — for the period the law requires.

7. Your rights

Under the GDPR you may ask us to:

  • confirm what we hold and give you a copy (access);
  • correct anything inaccurate (rectification);
  • delete your data (erasure);
  • restrict or object to processing based on legitimate interest;
  • provide your data in a portable, machine-readable format;
  • withdraw consent where processing relies on it, without affecting what came before.

Write to [privacy@example.com]. We reply within one month, extendable by two further months for complex requests, and will tell you if we need that extension. We may ask you to confirm your identity.

If you think we have handled your data wrongly, you can complain to the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es — or to the supervisory authority where you live. We would rather you came to us first.

8. Cookies and browser storage

We use no advertising or analytics cookies. What we do use:

  • Authentication cookies, set when you sign in, so you stay signed in. Strictly necessary — the service cannot work without them, so no consent banner is required under art. 22.2 LSSI.
  • Browser local storage for preferences (timezone, currency unit, alert settings, sidebar state). This stays on your device and is never sent to us. Clearing site data removes it.

9. Security

Data is encrypted in transit. Database access is restricted per user by row-level security, so one account cannot read another’s rows. Screenshot storage is private, with access granted only through short-lived signed links issued to the owning account. No system is perfectly secure; if a breach occurs that is likely to put your rights at risk, we will notify you and the AEPD as the GDPR requires.

10. Children

NOXX is not for anyone under 18. We do not knowingly collect their data; if we learn we have, we delete it.

11. Changes

We may update this policy. The date at the top shows the current version; material changes will be notified by email or in the application before taking effect.

12. Contact

[privacy@example.com]
[COMPANY LEGAL NAME, S.L.], [STREET AND NUMBER], [POSTCODE] [CITY], [PROVINCE], Spain