Privacy Policy

1. What we collect

• Account. Your email address, your display name, and a hashed password (we cannot read it). Your email is verified with a code when you sign up.
• Profile. What you tell us in onboarding and Settings: years trading, the platform you use, your time zone, age range, an optional gender, your struggles, your strategy description, the instruments you trade, your interests, and your A+ setups (including any screenshots you attach). These exist to match you into a cohort and to run the ritual.
• Rules and accounts. The trading accounts you add (a label, the platform's account name, and the limits you set), your cooldown lengths, your Rule Lock commitments, and your blackout settings.
• Trading activity. The trades you log or that the platform connection reports: time, result, profit or loss, which setup you classified it as, whether it was on plan, and the running daily profit and loss per account. This drives your limits, your streak, and your journal.
• Platform connection. When you connect Tradovate or NinjaTrader, the app reads executions, open positions, and profit and loss for the accounts you map. Detailed platform messages are kept in a log file on your computer only; what reaches our servers is the trade and account summaries above. Your platform password stays with your platform and is never seen by the app. With Tradovate, an access token is stored on your computer so the connection can resume.
• Community. Messages you post in cohort chat and global chat, direct messages, any images you attach, daily check-ins, and whether you are online.
• Billing. Stripe handles payment. We store your Stripe customer ID and your membership status and dates. We never receive or store your card number.
• Diagnostics. The app keeps a technical log on your computer. It only reaches us if you export it and send it to support yourself. Tokens and passwords are scrubbed from it before it is written.
• Website. If you enter a giveaway on the website we store the name, email, and answers you give on that form. The weekly-email sign-up on the website is handled by MailerLite under its own policy.

We do not collect your platform login, your bank details, your location beyond the time zone you choose, or any browsing history. There is no advertising tracking in the app.

2. Why we use it

• To run the Service: enforce your rules, count your trades, keep your journal, run the ritual, and show your Dashboard.
• To put you in a cohort and run the community features.
• To bill you and to know whether your membership is active.
• To support you when you write to us, and to fix problems using a diagnostics file you send.
• To send transactional email: the sign-up verification code, password-reset codes, and important notices about your membership or these policies. We do not send marketing email from the app.

We do not sell your information, and we do not use it to build advertising profiles.

3. What other members can see

Members in the app can see your display name, whether you are online, your discipline streak, your cohort, the platform you use, the instruments you trade, your non-dollar rules (for example "stops after 3 losses in a row"), your interests, and your Pong score. Members in your cohort also see your daily check-ins and whether you followed your plan. Nobody except you ever sees your profit and loss, your dollar limits, your account names, or your trades. Anything you write in chat is visible to that chat's members.

4. What the app does on your computer

To enforce rules you set, the app may close or block your trading platform, edit your computer's hosts file to block trading websites during a lock (through a small helper that runs with administrator rights), black out your screen during a trade, and start itself when you log in. These are local actions on your own machine; nothing about them is reported to us beyond whether a lock was bypassed, which affects your streak. Uninstalling the app removes all of them.

5. Who we share it with

Only the companies that run parts of the Service for us, and only what each one needs:

• Supabase hosts our database and sign-in system. Your data is stored on its servers in the United States (us-east-2).
• Stripe processes payments and holds your card details under its own privacy policy.
• Hostinger hosts the website and sends our transactional email (verification and reset codes).
• GitHub hosts the app downloads and updates. Checking for an update sends your app version and a standard web request; no account data.
• Tradovate / NinjaTrader when you choose to connect a platform. Data flows from the platform to your computer under your authorisation; we do not send your Degen Rehab data to them.
• MailerLite if you join the weekly email list on the website.

We will disclose information if the law requires it or to protect the rights or safety of members or the Service.

6. How long we keep it

While your membership is active we keep your data so the Service works. When your membership ends, whether you cancelled, a trial ran out without converting, a payment failed and was not fixed, or an access code expired, we keep your account and data for 30 days so you can come back with everything intact. After 30 days the account and all of its data are deleted automatically by a scheduled job. An account that never activated a membership is deleted 30 days after it was created. Billing records that the law requires us to keep (invoices) stay with Stripe for the required period. Giveaway entries are deleted after the giveaway.

7. Your choices and rights

• See or change your data. Most of it is editable in the app (Settings, Accounts, Strategies). For anything else, email us.
• Delete your account. Cancel your membership and it is deleted automatically after 30 days, or email tyler@degen-rehab.com from your account email and we will delete it sooner.
• Diagnostics. You choose whether to send a diagnostics file. Open it first if you want to see what is in it.

If you are in Canada, the European Economic Area, the United Kingdom, or another place with data-protection law, you may have additional rights to access, correct, port, restrict, or object to processing of your information, and to complain to your local authority. Email us and we will help.

8. Security

Data travels encrypted between the app and our servers. Each member's data is isolated in the database so one member can never read another's. Passwords are hashed, verified by email, and checked against known breach lists. Payment details never touch our systems. No system is perfectly secure; if we learn of a breach affecting your data we will tell you promptly.

9. Children

The Service is for adults. We do not knowingly collect information from anyone under 18. If you believe a minor has an account, email us and we will delete it.

10. Changes to this policy

If we change what we collect or how we use it, we will update this page and, for material changes, email you or show a notice in the app before the change applies.