1. Controller

Kolosseum.pro
Email: support@kolosseum.pro

This policy explains what personal data Kolosseum Journal processes, why, where, for how long, and which rights you have under the General Data Protection Regulation (GDPR).

2. Data we process

• Account data: your email address and a salted password hash, managed by our authentication provider. Timestamps of sign-up, email confirmation and last sign-in.
• Profile: an optional handle, an optional profile image you upload (downscaled to 256 × 256 pixels), your timezone and language, and your sync preferences.
• Exchange connection: the read-only API key, secret and passphrase you enter. They are encrypted with AES-256-GCM before storage; the encryption key is held only on the application server and never in the database. The app displays only the first and last four characters of the key.
• Journal data: closed positions and individual fills imported from your exchange (symbol, direction, size, prices, leverage, times, realised profit or loss, fees), plus everything you add: playbooks and rules, rule checks, grades, notes, chart screenshots and day notes.
• Technical data: IP address, browser type and request metadata in server logs, and the cookies described in section 8.

We do not process payment data, and we do not collect data from your device beyond what your browser sends with each request.

3. Purposes and legal bases

• Providing the journal, including importing and displaying your trades: performance of the contract, Art. 6(1)(b) GDPR.
• Account security, abuse prevention, error diagnosis: legitimate interest in a secure and reliable service, Art. 6(1)(f) GDPR.
• Optional profile image and handle: your consent, Art. 6(1)(a) GDPR, revocable at any time by removing them in the settings.
• Emails for sign-up confirmation, password reset and email change: performance of the contract, Art. 6(1)(b) GDPR. We send no marketing emails.

4. Where data is stored

Database, authentication and file storage are provided by Supabase Inc. and hosted in Frankfurt, Germany (EU). The application is hosted by Vercel Inc. in Frankfurt, Germany (EU). Both act as processors under data processing agreements including the EU standard contractual clauses for any support access from outside the EU.

Trade data is retrieved directly from your exchange (currently BloFin) over encrypted connections using your read-only key. The exchange's own privacy policy applies to your account there.

5. Recipients

Personal data is not sold, rented or shared with advertisers. Recipients are limited to the processors named above and, where required, the email delivery provider configured for transactional emails. We disclose data to authorities only where legally obliged.

6. Retention

Account, profile, exchange and journal data are kept for as long as your account exists. When you delete your account in the settings, all database rows and stored files linked to it are deleted immediately and permanently; backups of the database expire within 30 days. Server logs are retained for a short period, typically up to 30 days, for security purposes.

7. Your rights

You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent you may withdraw it at any time with effect for the future. Most of this you can do yourself in the settings: change email, handle, image and preferences, disconnect exchanges, delete your account. For anything else write to support@kolosseum.pro. You also have the right to lodge a complaint with a data protection supervisory authority.

8. Cookies and local storage

The Service uses only strictly necessary cookies: the session cookie that keeps you signed in (set by the authentication provider) and a cookie that remembers your chosen language. There are no advertising, tracking or analytics cookies and no third-party trackers.

9. Security

All connections use TLS. Passwords are stored only as salted hashes. Exchange secrets are encrypted at rest and are never returned to the browser. Database access is restricted per user through row-level security so that one account can never read another's rows. Access to production systems is limited to the operator.

10. Children

The Service is intended for adults. We do not knowingly process data of persons under 18; if you believe a minor has created an account, contact us and we will delete it.

11. Changes

We may update this policy, for example when we add features or change processors. The current version with its date is always available at kolosseum.pro/privacy. Material changes will be communicated in the app or by email.

12. Contact

Kolosseum.pro · support@kolosseum.pro