Privacy Policy

This Privacy Policy explains what personal information we collect, how we use and share it, and the choices you have. It applies to the SwingMentalist website and web app (and, once released, our native Android and iOS applications) - together, the "Service" - operated by Amit Shlomo, a sole proprietor based in Israel ("SwingMentalist," "we," "us").

We are committed to processing your data lawfully, fairly, and transparently. We sell software, not your data.

Note: SwingMentalist is currently in a closed beta. Some features described in this policy may be experimental, subject to change, or temporarily unavailable. We will update this policy and notify you if any change materially affects how we collect or use your data.

1. Information We Collect

1.1 Information you give us

• Account info - email address, password (stored only as a bcrypt hash; we never see the plain text), and optional display name.
• Subscription info - your subscription tier, billing status, renewal date. We do not store your credit-card number or banking details; those are handled directly by Paddle.
• Trading workspace data - watchlists, scan presets, trade journal entries (symbol, entry/exit prices and dates, notes, P&L), free-form notes, and chart drawings. This is your data - we store it so we can show it back to you.
• Support correspondence - if you email us, we keep your message and any attachments so we can respond and improve the Service.

1.2 Information collected automatically

• Authentication tokens - when you log in we issue a signed session token (JWT) stored in your browser's local storage. It expires after 7 days.
• Server logs - IP address, browser/device user-agent, request paths, and timestamps. Used for debugging, abuse prevention, and security. Retained for up to 30 days.
• Usage events - aggregated usage metrics such as number of scans run, features used, and error rates. These are associated with your account so we can enforce per-user limits and improve the Service; they are not shared with third parties for advertising or marketing.
• Push notification tokens - if you enable push notifications, we store the device token provided by your operating system or browser so we can deliver alerts. You can revoke this at any time in your device settings.

1.3 What we do NOT collect

• We do not place advertising cookies or marketing trackers.
• We do not sell, rent, or share your data with data brokers.
• We do not access your brokerage account, real-money positions, or any data outside the Service.

2. How We Use Your Information

• To operate the Service - store your workspace, run scans, render charts, compute backtests.
• To manage your account - authenticate logins, send verification codes, enforce subscription entitlements.
• To communicate with you - transactional emails (verification, password reset, billing receipts, important Service updates) and optional product announcements you opted into.
• To improve the Service - analyze aggregate usage, debug errors, prioritize features.
• To prevent abuse, fraud, and security incidents.
• To comply with legal obligations.

3. Legal Bases (GDPR / UK Users)

For users in the European Economic Area, United Kingdom, or other jurisdictions with similar laws, we rely on the following legal bases under the GDPR / UK GDPR:

• Contract - to provide the Service you signed up for.
• Legitimate interests - to secure the Service, prevent abuse, and improve it.
• Consent - for optional features (e.g., push notifications, product newsletter).
• Legal obligation - to comply with applicable laws.

4. Third-Party Service Providers

We use the following providers to operate the Service. They process data on our behalf under their own privacy and security commitments:

Provider	Purpose	Data handled
Paddle.com Market Ltd. (UK)	Payments & subscription billing (Merchant of Record)	Name, email, billing address, payment method, transaction history
MongoDB Atlas (AWS us-east-1, USA)	Primary database hosting	All account & workspace data described above
Hetzner Online (Ashburn VA, USA)	Application server hosting	Server logs, transient request data
Cloudflare	DNS & DDoS protection (proxied)	IP addresses, request metadata
Google Firebase	Push notification delivery (FCM)	Device push token, notification payload
Google Sign-In	Optional OAuth login	Email, name, Google account ID. Currently disabled during closed beta.
Google (Gmail SMTP)	Transactional email delivery (email verification, password reset, billing receipts, optional alert notifications)	Recipient email address, sender display name, message content
Twelve Data, Inc.	Market data feed (price, volume, fundamentals, earnings calendar, news headlines)	No personal data - we query public ticker symbols only

We disclose your information to law enforcement or other parties only when required by valid legal process or to protect the rights, safety, and property of SwingMentalist, our users, or the public.

5. Where Your Data Is Stored

Our primary database is hosted in the United States (AWS us-east-1) by MongoDB Atlas. Our application server is also in the United States (Ashburn, Virginia). Paddle is based in the United Kingdom. As an operator based in Israel serving global customers, we transfer data internationally.

For users in the EU/UK: international transfers rely on Standard Contractual Clauses (SCCs) or equivalent safeguards offered by our providers. You can request a copy of the relevant safeguards by emailing us.

6. Data Retention

• Active accounts - we retain your data for as long as your account is active.
• Deleted accounts - when you delete your account, we wipe your workspace data and personal information from our primary database immediately, except where retention is required for legal, tax, accounting, or fraud-prevention purposes. Specifically, we retain a one-way hash (SHA-256) of your email address together with the deletion timestamp; this lets us detect if the same address re-registers and prevents trial-period farming. The hash cannot be reversed into the original address.
• Backups - encrypted database backups (operated by MongoDB Atlas) may continue to contain your data for a limited period after deletion - typically up to 35 days - before being automatically overwritten by newer backups. We do not restore or otherwise access individual records from backups except to recover from a data-loss incident.
• Server logs - up to 30 days.
• Billing records - retained by Paddle and by us for the period required by applicable tax law (typically 7 years in Israel).

7. Your Rights

Depending on where you live, you may have the following rights:

• Access - get a copy of the personal data we hold about you.
• Correction - fix data that is inaccurate or incomplete.
• Deletion - request that we delete your data (subject to legal exceptions).
• Portability - receive your data in a machine-readable format.
• Restriction / objection - limit or object to certain processing.
• Withdraw consent - where processing relies on consent, you can withdraw it at any time.
• Complaint - lodge a complaint with the data protection authority in your country. In Israel, the Privacy Protection Authority (הרשות להגנת הפרטיות). In the EU, your local supervisory authority.

To exercise any of these rights, email [email protected]. We will respond within 30 days. We may ask you to verify your identity first.

8. California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, including the right to know what categories of personal information we collect, the right to delete, the right to correct, and the right to opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising.

9. Security

We protect your data with industry-standard measures: TLS encryption in transit (HTTPS via Let's Encrypt), encryption at rest in MongoDB Atlas, bcrypt password hashing, signed and short-lived session tokens, firewalled servers with restricted SSH access, fail2ban for brute-force protection, and the principle of least privilege for administrator accounts. No system is perfectly secure; if a breach affects you, we will notify you and the relevant authorities as required by law.

10. Children

The Service is not intended for, and we do not knowingly collect personal information from, anyone under 18. If you believe a child has provided us personal information, contact us and we will delete it.

11. Cookies and Similar Technologies

11.1 First-party cookies - none

The Service does not set any cookies of its own on your browser. Authentication is handled by an Authorization: Bearer header carrying a JSON Web Token (JWT), not by a session cookie. We do not use first-party analytics, advertising, fingerprinting, or social-tracking cookies of any kind.

11.2 Local browser storage we do use

For strictly functional purposes - without which the Service could not work the way you expect - we store small amounts of data in your browser's localStorage and in the Progressive Web App service-worker cache. This data lives on your device, is never automatically transmitted with HTTP requests (unlike cookies), and is used only by the Service itself.

• Authentication token - your signed JWT, attached to API calls in the Authorization header. Removed on sign-out.
• Preferences - accessibility settings (text size, high contrast, reduced motion, colour-blind palette), display preferences (theme, date format, time zone), onboarding-completed flag.
• Functional caches - your watchlist, draft chart notes, and small UI state used to make the app responsive offline and across reloads.
• Service-worker cache - the application bundle, icons, and static assets, cached so the app loads instantly and works offline (PWA functionality).

Under the EU's ePrivacy Directive and the Israeli ePrivacy framework, storage that is strictly necessary for a service the user has explicitly requested does not require prior consent. All of the above falls within that exemption, which is why the Service does not display a cookie banner.

11.3 Third-party cookies on third-party domains

If you choose to use either of the following integrations, the third party may set its own cookies on its own domain. These are governed by the third party's own privacy notice, not ours, because we never receive or store them:

• Google Identity Services (accounts.google.com) - only if you click "Sign in with Google" or "Continue with Google". Google sets authentication cookies on its own domain to manage the sign-in flow. See Google's Privacy Policy.
• Paddle (paddle.com) - only when you open the subscription checkout overlay to start or modify a paid plan. Paddle sets cookies on its own domain to process the payment and prevent fraud. See Paddle's Privacy Policy.

You can decline these integrations and still use the Service - sign up with an email and password instead of Google, and remain on the free tier instead of opening the Paddle checkout.

11.4 How to clear locally-stored data

You can erase all of the local storage described above at any time by using your browser's "Clear site data" / "Clear storage" tool for the SwingMentalist domain, or by signing out (which clears the authentication token explicitly). Clearing the data will sign you out and reset your preferences to defaults.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced by email or via a notice in the Service at least 30 days before they take effect. The "Last updated" date at the top reflects the most recent version.

13. Contact

Questions, complaints, or data-rights requests? Email [email protected].