Privacy Policy

01 Who we are

psychoded is a trading journal operated by Mohamed Nour, based in Abu Dhabi, United Arab Emirates. In this policy, "we", "us" and "psychoded" all mean the same thing, and "you" means the person using the app.

For anything about your data — questions, exports, deletion, complaints — write to support@psychoded.app. For suspected security problems, use security@psychoded.app.

02 What we collect

We only collect what the app needs to work. There is no hidden collection and no profiling for advertising.

Account information

• Your email address.
• If you register with a password, a cryptographic hash of that password. We never see or store the password itself.
• If you sign in with Google, your Google account identifier, email address, and the name and profile picture attached to that account. We ask Google for nothing beyond that, and we cannot read your Gmail, contacts, Drive, or anything else.

What you put in the journal

• Journal entries, pre-session plans, mind checks, your mind log, your trading accounts, and your trading plans — whatever you type or dictate.
• Chart screenshots and other images you attach to a trade.
• When you use dictation, your microphone audio is streamed for transcription while you speak. We do not keep the audio; we keep the text it produced, because that text is your entry.

Technical information

• Ordinary server logs: IP address, browser or device user agent, the request made, and the time it was made. These exist so the service can be operated and abuse can be investigated.
• If you joined the waitlist on the landing page, the email address you gave and when you gave it.
• Usage information, through PostHog: which pages and screens you open, which features you use, taps and scrolling, page speed, app errors, and your approximate location from your IP address. It is tied to your account once you sign in, so we can see where the app works and where it lets people down.
• Session recordings, through PostHog: a replay of how you moved through the app, taps and scrolling. Every piece of text and every input is blacked out before it leaves your device, so a recording shows the shape of the screen, never your journal, your numbers or your email.
• Error reports, through Sentry and PostHog: what broke, on which screen, on which device, so it can be fixed.

03 Why we hold it, and on what legal basis

We process your account information to give you an account and let you sign in. We process your journal content to provide the journal itself: storing it, syncing it between your devices, and generating the readings and summaries the app exists to give you. Both are necessary to perform the contract you enter into by using the app.

We process server logs on the basis of our legitimate interest in keeping the service running and secure. Where the law requires consent — for example, access to your microphone or camera — we ask for it at the moment it is needed, and you can refuse without losing access to the rest of the app.

04 Where your data lives

On your device, first. psychoded is built local-first. Entries are written to your own device's storage as you make them, and the app keeps working with no connection at all. If you never sign in, your journal never leaves your device.

In the cloud, once you sign in. Signing in turns on sync so the same journal appears on your phone, your tablet and your desktop. Synced data is stored in a PostgreSQL database and a private file store operated by Supabase, both hosted on Amazon Web Services in Stockholm, Sweden (AWS region eu-north-1). The application server is in the same region.

Every table carries row-level security policies enforced by the database itself, not merely by our application code: a signed-in session can only read and write rows whose owner is that session's own user. Screenshots go to a private bucket with the same rule applied to the file path, and are served only through short-lived signed links that expire after an hour.

05 Who else processes it

We use a small number of specialist providers to run the service. They act on our instructions, for the purpose named, and for nothing else. We do not sell your data to anyone, and none of these providers is paid in data.

Anthropic states that it does not train its models on data submitted through its API. Google only receives anything if you actively choose to sign in with Google; if you register with an email address and password, Google is not involved at all.

06 International transfers

Your journal is stored in the European Economic Area. We operate from the United Arab Emirates, and some of the providers listed above process data in the United States. Where data leaves the EEA it is transferred under the safeguards those providers offer, which for each of them is a set of Standard Contractual Clauses approved by the European Commission.

07 How long we keep it

We keep your journal for as long as your account exists, because a journal that quietly deletes itself would defeat its own purpose — the readings get sharper the longer your history runs.

• Delete an entry and it is removed from your device and marked deleted in the cloud, so the deletion travels to your other devices too.
• Delete your account and we erase your account record, your journal rows and your stored screenshots.
• Encrypted backup archives are kept for 14 days on the server, with copies held offsite. Deleted content can survive in those archives until they age out, which is the point of a backup.
• Server logs are kept only as long as they are useful for operating and securing the service.

08 Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it to another provider in a portable format. Email support@psychoded.app and we will act within 30 days. Exercising any of these rights is free, and we will not degrade your service for asking.

If you are in the EEA or the UK and you think we have handled your data badly, you may complain to your national data protection authority. We would rather you told us first, but that right is yours regardless.

09 Security

All traffic runs over TLS. Passwords are hashed, never stored in a readable form. Database access is governed by row-level security policies, so isolation between accounts is enforced by the database rather than trusted to application code. Screenshot storage is private by default and reachable only through expiring signed links. Backups are written with restricted permissions and are not reachable from the web.

No system is perfectly secure. If we ever discover a breach affecting your data, we will tell you and the relevant regulator promptly, and we will tell you what actually happened rather than a sanitised version of it.

10 Children

psychoded is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, write to support@psychoded.app and we will delete it.

11 Changes to this policy

If we change this policy we will update the effective date at the top and raise the version number. For changes that materially affect your rights or meaningfully widen what we collect, we will email registered users rather than relying on you to re-read this page.

12 Contact

Privacy questions, data requests and complaints: support@psychoded.app
Security reports: security@psychoded.app