GDPR · Art. 13 & 14

Privacy Policy

Protecting your personal data is important to us. This Privacy Policy informs you about what data we collect, how we use it and what rights you have — in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

Note: The German version of this Privacy Policy is the legally binding version. This English translation is provided for convenience only.

1. Data Controller

Company: TradeOnyx UG (haftungsbeschränkt)

Address: Stockberg 19, 52393 Hürtgenwald, Germany

Authorised representative: Managing director Christian Grube

Registration court: Amtsgericht Düren, HRB 10446

Email: [email protected]

Contact form: tradeonyx.io/kontakt

A separate Data Protection Officer is not required under § 38 BDSG: the company employs fewer than 20 persons in continuous automated processing of personal data.

2. Hosting & Server Log Files

This website is hosted on a dedicated server of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in a data centre located within the Federal Republic of Germany. A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Hetzner. Technically necessary server log files are collected automatically. These contain: IP address (truncated / pseudonymised after processing), date and time, requested URL, HTTP status code, data volume transferred, browser type and operating system.

Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in stable, secure operation and defence against attacks). Retention: Maximum 14 days; afterwards logs are deleted or fully anonymised.

File storage (Cloudflare R2): Uploaded files (avatars, trade and journal attachments) are stored in an EU bucket of the S3-compatible object storage service Cloudflare R2. Provider: Cloudflare Germany GmbH, Rosental 7, 80331 Munich, with data processing agreement and EU data residency. Standard Contractual Clauses (SCC) under Art. 46 GDPR are covered by the Cloudflare Data Processing Addendum.

3. Registration & User Account

When you register, we collect: username, email address, password (Bcrypt hash, never in plain text), registration timestamp, last login, and optionally a profile picture you upload yourself.

Purpose: Providing and managing your user account. Legal basis: Art. 6 (1)(b) GDPR. Retention: For the duration of your account. Deletion is immediate: once you confirm it by email in the second step, the account and its contents are removed in one pass, not after a waiting period. The exception is accounting records, which § 147 AO and § 257 HGB require us to keep for ten years (see section 11).

3.1 Minors (Art. 8 GDPR)

The platform is intended exclusively for persons aged 18 and over (see Terms § 3). We do not knowingly process data of minors. If we become aware that we are processing data of a person under 18, we will delete it without delay (Art. 17 GDPR). Parents or guardians who suspect their child has created an account can contact [email protected].

4. Trading Data (Trading Journal)

As part of using the platform, you store the following data. All of it is exclusively linked to your account and is not visible to other users:

  • Trade data (symbol, direction, volume, prices, timestamps, P&L)
  • Journal entries (pre-market plan, market notes, post-market reflection, mood ratings, lessons learned)
  • Trade reviews (execution grade, mood before/after, plan-followed flag, notes)
  • Tags, playbooks and trade↔playbook assignments
  • Uploaded screenshots (stored locally on our server; retrievable only by you)
  • Per-account symbol mappings
  • XP / level events, trading-account configuration

Legal basis:Art. 6 (1)(b) GDPR. You can delete your data at any time; deleting a trading account also removes its symbol mappings, clearing all trades on an account removes that account's mappings.

4.1 Audit Log

Every mutation of journal entries, reviews, tags and playbooks is written to an internal audit log with timestamp, old value and new value. This gives you complete change traceability and is the foundation for planned coach/team features. The audit log is strictly internal and linked to your account; it is deleted together with your account.

4.2 Uploaded Images / Screenshots

Screenshots you attach to trades, journal entries or a bug report live in a private object store (Cloudflare R2) under a path containing your user id and a checksum of the image. The bucket is not publicly reachable. To display an image the server mints a signed address that expires after one hour and is valid for that single object; it is minted only after verifying that the entry belongs to you. Without the address nobody reaches the file, and once it has expired even a copied address stops working. Maximum file size: 5 MB per image, permitted formats: PNG, JPEG, WebP, GIF.

Processor: Cloudflare Germany GmbH, Rosental 7, 80331 Munich, for the European storage region. Cloudflare receives the image data for storage only, does not use it for its own purposes, and receives no mapping to your name or email address. Legal basis: Art. 6 (1)(b) GDPR, processing on our behalf under Art. 28 GDPR. Deleting an attachment or your account deletes the object.

4.3 Timezone Data

Trade timestamps are stored server-side as UTC and only converted to your configured IANA timezone for display. When importing broker files you can set the source timezone per file. Changing the timezone in settings affects only display, not storage.

4.4 Tax-export calculation (Anlage KAP and Anlage SO)

Purpose: aggregation of your closed trades as preparation for the German income-tax return. The export separates two categories of income: investment income under § 20 EStG goes into the Anlage KAP schedule, while private disposals under § 23 EStG (crypto assets in particular) go into a separate Anlage SO schedule, for which the one-year holding period is checked as well. Methodology: buy and sell fills are paired per symbol and per account using the FIFO method (First In, First Out) into closed positions. Per position we sum the gross result, commission and swap, and convert display times to the account timezone you selected. Data source: exclusively your stored trade data (see section 4); no third-party enrichment occurs. Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

A detailed description of the calculation methodology together with an explicit limitation of liability is provided in our Terms § 11a (Tax export — Disclaimer).

4.5 Algorithmic pattern detection and profiling (Art. 13 (2)(f) GDPR)

(1) What happens. The platform analyses your trade and journal data using rule-based detectors ("Onyx Engine") that surface statistical patterns in your trading behaviour and report them back to you as "Patterns" (e.g. revenge_trading, overtrading, position_sizing_drift, hold_time_asymmetry). This analysis constitutes profiling within the meaning of Art. 4 (4) GDPR.

(2) Logic. The detectors compare individual trades against your own baseline values (volume, hold time, time of day, risk profile) and flag trades that deviate significantly. The thresholds and algorithms are documented openly in our public architecture documentation.

(3) Scope. The insights serve exclusively your personal self-reflection. No automated decision producing legal effects or similarly significantly affecting you takes place (Art. 22 (1) GDPR does not apply). You remain the sole decision-maker for all trading actions; the platform does not issue investment recommendations.

(4) Right to object. You can object to the profiling at any time (Art. 21 (1) GDPR). In that case the Onyx Engine analysis is disabled for your account; the underlying trade data is unaffected. Write to [email protected].

(5) AI analyses (Pro Plus). In addition to the rule-based Onyx Engine you can run individual trades or journal entries through an AI provider (see section 6 "AI-Powered Analyses"). That processing is also profiling; it is triggered exclusively by your active click (Art. 6 (1)(a) GDPR).

5. Cookies, Local Storage & Consent

On your first visit we display a consent bannerat the bottom of the screen. You decide there per category what we may load — three equally-prominent buttons (“Only essential” · “Settings” · “Accept all”) plus a close button that maps to rejecting the non-essential categories. Your choice is stored locally in your browser and is valid for 12 months; afterwards we ask again. Via the Cookie settings link in the footer you can change or fully revoke your choice at any time — as easily as you gave it (Art. 7 (3) GDPR).

5.1 Essential (always on)

  • Session cookie (session): Encrypted session ID to recognise your login. Deleted on logout or when the browser is closed. Provider: TradeOnyx UG (haftungsbeschränkt), EU-Hetzner servers.
  • CSRF protection: Hidden token to defend against cross-site request forgery. Reissued per session.

Payment processing (Stripe): Paid subscriptions are processed through Stripe. When you start a payment you are taken to a page hosted by Stripe, where Stripe may set its own fraud-prevention cookies (__stripe_mid, __stripe_sid). Provider: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. This happens only when you start a payment yourself and is necessary to perform the contract. No Stripe script is loaded on our own pages unless you begin a payment. We never see your card details: they are entered at Stripe and processed there.

5.2 Functional (consent-exempt)

This bucket holds nothing but the settings you made yourself: chosen language and display currency, column and filter selections in tables, the tab you last opened, the state of the welcome wizard and similar. All of it lives in your browser's localStorage or sessionStorage, is never transmitted to us, and serves no analytical purpose. Because it merely carries out a setting you made, no consent is required under § 25 (2) TDDDG; you can clear these values at any time through your browser's site data.

The complete, code-maintained list of every single key with its purpose and retention is in the cookie settings (footer → “Cookie settings”). It is generated from the code itself and therefore cannot go stale. The colour preference is not part of it, incidentally: it is stored in your account on the server so it looks the same on every device.

5.3 Analytics (opt-in)

No analytics cookies are active, and none are planned. Traffic figures are produced server-side only: from the server log files (section 2) and from the statistics Cloudflare compiles for the requests it passes through as our content-delivery network. Neither sets a cookie, and neither loads a counting pixel or an analytics script into your browser. The “Analytics” toggle in the banner therefore controls nothing at present; it stays visible so that any future measurement cannot start without consent.

5.4 External content (opt-in)

Embedded YouTube videos are delivered in click-to-load mode by default (see the “Embedded walkthrough videos” section below). Only when you click play does the YouTube player load in privacy-enhanced mode. Activating this toggle disables the click-to-load shield for embedded videos so third-party content may load directly on page open.

Legal basis: Essential cookies: Art. 6 (1)(b) and (f) GDPR in conjunction with § 25 (2) (2) TDDDG (technically required for contract performance). Comfort, Analytics and External content: Art. 6 (1)(a) GDPR in conjunction with § 25 (1) TDDDG (your active consent via the banner).

6. External Services

Fonts (self-hosted)

The fonts used on this site (licensed under the Google Fonts licence) are hosted entirely on our own servers and delivered from there. Opening the site establishes no connection to Google servers, and no personal data is transmitted to Google.

Market Data and Economic Calendar

For prices, candles, symbol search, company data and event dates the platform queries four external sources:

  • query1.finance.yahoo.com (Yahoo Finance) — candles and symbol search
  • finnhub.io (Finnhub Inc.) — quotes and company data
  • financialmodelingprep.com (Financial Modeling Prep) — supplementary price and fundamental data
  • nfs.faireconomy.media — economic calendar

All four are queried from our server only, never from your browser. The providers therefore see neither your IP address nor any identifier, and they do not learn which user looked at which symbol: only the symbol itself is requested. Results are cached on our side to keep the number of requests small. No personal data is transmitted, so no legal basis for such a transfer is needed here.

AI-Powered Analyses (optional, plan-dependent)

For certain features — in particular the AI analysis of individual trades and journal entries, daily market briefings, and news/calendar summaries — the platform calls a third-party AI provider's API (currently Anthropic PBC, api.anthropic.com, data centres in the United States). This transmits your trade data, journal content, review notes, tags, playbook descriptions and account currency as prompt context to the AI provider. The response (Markdown text) is cached on our side for the duration of your subscription so you can re-access it without a new API call, and is deleted together with your account. A Data Processing Addendum with Anthropic PBC including a zero-retention clause contractually prohibits use of the data for model training. If we switch AI provider, we commit to securing an equivalent contractual guarantee in advance.

We reserve the right to change the AI provider (e.g. to OpenAI, Google, Mistral or self-hosted models) to optimise cost, performance or privacy. Any change will be reflected here and existing users will be notified of material changes.

Legal basis:Art. 6 (1)(b) GDPR (performance of contract) and Art. 6 (1)(a) GDPR (consent, given by actively clicking the "Run analysis" button for each trade/journal entry). Third-country transfer: conducted primarily under the EU Commission's adequacy decision for the EU-US Data Privacy Framework (Decision 2023/1795; Anthropic PBC is DPF-certified), and additionally under EU Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR, plus technical safeguards (TLS 1.2+, zero-retention addendum). The AI analysis can be disabled by the administrator and simply not used by individual users. Further information: Anthropic Privacy Policy.

Notice under the EU AI Act: AI-generated content is clearly labelled "AI analysis" in the UI. Results are algorithmically generated, do not constitute financial advice, and come without warranty.

Transactional emails (Postmark)

For transactional emails (account confirmation, password reset, weekly digest, system notifications) we use the email-delivery service Postmark, operated by ActiveCampaign, LLC, 1 N Dearborn St, 5th Floor, Chicago, IL 60602, USA. We transmit only your email address, name (where stored) and the email content. A data-processing agreement (DPA) including EU Standard Contractual Clauses is in place under Art. 46 (2)(c) GDPR. Legal basis: Art. 6 (1)(b) GDPR (contract performance) or Art. 6 (1)(f) GDPR (security / service notifications).

Bug reports and suggestions (Linear)

If you send a bug report or a suggestion through the in-app feedback window, it becomes a ticket in our issue tracker Linear after a manual review. That does not happen automatically: a human reads every report first, and only the release creates the ticket. What is then transmitted is your message text, your email address and user id (so you can be answered), the page you were on, the browser identification, and any screenshots you attached.

Provider:Linear Orbit, Inc., 2261 Market Street, San Francisco, CA 94114, USA. The transfer rests on the provider's data processing addendum including the EU standard contractual clauses under Art. 46 (2)(c) GDPR. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in fixing reported bugs). If you would rather report something without this transfer, write to [email protected] instead.

Push notifications (optional)

If you enable push notifications, your browser creates a subscription address with the push service of your browser vendor (Google for Chrome, Mozilla for Firefox, Apple for Safari). We store that address and two keys used for encryption so we can deliver messages to you. The content of every message is end-to-end encrypted (VAPID / Web Push), so the push service cannot read it; it only sees that and when something is delivered to that subscription. Legal basis: Art. 6 (1)(a) GDPR. You can withdraw at any time via the notification settings or the browser permission, and the subscription is then deleted on our side.

Broker connections (your credentials)

If you connect a broker or exchange account through its API, you store an API key with us. It is kept encrypted and used for nothing but fetching your trades and balances from that one provider. We explicitly recommend keys without trading or withdrawal permissions; the import needs nothing more.

During those calls data flows to your broker, not from us to some third party: the recipient is the company you yourself have a contract with, and the basis is the instruction you give by connecting. Your broker's own privacy policy governs what happens there. You can disconnect at any time in the settings, and the key is deleted with it. Legal basis: Art. 6 (1)(b) GDPR.

MCP interface for external AI clients

You can connect your account to an AI client of your choice (Claude, ChatGPT or Cursor, for example) through the MCP interface. This is off by default and requires explicit authorisation through an OAuth flow that shows you which permissions you are granting. After that, the client can read data from your account on your behalf and, depending on the tool, write to it.

Worth being precise about: the recipient of the data is then the provider of the client you chose, not us. What that provider does with the content follows their terms, over which we have no influence. Granted authorisations (tokens) are listed in your settings and can be revoked individually; access ends immediately when you do. Legal basis: Art. 6 (1)(a) GDPR.

Error monitoring (Sentry)

To ensure stable operation and quick error resolution we use Sentry by Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, with EU data residency (de.sentry.io, Frankfurt). When an error occurs we collect the error message, stack trace, requested URL, browser and OS information and a truncated IP address. The data serves solely for technical debugging; no profiling or ad-targeting takes place. Retention in Sentry: 30 days. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in platform stability). Third-country transfer: EU data residency; a DPA including EU Standard Contractual Clauses is in place. Further information: Sentry Privacy Policy.

Content delivery network & access protection (Cloudflare)

All web traffic to tradeonyx.io and the subdomains app.tradeonyx.io, uploads.tradeonyx.io and assets.tradeonyx.io is routed via the Cloudflare CDN, operated by Cloudflare Germany GmbH, Rosental 7, 80331 Munich (contracting party) and its parent Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare runs a globally distributed edge network in which IP address, user agent and requested URL are technically processed for content delivery and DDoS mitigation. Administrative areas (staging, admin inbox) additionally use Cloudflare Access; a short-lived JWT cookie (CF_Authorization) is set in the authorised administrator's browser.

Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in stable, performant and secure delivery of the platform) and Art. 6 (1)(b) GDPR for the contract-related subdomains. Third-country transfer: A data-processing addendum including EU Standard Contractual Clauses under Art. 46 (2)(c) GDPR is in place with Cloudflare. Further information: Cloudflare Privacy Policy.

Bot protection (Cloudflare Turnstile): On the contact form (/kontakt) and the registration form (/register) we use Cloudflare Turnstile. Turnstile is a privacy-friendly alternative to CAPTCHA services (notably Google reCAPTCHA): no click puzzles, no tracking cookies, no browser-history evaluation. When the form is opened, a script from challenges.cloudflare.com is loaded that checks in the background whether the request is human or automated; in the process the IP address, user agent and a few browser properties are transmitted to Cloudflare. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in preventing spam and bot registrations). Third-country transfer and DPA apply analogously to the Cloudflare CDN entry above.

Embedded walkthrough videos (YouTube)

On selected pages (e.g. /walkthrough/<name> and individual Academy articles) we embed walkthrough videos from the TradeOnyx UG (haftungsbeschränkt) YouTube channel. The YouTube service is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

We use a two-step pattern: we first show a preview image and play button hosted on our own servers (click-to-load). Until you actively click play, your browser does not connect to Google at all — no cookies are set, no IP address, user agent or other data is transmitted. Only your active click loads the actual YouTube player in privacy-enhanced mode (youtube-nocookie.com). From that moment on your browser connects directly to Google's servers — at that moment your IP address, user agent, referrer URL and device information are technically required to deliver the video. If you are signed in to a Google account at the time, Google may associate the playback with that account — you can avoid this by signing out of your Google account before clicking play.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a low-friction, audiovisual product demonstration). Third-country transfer: Once the video is started, data is transferred to the USA. We have a Data Processing Addendum with Google covering EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. Further information: Google Privacy Policy.

Web Analytics

We do not use Google Analytics, Meta Pixel, LinkedIn Insight, TikTok Pixel or any comparable tracking solution. Our own usage statistics are derived exclusively from the server logs (see section 2) and from the request statistics Cloudflare compiles as our content-delivery network. They contain no personally identifiable identifiers, and identification of individual users is neither possible nor intended. No analytics product is planned on top of that. Legal basis: Art. 6 (1)(f) GDPR. No cookie consent banner is required under § 25 (2) TDDDG, because nothing is stored on or read from your device for this.

7. Data Sharing with Third Parties

We do not share your personal data with third parties unless you have consented, sharing is necessary to perform the contract, a legal obligation exists, or a legitimate interest prevails.

8. Your Rights as a Data Subject

  • Right of access (Art. 15 GDPR): What data we hold about you.
  • Right to rectification (Art. 16 GDPR): Correction of inaccurate data (also available in your profile).
  • Right to erasure (Art. 17 GDPR): Request via [email protected] or directly in your profile via the delete-account function.
  • Right to restriction of processing (Art. 18 GDPR).
  • Right to data portability (Art. 20 GDPR): You can export your trading data as CSV and your journal entries (including reviews and tags) as JSON from the profile. For data not covered by the export function (e.g. audit log) an informal request to [email protected] is sufficient.
  • Right to object (Art. 21 GDPR).
  • Right to withdraw consent (Art. 7 (3) GDPR): At any time with effect for the future.

Contact for all data-protection enquiries: [email protected]

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR):

: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2-4, 40213 Düsseldorf, Germany — [email protected], ldi.nrw.de

A list of all German data protection authorities: www.bfdi.bund.de

10. Data Security

  • Passwords are stored exclusively as Bcrypt hashes — never in plain text.
  • Database access is conducted via encrypted connections within the server network.
  • Session tokens are encrypted and have a limited validity period.
  • HTTPS/TLS 1.2+ encryption for all data in transit
  • Server-side encryption at rest for uploaded files (Cloudflare R2)
  • Bcrypt password hashing (never plain text)
  • Optional two-factor authentication (TOTP, RFC 6238) in the settings. Admin accounts use 2FA mandatorily (Art. 32 GDPR — appropriate technical measure for privileged access).
  • Security emails on sign-ins from new devices and on critical actions (password change, 2FA enabled / disabled). The device fingerprint is stored only as a SHA-256 hash over browser family, OS family, country, and IP prefix (/24 IPv4, /48 IPv6) — never a raw IP. Trusted devices can be reviewed and revoked individually in the settings (Art. 16 + Art. 17 GDPR).

11. Retention at a glance

Each period is stated with the processing it belongs to; here are the same figures in one place so you do not have to hunt for them.

Account, trades, journal, attachments: As long as your account exists. If you delete it, they go with it immediately: there is no grace period and no “trash” window.

Server log files: 14 days at most, then deletion or full anonymisation.

Contact-form messages: 90 days. After that the message text and any attachment are deleted automatically; all that remains is the record that a request arrived at that time.

Error diagnostics in Sentry: 30 days.

Cookie consent record: 12 months, then you are asked again.

Support copies of your account: Only for the duration of a support case and at most until the expiry set when it was created; a daily job removes expired copies.

Waiting list: Until you are granted access or unsubscribe.

Invoices and payment records: 10 years, because § 147 AO and § 257 HGB require it. These records outlive an account deletion, but they are kept separate from the rest of the account and used for nothing else.

Last updated: 11 August 2026 · This Privacy Policy will be updated when the platform or applicable law changes.