Privacy Policy
Last updated: 22 septembre 2026
This page explains what StrixFX does with your data. It is written to be understood, not to hide behind jargon. If anything stays unclear, write to us: that's a flaw in the text, not in your reading.
In short
- We don't sell your data to anyone, and we earn no advertising revenue from it.
- There is no advertising and no tracking on StrixFX.
- Your journal is yours. You can export it and delete everything whenever you want, without asking us.
- What you write to the AI assistant is never used to train a model, and is not stored anywhere.
1. Who is responsible for your data
Data controller: Ethan Feat.
For any question about this page or to exercise your rights: sav@strixfx.com.
There is no data protection officer, and the law does not require one here: StrixFX is not a public body, does not monitor anyone on a large scale, and processes no sensitive data within the meaning of the GDPR.
2. What we collect, and why
To create your account and let you in
Your email address, your username, your avatar, your language and your display settings. If you enable fingerprint or face sign-in, we record the device, not your fingerprint: it never leaves your phone or computer. We only keep a public key and a counter used to detect a cloned device.
For your trading journal
Your trades (instrument, direction, sizes, prices, dates, result, the emotion you declare), your trading accounts, your notes, your tags, your plans and the screenshots you add. This information says a lot about your financial situation: we handle it with the same care as sensitive data, even though the law does not classify it as such.
For financial management
The transactions you enter, your goals and your recurring expenses. StrixFX does not connect to any bank account: everything shown there is what you wrote yourself.
For your discipline and progress
The rules you set for yourself, your answers at checkpoints, your reviews, your experience and tiers, your daily challenge results, and the history of your trader profile.
For the subscription
Your subscription status and the identifiers needed for payment. No card data ever passes through StrixFX: Stripe handles it, and we never see it. We also record your acceptance of the terms: which document, which version, when, and the exact text you were shown. That protects you as much as us.
To connect you to your broker, if you ask for it
If you connect your broker or platform, we keep what's needed to read your history: tokens and keys are encrypted, and the MetaTrader EA and NinjaTrader add-on keys are only hashed. With most brokers, your key stays in your browser and never reaches us. Nothing runs without your action, and you can disconnect at any time.
To write to you and fix outages
Your email address, only for matters concerning your account: sign-in link, confirmations, and warnings before an inactive account is deleted. When a technical error occurs, a report goes to our outage tracking tool: it contains technical information, not the contents of your journal.
To tell you the day we open
If you leave your address in the « Tell me when it opens » form, it does one thing only: send you an email the day StrixFX opens. One email, no newsletter, no follow-up. That processing rests on your consent, not on a contract · you give it by ticking the box yourself, and you can withdraw it whenever you like, without having to explain · every email carries an unsubscribe link that works in one click. Until you click the confirmation link sent by email, you are not signed up, and nothing is kept beyond seven days. We record, so we can prove it: your address, the date and time, the page language, the IP address you confirmed from, and the exact wording you had in front of you. Your address is never sold, lent, or used for anything else.
When you report a bug or suggest an idea
Your description, the chosen category, the page you were on, your browser's name, and an email address so we can reply · your account's address if you're signed in, or the one you type yourself from the sign-in screen. Attached screenshots never leave your device: we don't receive them. We rely on our legitimate interest in fixing what breaks.
When we help you by looking at your account
To help you, the team can display your account in read-only mode: nothing is changed. Each opening requires a written reason, lasts 30 minutes at most and is logged. Your broker keys are never visible. We rely on our legitimate interest in assisting you. You can object in My profile › Privacy: access is blocked as soon as you ask.
3. What we don't do
- No advertising, no advertising revenue, no ad network.
- No resale of your data, to anyone, in any form.
- No tracking of your browsing outside StrixFX.
- No automated profiling producing legal effects concerning you.
- No bank connection.
- A single form of profiling, and it only displays: your trader profile, computed from your reviewed trades. It decides nothing for you. Every automated processing in StrixFX, its logic and its consequences are described in the privacy center of your account, where you can also contest one.
4. AI: the assistant and the voice note
Four different things go through our artificial intelligence provider, and they are not equivalent.
The psychological analysis only sends percentages: your win rate, your longest losing streak, your share of trades taken under emotion, your discipline score. No name, no email, no text you wrote.
The monthly report only sends figures.
Chatting with the assistant sends what you type.
There are TWO voice recordings, and they do not end the same way. ① The one that fills the fields (30 s): your voice goes to our provider just long enough to become text, then it is erased · it is kept nowhere, neither by us nor by them, and none of that text is stored. ② The voice note you keep (2 min, on a trade): it stays on YOUR device, in your browser · it is never sent to us, and you delete it yourself whenever you like, permanently. In both cases your voice is never analysed for its tone, pace or emotion: we read what is said, never how it is said.
The daily plan: if you fill it in, you can note your mood, your energy and your night (good, average or short). These three fields are optional. They are shown only to you, next to your verdict of the day · they are never sent to the AI assistant, never used in a statistic or to draw any conclusion about your health. You can erase them at any time (« Start from scratch », or deleting your account).
Our provider is Groq, Inc., established in the United States. This transfer is governed by the European Union's standard contractual clauses.
Two commitments, from its contract and our settings: it is contractually forbidden from using what we send, or what it answers, to train or fine-tune a model; and the "zero data retention" option is enabled on our account, so nothing is logged, not even temporarily.
Finally, StrixFX stores none of your conversations with the assistant. They exist in none of our tables.
5. Who else sees your data
We use providers, which act on our instructions and are not allowed to use your data for themselves.
| Provider | Why | Where |
|---|---|---|
| Supabase | database, sign-in, file storage | Ireland |
| Vercel | website hosting | European Union and United States |
| Stripe | payment and invoices | European Union and United States |
| Brevo | sending emails, including the opening announcement | France, Germany, Belgium |
| Sentry | outage reporting | European Union and United States |
| Groq | AI assistant and voice transcription | United States |
| cTrader (Spotware) | reading your history, if you enable it | Cyprus |
| TradingView | chart shown on the Markets page | display only |
| Cloudflare (R2) | daily database backup | European Union |
| GitHub | running that backup | United States |
For providers outside the European Union, transfers are governed by the European Commission's standard contractual clauses, and where applicable by the EU - US Data Privacy Framework.
Your broker or exchange, if you connect them, are not our providers: they send us your history at your request, under their own privacy policy.
6. How long we keep all this
| What | How long |
|---|---|
| Your account and everything in it | as long as your account exists |
| What you move to the bin | 30 days, then permanently deleted |
| Your kept voice note | on your device only, never with us · until you delete it |
| An inactive account | 3 years after your last activity, with two warning emails beforehand |
| Proof of acceptance of the terms | duration of the contract, then 5 years |
| Invoices | 10 years, at Stripe: an accounting obligation |
| Outage reports | 90 days at most |
| What you write to the AI assistant | nothing is kept |
| Your address for the opening announcement | until we open, then erased · seven days only if you never confirmed, and three years at most in every case |
| A bug report or a suggestion | kept for follow-up · your email address is removed from it if you delete your account |
| Your monthly reports | 1 year each, then erased · you can download each report before |
| Database backups | 30 days, then deleted |
| Our hosts' technical logs (IP address, page requested) | 7 days at most |
About inactive accounts: we never delete without warning. You receive an email two and a half years after your last activity, then a second one a month before deletion. A single sign-in resets the counter.
What survives the deletion of your account: your invoices, for ten years, because accounting law requires it (they stay at Stripe, not with us); proof that you accepted our terms and the list of Premium content you opened, with your email address, which we use to prove what happened in case of a dispute; and your bug reports, without your address. Nothing from your journal or your trades is part of it.
7. When we look at your account
We may need to see your account as you see it, to understand a problem you report to us.
This mechanism is controlled: a written reason is mandatory, otherwise access is refused; access is time-limited and closes on its own; every access is logged.
Your broker connection tokens are never visible this way.
8. Cookies
A cookie is a small file the site stores in your browser.
StrixFX sets only one kind: the one that keeps you signed in. Without it, you would have to sign in on every page. It is strictly necessary for the service, and as such the law does not require your consent for it.
There is no advertising cookie, no analytics, no tracking. That is why you don't see a cookie banner when you arrive.
The TradingView chart shown on the Markets page is provided by a third party. We checked what it stores: no cookie, and two technical settings stored by that service in your browser (a drawing-tool preference and a storage availability test). No identifier, no tracking.
9. Your rights
The GDPR gives you rights over your data, and they are exercised free of charge.
- Access it and obtain a copy: the export is available directly in your account.
- Correct it if it is wrong.
- Delete it: the button is in your account, and it really deletes, without going through us.
- Restrict processing or object to it.
- Take it elsewhere, in a format readable by another application.
- Withdraw your consent where a processing rests on it: the broker connection, or the opening announcement.
- Decide what happens to your data after your death: delete everything, or pass a copy to the person of your choice. The setting is in your account, and you can change or cancel it at any time.
- Have a human review a decision made automatically, give your point of view and contest it.
Write to sav@strixfx.com. We answer within one month.
If our answer doesn't satisfy you, you can refer the matter to the CNIL, the French data protection authority, at cnil.fr.
Without a directive from you, the law applies: your heirs can have your account closed and obtain what is needed to settle your estate (Article 85 of the French Data Protection Act, loi Informatique et Libertés).
Most of these requests can also be made from the privacy center of your account (My profile · Privacy), with a dated history of each one.
10. How your data is protected
- Everything travels over an encrypted connection, and the browser refuses to even try otherwise.
- Data is encrypted on our host's disks.
- Every table is partitioned: your account technically cannot read another's rows.
- Backup codes are hashed: not even we can read them back.
- Fingerprint sign-in relies on a public key, never on your fingerprint itself.
- Your broker keys and tokens are encrypted, or only hashed: a stolen copy of the database would not reveal them.
No system is infallible. If a breach occurred and presented a risk to you, we would notify the CNIL within 72 hours and write to you directly.
11. If this page changes
Any change is published here with a new date. If the change is significant, you are informed and invited to review it before it applies.