Privacy Policy

Publisher: EDGYX SAS, 61 Rue de Lyon, 75012 Paris, France (SIREN 994 642 866), controller of the data described here. For any question about your data: contact@edgyx.ai.

Scope: this policy covers the www.edgyx.ai website and the Edgyx: Trading Journal app (« Edgyx : Journal de trading » in French), published on Google Play (Android) under the developer name "Edgyx" and available on the App Store (iPhone, iPad, Mac). One account works on both the website and the app.

Account Information: Email, name, profile picture when you create an account. If you sign in with Google or Apple, they send us your name and email (with Apple, this may be a relay address). We also store your answers to the welcome questionnaire (goals, experience, markets) and, if you fill them in, your bio and links.

Trading Data: Trades you enter manually, import from a file or sync from a broker (MT4, MT5, cTrader, TradeLocker, Interactive Brokers, Tradovate, NinjaTrader), along with your portfolios, trading plans, journal notes, emotions and daily mood. This data is encrypted.

Broker Connectors: to sync your trades, we keep what each broker requires: account number and server (MetaTrader), access tokens (cTrader, Tradovate, NinjaTrader, TradeLocker), Flex token and query ID (Interactive Brokers). The TradeLocker password is stored encrypted (AES-256). The MetaTrader password (we ask for the read-only investor password) is not kept in our database: it is sent to our MetaTrader sync server, which keeps it to connect to the account. Edgyx never places orders.

Images and Documents: trade screenshots and attachments, note images and files, post media, your avatar, files sent to Ora or to support. They are stored with Supabase, in the EU. Images (trades, notes, backtests, community, avatars, trading cards) are served from a direct web address: anyone who has the link can display them. Documents attached to trades and notes, and files sent to Ora or to support, are private: they only open through a temporary link, from an account that has access to them.

Community and Private Messages: your posts, comments, reactions and profile are visible to other members; your private messages, only to their recipient. They go through an automatic filter of banned terms, and our team may read them to handle a report. If you join a school or accept a mentor, they can see your trades and journal.

Conversations with Ora: your messages, Ora's answers and the files you attach are stored for your conversation history. If you report an Ora answer, a copy of the reported passage is kept with your report.

Notifications: in the app, a notification token specific to your device is registered; on the website, only if you enable browser notifications. It is used to send you the alerts and reminders you chose.

Usage Data: we do not track the pages you view in the app. We count feature usage from actions already stored (a trade created, a message to Ora…) and from Ora's interventions, to improve the service. Audience measurement on the website's public pages is described in "Cookies & Tracking".

Technical Data: IP address, browser and device, in our hosting providers' logs. When you sign up with a referral code, your IP address, browser and a device fingerprint are used to detect fraud.

Payment Data: Processed by the service that collects the payment, never by us: Stripe for a subscription paid on the website, Apple (App Store) or Google (Google Play) for an in-app purchase. We never store your credit card details. We keep your subscription history (plan, status, renewal dates) and the transaction references the store sends us to verify the purchase.

AI Analysis: Ora analyzes your trades, notes and messages to provide personalized insights and detect biases. These analyses are performed by OpenAI (see "Service Providers and Recipients"). Some app features run on your device without sending anything (see "Apps").

Service Improvement: Anonymous, aggregated statistics, never per member, help us improve the platform.

Communication: We send important account updates and optional marketing emails.

Support: Your data helps us provide better customer support.

Notifications: the alerts, reminders and debriefs you chose are delivered by Apple (APNs) on iPhone, iPad and Mac, by Google (Firebase Cloud Messaging) on Android, and by your browser's push service on the website. These services carry the notification's title and text.

Moderation and Security: filtering banned terms, handling reports and blocks, detecting referral fraud.

We do not sell your data. It only goes to the providers that run Edgyx on our behalf, and to the people or services you choose.

Hosting: Supabase (database, authentication, files; servers in the EU) and Vercel (website and API, functions running in Paris; a US company).

Artificial Intelligence: OpenAI (United States) receives what Ora needs to analyze: trades, notes, messages, attached files. Under its API terms, OpenAI does not train its models on this data and may keep it for up to 30 days to detect abuse.

Payments: Stripe (website), Apple (App Store) and Google (Google Play Billing), each for the purchases made with them.

Sign-in: Google ("Continue with Google", on the website and the apps) and Apple ("Sign in with Apple", on iPhone, iPad and Mac), if you choose them.

Notifications and Emails: Apple (APNs), Google (Firebase Cloud Messaging), your browser's push service, and Brevo for emails (address and first name).

Charts: a trade's price chart is a TradingView widget, loaded from TradingView's servers on the website and in the apps. TradingView receives the symbol and timeframe displayed, plus the technical information of any web request (IP address, browser). Likewise, a course video hosted on YouTube or Vimeo plays in that service's player, which receives the same technical information.

Brokers: syncing goes through the brokers you connect and, for MetaTrader, through our sync server. Older MetaTrader accounts connected through the MetaApi service no longer sync: MetaApi keeps their login details until you reconnect them or delete your account, which removes them from MetaApi.

What You Share: the mentors and schools you join, the share links and dashboards you publish, the tools you connect with an API key (Claude via MCP, expert advisor), and the Discord channel you link with a webhook: your closed trades and trading cards are posted there, each card being rendered as an image by the ApiFlash service.

Transfers Outside the EU: when a provider processes data outside the European Union (notably in the United States), the transfer relies on the safeguards provided by the GDPR, such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

Permissions: microphone and speech recognition, only for dictation; notifications; photos through the system picker, which only gives the app the images you select. No location, no access to contacts or calendar.

Dictation: on iPhone, iPad and Mac, your voice is transcribed on the device. On Android, by the phone's speech recognition service, on the device when possible; otherwise that service (often Google's) may process the audio under its own terms. Edgyx only receives the text, never the audio. The website has no dictation.

On-device Processing: reading a trade screenshot and on-device intelligence (Apple Intelligence on iPhone, iPad and Mac; Gemini Nano on Android devices that support it) work without sending the image or the text. On Android, these features use Google's ML Kit, which sends Google technical diagnostics (device model, performance, errors, installation identifier), without the image or the text.

No Ads, No Tracking: the apps include no advertising, analytics or crash-reporting SDK (apart from the ML Kit diagnostics described above) and do not use the advertising identifier.

Encryption: All data is encrypted at rest (AES-256) and in transit (TLS).

European Servers: Data is stored on Supabase servers located in the EU.

Access Control: Strict internal access policies. Only authorized personnel can access data.

Regular Audits: We conduct regular security audits and penetration testing.

Access: Request a copy of all your personal data.

Rectification: Correct any inaccurate personal data.

Erasure: Request deletion of your account and all associated data.

Portability: Export your data in a machine-readable format.

Objection: Opt-out of marketing communications at any time.

Exercising Your Rights: write to contact@edgyx.ai; we answer within one month. You may also lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.

Essential Cookies: Required for the platform to function (authentication, preferences).

Audience measurement (Google Analytics 4): only on the public pages of the site (not in the signed-in app), and only if you accept it in the banner. Without your consent, no Google script is loaded and no measurement cookie is set. _ga cookies are kept for at most 13 months; your choice is remembered for 13 months if you accept, 6 months if you decline. You can change it at any time with "Manage cookies" at the bottom of every page, which also deletes cookies already set.

No Advertising Cookies: We do not sell your data or use advertising tracking.

Apps: no banner and no audience measurement in the iPhone, iPad, Mac and Android apps: no Google Analytics, no measurement cookie set by Edgyx.

Active Account: Data is retained as long as your account is active.

Account Deletion: All data is permanently deleted within 30 days of account deletion: immediately in our database and file storage, then in technical backups and at our providers as they are renewed.

Legal Requirements: Some data may be retained longer if required by law, notably invoices for a subscription paid on the website, accounting records kept for 10 years (article L123-22 of the French Commercial Code) in our Stripe account, along with the customer record they belong to (email, plus billing name and address if entered at checkout).

Deletion Record: if a deletion step fails at one of our providers, we keep a technical record (internal account ID, step, references needed to finish it, no email and no content) until the step is completed.

In the app: profile picture › Settings › Delete account › Delete permanently.

On the website: profile picture › Settings › Account › Delete account.

Without access to your account: email contact@edgyx.ai from the account's email address.

Deletion stops a subscription paid on the website or on Google Play; an App Store subscription is cancelled with Apple. Detailed steps, what is deleted and what is kept: Delete your Edgyx account.