Privacy Policy

This policy explains what Markov does with personal data, and your rights over it under the UK GDPR and the Data Protection Act 2018. The controller is Marcu Calandea, at 24 Barbastelle Crescent, Hethersett, NR9 3FR, United Kingdom.

What we collect

Account data

Your email address, and a password stored only as a hash by our authentication provider — we never see or store the password itself. Also the date you signed up and when you last signed in.

Trading data you enter

The trades you log — symbol, direction, entry and exit prices, size, times, notes, and calculated profit or loss. Where you edit a trade we also keep the original values and the time of the edit, so the journal stays honest.

Account and rule settings

Prop firm accounts you track (firm name, account size, phase, profit target, drawdown limits), the rules you set, and the violations recorded when logged activity breaches them.

Subscription data

Your subscription status, trial end date, and the Paddle customer and subscription identifiers. We do not receive, process or store your card details at any point — those go directly to Paddle.

Why we use it, and our lawful basis

• To provide the service — storing your trades, running the rule engine, showing your history. Lawful basis: performance of a contract.
• To bill you — managing trials, subscriptions and cancellations. Lawful basis: performance of a contract.
• To keep the service secure and working — diagnosing faults, preventing abuse. Lawful basis: our legitimate interests in operating a secure service.
• To meet legal obligations — for example retaining records needed for tax. Lawful basis: legal obligation.

We do not sell personal data, we do not use it for advertising, and we do not carry out profiling or automated decision-making that produces legal effects.

Who we share it with

These are our processors. We use no others.

Supabase

Hosts the database and handles authentication. Your account and all data you enter are stored there. Data is held in the EU (London region). Acts as a data processor on our instructions.

Paddle.com Market Ltd

Processes payments as Merchant of Record. Paddle receives your email and billing details directly from you at checkout and is an independent controller for the payment itself, as well as a processor for the subscription status it reports back to us.

Vercel

Serves the website. Processes technical request data such as IP address in the course of delivering pages.

We may also disclose data where the law requires it. If the business is ever sold, data may transfer with it, and you would be told first.

Cookies and local storage

This site sets no cookies of its own. We use no analytics, no advertising pixels, and no third-party tracking.

To keep you signed in, our authentication provider stores a session token in your browser's local storage, under a key beginning sb-. It holds an access token, a refresh token and your basic account details. It is not a cookie and is not sent automatically with every request — the app reads it and attaches it deliberately. It is strictly necessary for signing in, and clearing your browser storage signs you out.

When you open the subscription screen we load Paddle's checkout script from cdn.paddle.com. Paddle may set its own cookies or storage as part of processing a payment; that is governed by Paddle's own privacy notice. No Paddle code loads anywhere else in the app.

How long we keep it

• Account, trade and rule data: for as long as your account exists.
• After you delete your account: removed from the live database immediately, and from routine backups within 30 days.
• Billing and transaction records: retained by Paddle, and by us where required, for six years to meet UK tax and accounting obligations.

Your rights

Under the UK GDPR you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• receive your data in a portable, machine-readable format;
• restrict or object to how we process it;
• withdraw consent where processing relies on it.

To exercise any of these, email marcucalandea@icloud.com. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

You can also complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to resolve it first.

International transfers

Our database is hosted in the UK/EU. Some processors may handle data outside the UK; where they do, transfers are covered by UK adequacy regulations or the International Data Transfer Agreement.

Security

Data is encrypted in transit. Access to your records is enforced at the database level, so one account cannot read another's rows. Payment card data never reaches our systems.

Contact

marcucalandea@icloud.com
Marcu Calandea, 24 Barbastelle Crescent, Hethersett, NR9 3FR, United Kingdom