Privacy Policy

Last updated: June 27, 2026

This Privacy Policy explains how StratVault ("StratVault", "we", "us", or "our") collects, uses, and shares information when you use our websites, applications, and services (the "Service"). It also describes the rights available to users in the European Economic Area (EEA), the United Kingdom, and California. By using the Service, you agree to the practices described here.

1. Information We Collect

• Account information. Your email address and a display name. If you sign in with a third-party provider (Google or Whop), we receive your name, email address, and profile picture from that provider.
• Subscription and payment information. Payments are processed by Whop. We do not collect or store your full payment-card details. We receive subscription and membership status (plan, renewal dates) from Whop to provision your access.
• Content you create. Backtests, journal notes, screenshots you upload, and preferences you set within the Service.
• Usage and device data. Log data such as IP address, browser/user-agent, session activity, and timestamps, used for security, session management, and operating the Service.
• Cookies. Strictly-necessary cookies to keep you signed in and operate core functionality (see Section 5).

2. How We Use Information

• To provide, maintain, and improve the Service;
• To create and manage your account and authenticate your sign-ins;
• To process subscriptions and provision the correct access tier;
• To secure the Service, enforce limits, and prevent fraud or abuse;
• To communicate with you about your account, security, and service updates;
• To comply with legal obligations.

3. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as needed to operate the Service, with the following categories of service providers ("subprocessors"):

• Supabase — database, authentication, and file storage;
• Vercel — application hosting and delivery;
• Whop — subscription billing and payment processing;
• Google — optional sign-in (OAuth);
• Cloudflare — bot/abuse protection;
• Upstash — rate limiting and ephemeral session state;
• Market-data providers — to deliver historical and reference market data.

We may also disclose information where required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets (with notice where required).

4. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we delete or anonymize your personal information within a reasonable period, except where retention is required by law.

5. Cookies

We use only strictly-necessary (essential) cookies — for example, to authenticate you and keep you signed in, and to operate core security features. We do not use advertising, analytics, or cross-site tracking cookies. Because these cookies are essential to deliver the Service you request, they do not require consent under GDPR/ePrivacy rules; they cannot be disabled while you are signed in and using your account. If we ever introduce non-essential cookies, we will update this policy and present a consent choice before setting them.

6. Your Rights and Choices (Everyone)

Regardless of where you live, you can:

• Request a copy of your data by emailing support@stratvault.trade;
• Delete your account from your account settings;
• Contact us at support@stratvault.trade to exercise any other applicable right.

7. Your GDPR Rights (EEA & UK)

If you are in the EEA or the UK, StratVault is the data controller for your personal data, and you have rights under the GDPR / UK GDPR.

Legal bases. We process your personal data to (a) perform our contract with you and provide the Service; (b) pursue our legitimate interests in securing, operating, and improving the Service (balanced against your rights); (c) comply with legal obligations; and (d) where applicable, with your consent.

Your rights. Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data; the right to data portability; and the right to withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with your local data-protection supervisory authority.

International transfers.We and our subprocessors may process your data in the United States and other countries. Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) where required.

To exercise any of these rights, delete your account from your account settings or email us at support@stratvault.trade.

8. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the CPRA.

Categories of personal information collected. Identifiers (such as name and email); commercial information (subscription status); internet/network activity (usage and log data); and user-generated content (such as journal notes). We collect these for the business purposes described in Section 2.

Do Not Sell or Share My Personal Information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising — and we have not done so in the preceding 12 months. Because we do not sell or share, no opt-out is required; you are welcome to contact us with any questions. We also do not use or disclose sensitive personal information for purposes that would require a right to limit.

Your California rights. You have the right to know/access the personal information we collect, to delete it, to correct inaccuracies, to opt out of any sale or sharing (not applicable, as we do none), and to not be discriminated against for exercising your rights.

To exercise these rights, delete your account from your account settings or email support@stratvault.trade. We will verify your request using your account email, and you may use an authorized agent where permitted.

9. Security

We use technical and organizational measures designed to protect your information, including encrypted transport, scoped access controls, and limits on active sessions. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International Users

We and our subprocessors may process and store information in countries other than your own, including the United States. By using the Service, you understand that your information may be transferred to and processed in those locations, which may have different data-protection laws than your jurisdiction.

11. Children's Privacy

The Service is not directed to, and we do not knowingly collect personal information from, anyone under the age of 18. If you believe a minor has provided us information, contact us and we will take appropriate steps to delete it.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be posted here with an updated "Last updated" date. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact

Questions about this Privacy Policy or your data? Contact us at support@stratvault.trade.