Privacy Policy
Last updated: 6 October 2026
This Privacy Policy explains how TraderNest handles personal data when you use our website (tradernest.ai), our app (app.tradernest.ai) and related services (together, the “Service”). It applies to all users worldwide. We apply the EU General Data Protection Regulation (GDPR) to everyone, wherever you live.
1. Who we are
TraderNest is a trading journal and analytics platform. It helps you review your own trading behavior. TraderNest does not provide financial advice, investment recommendations or trading signals.
Data controller:
SHD Services, trading as TraderNest
Chamber of Commerce (KvK): 99412896
Nijmegen, the Netherlands (full address in our legal notice)
Email: [email protected]
We have not appointed a Data Protection Officer because the law does not require one for us. For any privacy question, contact [email protected].
2. What we process, why, on which legal basis and for how long
The table below lists every purpose for which we use personal data. “Contract” means we need the data to provide the Service you signed up for.
| Purpose | Personal data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Your account: sign-up, sign-in (email or Google), profile, settings | Email, name, username, password hash, profile photo, time zone, currency, preferences, 2FA status | Contract (art. 6(1)(b)) | Until you delete your account |
| Journal and analytics: trades, strategies, notes, screenshots, reviews, dashboards, portfolio | Trade data, strategy rules, notes, emotional and behavioral answers you choose to give, screenshots, holdings | Contract (art. 6(1)(b)) | Until you delete it or your account |
| Exchange sync | Read-only API key and secret (encrypted), exchange name, account label, synced trades | Contract (art. 6(1)(b)), at your request | Until you remove the connection or your account |
| AI analysis: Hawk chat, AI insights, TradeScan report | Your messages, trade data and statistics needed to answer, AI responses, chat history | Contract (art. 6(1)(b)), when you use these features | Chat history until you delete the chat or your account; Anthropic keeps API data for a limited period (see section 5) |
| TradeScan without an account | Uploaded file, parsed trades, analysis result, IP address and browser type | Legitimate interest (art. 6(1)(f)) in delivering the free scan you request and preventing abuse | Unclaimed scans: 7 days. IP address and browser type: 30 days. Claimed scans: moved to your account |
| Payments and subscriptions | Plan, billing status, Stripe customer and subscription ID, invoices. Card details stay with Stripe | Contract (art. 6(1)(b)) and legal obligation (art. 6(1)(c)) for tax records | Invoices and payment records: 7 years (Dutch tax law, art. 52 AWR) |
| Preventing trial abuse and fraud | A fingerprint of your payment card provided by Stripe (not the card number) | Legitimate interest (art. 6(1)(f)) in preventing repeated free trials | Until you delete your account |
| Security: sign-in protection, rate limits, audit logs, fixing errors | Sign-in events (time and method), failed attempts, IP address in server logs, technical error reports | Legitimate interest (art. 6(1)(f)) in keeping TraderNest secure and working | Sign-in events: 180 days. Server logs: up to 30 days. Error reports (Sentry): up to 90 days |
| Product statistics inside TraderNest | Feature usage events (feature name, action, time). No amounts, prices or leverage | Legitimate interest (art. 6(1)(f)) in improving the product | 90 days (authentication events: 180 days); afterwards only anonymous totals |
| Statistics cookies on the website and in the app (Google Analytics) | Pages viewed, device and browser data, pseudonymous cookie ID | Consent (art. 6(1)(a) and Dutch Telecommunications Act art. 11.7a) | Up to 2 years, or until you withdraw consent |
| Own visit measurement on the website tradernest.ai, without cookies | Pages viewed, time, referring site, device type, approximate location and the owner of the network the visit comes from (a company name if the network belongs to a company, otherwise the internet provider). Your IP address is used once to look up the network in public registers and lookup services and is not stored. If you allowed Statistics, a random ID in your browser links a later visit to an earlier one | Legitimate interest (art. 6(1)(f)) in knowing which pages are used and which organisations are interested | 2 years |
| Record of your cookie choice | A random ID, the time, your choice per category and the page you chose on. No name and no IP address | Legal obligation to be able to demonstrate consent (art. 6(1)(c), GDPR art. 7(1)) | 2 years |
| Service emails: verification, password reset, billing, security notices | Email address, name | Contract (art. 6(1)(b)) | Resend keeps delivery logs for a limited period (up to 30 days) |
| Product updates and tips to existing users | Email address, name, activity status | Legitimate interest (art. 6(1)(f)); you can opt out in every email and in Account settings (Telecommunications Act art. 11.7(3)) | Until you opt out or delete your account |
| Newsletter and promotional emails | Email address, consent date | Consent (art. 6(1)(a)) | Until you unsubscribe |
| Partner program: knowing which partner referred you | Partner code in the tn_via cookie, partner code on your account, sign-up date, plan and status | Legitimate interest (art. 6(1)(f)) in paying partners correctly and applying their promotion | Cookie: 60 days. Attribution: until you delete your account; commission records: 7 years |
| Communities, teams and rankings | Username, avatar, trade statistics as described in section 6 | Contract (art. 6(1)(b)), only when you join a team or community | Until you leave or delete your account |
| Support requests and support access to your account | Your messages, account data needed to help you, support access log | Contract (art. 6(1)(b)) and legitimate interest (art. 6(1)(f)) | Support emails: 2 years. Support access log: as long as your account exists |
Where we rely on legitimate interest, we have weighed our interest against your privacy. You can object at any time (see section 9). We do not sell, rent or trade your personal or trading data, and we do not use it for advertising.
3. Which data you must provide
To create an account you must provide an email address and a password, or sign in with Google. Without these we cannot provide the Service. Everything else, such as exchange connections, notes, emotional check-ins, a profile photo or joining a community, is optional. If you leave it out, only the related feature will not work.
4. Where the data comes from
Most data comes from you. If you connect an exchange, we receive your trade history from that exchange through the read-only API key you provide. If you sign in with Google, Google shares your name, email address and profile photo with us. If you arrive through a partner link, we receive that partner's code.
5. AI features and automated decisions
Hawk chat, AI insights and the TradeScan report are produced by an AI system: the Claude model from Anthropic. We label these features in the app so you always know you are dealing with AI. AI output can be wrong, is meant for reflection only and is not financial advice.
To answer you, we send Anthropic only what the feature needs: your question and the relevant trade data and statistics. Anthropic acts as our processor. Under its commercial terms it does not use this data to train its models and deletes it after a limited period (normally within 30 days), unless it must keep it longer to investigate misuse or because the law requires it.
Pattern detection and AI analysis evaluate your trading behavior, but we never take decisions that have legal effects for you or similarly significantly affect you based solely on automated processing (GDPR art. 22).
6. Who can see your data
6.1 Private by default
Your journal, trades and notes are private to you.
6.2 Teams and communities
Only if you join a team or community:
- Team owners can see aggregated performance data of their members.
- Community members and owners can see your username, avatar and trading statistics such as win rate and number of trades.
- If you are a member of a public community, your username, avatar, number of trades, win rate and total P&L can appear in the trader rankings that all signed-in users can see.
You can stop sharing with communities and hide yourself from public rankings at any time under Account > Rankings.
6.3 Partners
If you signed up through a partner link or promo code, that partner can see your username, sign-up date, plan and subscription status, so commission can be calculated. Partners never see your email address or trading data.
6.4 Service providers (processors)
We use the providers below to run TraderNest. They may only process your data on our instructions, under a data processing agreement (GDPR art. 28).
- Railway Corporation – Application hosting (United States)
- Neon Inc. – Database hosting (United States (cloud servers may be in the EU))
- Cloudflare Inc. – File storage (R2), DNS, storage of cookie choices and visit measurement (United States and global network)
- Anthropic PBC – AI model (Claude) for Hawk chat, AI insights and TradeScan (United States)
- Stripe Payments Europe Ltd. / Stripe Inc. – Payments, subscriptions, invoices (Ireland and United States)
- Resend Inc. – Sending emails (United States)
- Functional Software Inc. (Sentry) – Error monitoring, without names or email addresses (United States)
- Google Ireland Ltd. / Google LLC – Google Analytics via Google Tag Manager (only with consent); Google sign-in if you choose it (Ireland and United States)
- Loops (Astrolabe Software Inc.) – Marketing emails, only if you opted in (United States)
6.5 Independent third parties
When you connect an exchange (such as LBank, Binance, Bybit, Bitget, MEXC, KuCoin or BloFin), link Discord or Telegram for Hawk alerts, pay through Stripe or sign in with Google, those companies also process data under their own privacy policies. We may also share data when the law requires it, for example with tax authorities or after a valid court order, or as part of a merger or sale of TraderNest (we will tell you in advance).
7. International transfers
Several providers above are based in the United States. Transfers to the US are covered by the EU-US Data Privacy Framework when the provider is certified, and otherwise by the European Commission's Standard Contractual Clauses (GDPR art. 46(2)(c)) together with additional measures such as encryption in transit and at rest. You can ask us for a copy of these safeguards at [email protected].
8. Security
We protect your data with technical and organizational measures (GDPR art. 32), including:
- HTTPS/TLS for all traffic and encrypted storage
- Exchange API keys, secrets and 2FA secrets encrypted with AES-256-GCM; we only accept read-only keys and can never trade or withdraw for you
- Passwords hashed with Argon2id
- Optional two-factor authentication (2FA)
- Brute-force protection, rate limits and secure HttpOnly session cookies
- Restricted, logged access for our own staff
If a data breach is likely to put your rights at risk, we will report it to the Dutch Data Protection Authority within 72 hours and inform you without undue delay when the risk is high.
8.1 Support access to your account
Authorized support staff can open your account only to resolve a support request, investigate a security issue or abuse, or enforce our Terms. When they do:
- Financial values are masked in the support view: balances, amounts, quantities, prices and P&L are hidden on screen
- Read-only: support cannot change your data, connections or settings, and cannot export your data
- Time-limited: a support session ends automatically after 30 minutes
- Logged: every session is recorded in an audit log; your data export shows when support accessed your account
- You are notified in the app and by email each time
9. Your rights
You have the right to:
- access your data and get a copy (art. 15)
- correct inaccurate data (art. 16)
- have your data deleted (art. 17)
- restrict processing (art. 18)
- receive your data in a machine-readable format and transfer it (art. 20)
- object to processing based on legitimate interest, and to direct marketing at any time (art. 21)
- withdraw consent at any time, without affecting earlier processing (art. 7(3))
You can do most of this yourself in the app under Account > Profile: Download your data gives you a JSON file with everything we hold about you, Emails lets you choose which emails you get, Cookie settings changes your cookie choice and Delete Account removes your account. For anything else, email [email protected]. We answer within one month and may ask you to confirm your identity.
You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). If you live elsewhere in the EU, you can also contact your local authority. We would appreciate the chance to resolve your concern first.
10. Deleting your account
When you delete your account, we immediately delete your profile, trades, strategies, notes, AI chats and insights, exchange connections, TradeScan results, notifications and usage events, and we remove you from Loops and our newsletter list. Some data is kept longer only where the law requires it or where we have a legitimate need: invoices and payment records (7 years, tax law), partner commission records without your name (7 years), and our support access log without your name. Deleted data can remain in encrypted backups for up to 30 days until those backups are overwritten.
11. Cookies
We use necessary cookies to keep you signed in and remember your settings, a partner cookie (tn_via) when you use a partner link, and Google Analytics cookies on the website and in the app only if you allow them. Marketing cookies are only set if you allow them; none are active at this moment. Details and how to change your choice are in our Cookie Policy.
12. Children
TraderNest is only for people aged 18 or older. We do not knowingly collect data from anyone under 18. If we learn that we have, we delete it. Contact us if you think this has happened.
13. Changes
We may update this Privacy Policy. The date at the top shows the latest version. For significant changes we will notify you by email or in the app before they take effect.
14. Contact
Questions about this policy or your data? Email [email protected].
Stop guessing. Start journaling.
Join traders who use TraderNest to track their trades, spot behavioral patterns with AI, and review their process with real data.