Privacy policy

We collect what it takes to run a trading journal — your account details, the trades you import, and the notes you write. We use it to operate the Service for you. We do not sell your data, do not use your trading data to advertise anything, and do not share it except with the providers who help us run the product, or where the law forces us to. You can export or delete everything at any time.

Account information. Your email address, your name if you give one, and a hashed password. If you subscribe, our payment processor collects your billing details — we never see or store full card numbers.

Trading data you bring in. The trades, executions, positions, and account balances you import — through an Interactive Brokers Flex connection (a read-only token and query ID you create at IBKR) or files you upload. This is the heart of the product; it is your data and it stays scoped to your account.

What you add on top. Journal notes, tags, screenshots, settings, and anything else you type or upload while using Options Whale.

Technical data. IP address, browser and device type, and diagnostic logs of how the Service is used — the usual material needed to keep a web app secure, debug failures, and understand which features earn their keep. We also store small pieces of state in your browser (such as your theme choice) and a session cookie to keep you signed in.

Support messages. What you send us by email, and the context needed to solve the problem you wrote in about.

• to provide the Service: importing your fills, computing your analytics, rendering your journal, and syncing across your devices;
• to authenticate you, prevent fraud and abuse, and keep accounts and data secure;
• to bill you for a plan you chose, and to tell you about changes to it;
• to answer support requests and fix what is broken;
• to understand, in aggregate, which features are used — so the roadmap follows real behaviour rather than guesses;
• to enforce these terms and comply with the law.

The legal basis, where one applies (such as under the GDPR): the data is necessary to perform the contract you signed up for, to meet our legal obligations, and — for things like product analytics — our legitimate interest in running and improving the Service.

When AI-assisted features are enabled on your account, your questions and the journal context needed to answer them are processed to produce the answer. That context can include trades, notes, and statistics — which is what makes the answer about your trading instead of generic advice.

Your journal data is not used to train third-party AI models. AI output is generated analysis of your own record — it can be wrong, it is not advice, and it carries the same simulated-results caveats as the rest of the Service. Usage is rate-limited per day per account.

• We never sell your personal data or your trading data — to advertisers, data brokers, or anyone else.
• We do not use your trades, notes, or journal content for advertising or to build marketing profiles.
• We do not read your journal for curiosity. Access to customer data by our own tooling is limited to what support and operations genuinely require, and broker connections are read-only — nothing we hold can place an order or move money at your broker.

Only in these situations, and only as much as each one needs:

• Service providers who help us operate — hosting and database infrastructure, the payment processor for subscriptions, error monitoring, email delivery. They process data on our behalf under contracts that forbid them from using it for anything else.
• Legal requirements — if we are compelled by law, subpoena, or court order, or if disclosure is needed to protect the Service, our users, or the public. Where we are legally allowed to, we tell you first.
• Business transfers — if Options Whale is acquired or merged, data moves with the product under the same promises, and you will be told before the privacy picture changes.

We keep data for as long as your account exists — that is what makes your journal cumulative. When you delete your account from Settings, your account and its trade data are deleted from live systems immediately and irreversibly.

Two carve-outs, both temporary: encrypted backups age out on their own rotation (up to 30 days), and we may retain minimal billing records where accounting law requires it. Neither is usable by the product.

Traffic is encrypted in transit (TLS). Passwords are stored hashed, never in plain text. Access to production systems is restricted and logged. No method of electronic storage is perfectly secure, so we cannot guarantee absolute security — but we treat your trading record the way we would want ours treated, and we will tell you if something goes wrong that materially affects you.

You can export your trades (CSV) and delete your account and data from Settings at any time, without writing to anyone. Depending on where you live, you may also have the right to access, correct, restrict, or object to our processing of your personal data, and to lodge a complaint with your data protection authority.

To exercise any of those rights — or if you just want to know what we hold — write to support@options-whale.com and we will respond within the timelines the law sets.

Options Whale is operated from the United States, and your data may be processed there or wherever our infrastructure providers run. Where the law of your country (such as the GDPR) requires safeguards for cross-border transfers, we rely on the mechanisms those laws provide.

Options Whale is built for adults making real financial decisions. It is not directed at anyone under 18, and we do not knowingly collect data from them. If you believe a minor has given us data, tell us and we will delete it.

This policy may change as the product does. For anything material — new data collected, new uses, new categories of sharing — we will give advance notice in the app or by email before it applies to you.

Questions, requests, or complaints about privacy: support@options-whale.com.