Legal
Privacy Policy
Your trading records stay on your device. Cloud sync is encrypted before it leaves your browser, with a passphrase we never receive and cannot recover.
The short version
Your trading data never reaches us in readable form
QuantPeak runs in your browser and stores your trades, journal and settings on your own device. We operate no user database and no server-side copy of your records. If you switch on cloud sync, your data is encrypted on your device with a passphrase we never receive, so what we hold is ciphertext we cannot open.
That architecture is the point of the product, not a policy position, and it means most of what a privacy policy usually has to promise simply does not arise here: there is nothing readable to leak, sell, or hand over.
1. What we collect
Information you give us
- Nothing to use the terminal. No name, no email and no account is needed to import trades and use QuantPeak on your device.
- Billing details go to Whop, not to us. Whop is our payment provider and holds the customer relationship, including your email and payment method. We never see or store your card details.
- If you use “Sign in with Whop”. That sign-in asks Whop for your basic identity (the OpenID profile and email scopes) so we can read your Whop account identifier and check whether it holds an active membership. That check happens inside a single request, in memory. We do not store your identifier, your name or your email address. What lands back on your device is a signed session token carrying only a membership id, a plan name and a status. You can skip this entirely and paste a membership key instead.
- Feedback you send us. The in-app feedback button stores what you write, an optional contact you choose to add, which screen you sent it from, your browser’s user-agent string and a timestamp, in private storage only we can read. Send it anonymously by leaving the contact field empty. Do not paste account numbers or anything you would not put in an email.
- Support correspondence. If you email us, we hold that email and our reply so we can help you.
Information collected automatically
- Standard server logs from our host (Vercel) when a page or API route is requested. These may include IP address, user agent and timestamp, are retained briefly, and are used for security and to keep the service running.
- Encrypted sync blobs, if you enable cloud sync. See section 4.
What we deliberately do not do
- No advertising trackers, no third-party analytics that fingerprint or profile you.
- No selling, renting or sharing of personal information with anyone, ever.
- No adding you to a mailing list without your consent.
- No reading, mining or aggregating your trading records. We could not if we wanted to.
2. Where your data actually lives
Your trades, journal entries, notes, rulesets, accounts, settings and screenshots are stored by your browser on your device, in localStorage and IndexedDB. They stay there until you delete them, clear your browser storage, or export them yourself. Clearing site data removes them permanently, so export a backup first.
3. Permissions the terminal may ask for
Two browser permissions are optional, are requested only at the moment you use the feature, and can be refused without breaking anything else:
- Microphone, for voice notes in the Journal. Recording happens on your device and the audio file is written straight into your browser’s IndexedDB storage. Audio is never uploaded. It does not ride cloud sync, which carries no media at all: the only way a recording leaves your device is if you export a backup yourself.
- Notifications, for economic-calendar reminders. The schedule is evaluated on your device and the notification is raised by your own browser. Nothing is sent to us, and no push service is involved.
Screenshots you attach to trades are handled the same way as audio: IndexedDB, on your device, never synced.
4. Cloud sync, and how the encryption works
Cloud sync is optional and off unless you turn it on. When enabled:
- your data is encrypted in your browser, before it is sent, using a key derived from a passphrase you choose;
- the passphrase is never transmitted to us and never leaves your device;
- we store the resulting ciphertext so your other devices can fetch it;
- we cannot decrypt it, and neither can our hosting provider or anyone who compromises our storage.
There is no passphrase recovery
Because we never hold your passphrase, we cannot reset it and cannot recover your synced data if you forget it. This is the direct cost of the guarantee above. Store it somewhere safe.
5. Why we may process information
We rely on: performing our contract with you (providing the terminal, verifying your subscription is active); our legitimate interests (keeping the service secure and available, responding to support requests); and your consent where you have given it. Where the GDPR or UK GDPR applies to you, these are our lawful bases.
6. Who we share with
Only the service providers needed to run QuantPeak, and only what each one needs:
| Provider | Purpose | What it receives |
|---|---|---|
| Whop | Payments, subscriptions | Your billing details, held by them and not by us |
| Vercel | Hosting, cloud sync storage | Server logs; encrypted sync blobs |
| Discord | Community (optional) | Whatever you choose to share there |
| Yahoo Finance | Price charts (optional) | The symbol and timeframe requested, never your trades |
| FXStreet | Economic calendar | The date range requested, nothing about you |
We may also disclose information if compelled by law. In practice, a lawful request for your trading records could only ever yield ciphertext we cannot open.
7. International transfers
We operate from Australia and our providers may process data in other countries, including the United States and the European Union. Where personal information is transferred internationally, we rely on our providers’ standard contractual clauses and equivalent safeguards.
8. Retention
Server logs are kept only briefly for security and reliability. Support emails and feedback submissions are kept while they are still relevant to helping you. Your own records are on your device and are retained for exactly as long as you choose.
Encrypted sync blobs are kept until you delete them. A lapsed or cancelled subscription does not delete anything: access to the terminal is suspended, your records stay on your device, your ciphertext stays where it is, and resubscribing restores both. This matches section 5 of the Terms of Service. If you want your blob gone before then, turn off sync or write to us and we will delete it.
9. Your rights
Depending on where you live, you may have rights to access, correct, delete, export or restrict the processing of your personal information, to object to processing, and to complain to a regulator, which in Australia is the Office of the Australian Information Commissioner.
For your trading records, these rights are already built in and need no request: export from Settings at any time, delete by clearing the app’s data or disabling sync. For anything we hold, meaning support email, feedback and sync blobs, write to support@quantpeak.trade and we will action it. For billing information, contact Whop, who hold it.
10. Cookies, local storage and analytics
We set no cookies. Not one, not for advertising, not for cross-site tracking, and not for analytics. That is why you have never seen a cookie banner here: there is nothing to ask you to consent to.
The terminal does use your browser’s local storage, because that is where your trading records, your theme and your settings physically live. That storage never leaves your device unless you switch on encrypted sync. Blocking storage for this site will stop the terminal from functioning.
We run no analytics at all. Not on the marketing pages and not in the terminal: no product analytics, no session recording, no error-reporting service, no beacons, no pixels and no first-party counter of our own. An earlier version of this policy described a page-view counter on the marketing pages. It was never built, and we have removed the paragraph rather than leave a policy describing collection that does not happen.
The practical consequence is one we accept on purpose: we cannot see which features you use, how often you open the app, or where you got stuck. If something is wrong, the feedback button or an email is the only way we will learn about it.
11. Children
QuantPeak is not intended for anyone under 18 and we do not knowingly collect information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
12. Security
We keep the attack surface deliberately small: no user database, no readable user content, no secrets in client code, and encryption performed on your device. No system is perfectly secure, and you are responsible for the security of your own device and passphrase. If a breach ever affected personal information we hold, we would notify affected people and the relevant regulator as required by law.
13. Changes
We will update this policy as the product changes, and the date above always reflects the current version. If a change materially reduces your protections we will give notice before it takes effect.
14. Contact
Privacy questions or requests: support@quantpeak.trade.