Privacy Policy
Last updated 2 October 2026
This policy explains what personal data Propbook collects, why, on what legal basis, how long we keep it, who processes it for us and how you can use your rights. It is written from what the app actually does. It applies wherever you are; where your local law (EU/UK GDPR, Swiss FADP, Brazil's LGPD, California's CCPA, Canada's PIPEDA or Quebec's Law 25, and others) gives you more rights, you get them.
Who is responsible
The controller is Kylian Couzon (France, 18 bis allée des Hirondelles, 97430 Le Tampon, La Réunion, France). Contact: propbookoff@gmail.com. EU representative: Not required — the publisher is established in the European Union. UK representative: appointment in progress. Propbook is small and has no data protection officer; the managing member answers data requests personally.
What we collect and why
| What | Why | Legal basis | How long |
|---|---|---|---|
| Account: email, password (stored only as a hash by our sign-in provider), two-factor setting | Create your account, sign you in, secure it | Contract | Until you delete your account |
| Journal: accounts, trades, P&L, tags, notes, moods, screenshots you add, prop firm rules, settings | Provide the journal and sync it across your devices | Contract | Until you delete it or your account |
| Sign-up answers (optional): experience, platform, how you heard of us | Set the app up for you; learn which channels bring traders | Contract (setup) and legitimate interest (channels) | Until you change them or delete your account |
| Broker connection: your ProjectX / TopstepX username and API key (encrypted with AES-256), account list, PropSync setup and the log of every order PropSync sent or simulated | Run PropSync and the TradingView webhook for you | Contract | Until you disconnect or delete your account |
| Telegram: your chat ID (official bot) or your own bot token | Send your alerts and recaps | Contract | Until you send /stop, disconnect or delete your account |
| Pip AI (when you ask for a written review or a question): a summary of your numbers — results by day, weekday, hour, instrument, setup tag and mood, and each account's rule status — plus your question. Never raw notes, screenshots, broker logins or keys | Answer you | Contract (you ask for it) | Not stored by us beyond the time of each run, kept 35 days (for the daily and monthly limits). Our AI provider keeps inputs only as its API terms describe (see below) |
| Public profile (only if you publish one): your handle and the anonymised stats you choose (percentages, win rate, profit factor) — never account numbers or dollar amounts | Show your profile to anyone with the link | Consent — unpublish anytime | Until you unpublish it |
| Referral code and who referred whom | Credit referral rewards | Contract | Until you delete your account; reward records with billing records |
| Feedback and PropSync waitlist: your message, your email if you add one, the platforms you picked | Reply to you; tell you when PropSync opens on your platform | Legitimate interest (feedback); consent (waitlist — you type your email to join) | 3 years for feedback; the waitlist email is deleted once we have told you, or 12 months at most |
| Emails: account emails (confirmation, password reset) and at most two product emails — a welcome email and one reminder if you haven't added an account | Run your account; help you get started | Contract (account emails); legitimate interest (product emails — one-click unsubscribe in each) | Your unsubscribe choice is kept as long as your account exists |
| Payments (Propbook One): plan, billing period, country, invoices, the last four digits and brand of your card as shown by Stripe. Card numbers go straight to Stripe — we never see them | Bill you, apply taxes, handle refunds and disputes | Contract; legal obligation (tax and accounting) | 10 years for invoices and tax records, then deleted |
| Account activity: the dates (day only) on which you opened the app while signed in, plus when you last signed in | Know how many people use Propbook each day and help you if something goes wrong | Legitimate interest | 13 months, then deleted; everything is removed when you delete your account |
| Certificate and review request: if we send you your registration certificate by email, your name, email address and account dates go into it, with a link to leave a review on propbooktrading.com. Reviewing is optional and never a condition of anything | Give you proof of your account; ask for an honest review | Legitimate interest | The email stays in our mailbox like any other message |
| Reviews you leave on the site: your first name, the prop firm or profile you add, your rating and text — no email address. Each review is read by hand and only shown once we publish it | Show honest reviews of Propbook on the website | Consent — you tick the box when you send it; ask us to remove it anytime | Until you ask us to remove it, or we stop showing reviews |
| Anonymous usage statistics: a short list of events (“opened the app”, “created an account”, “imported a file”…) tied to a random identifier stored in your browser, never linked to your account, never containing trades, P&L or account numbers | Count visits and see which features are used | Legitimate interest — audience measurement exempt from consent; you can switch it off | 13 months, then deleted; the browser identifier is renewed every 13 months |
| Technical logs: IP address, browser, time and page requested, kept by our host | Keep the service running and secure, stop abuse | Legitimate interest (security) | 30 days at most |
In guest mode, your journal stays in your browser's storage and is never uploaded; only the anonymous usage events are sent (unless you turned them off). The screenshot scanner reads your chart images inside your browser — the image is never uploaded.
We do not use your data to make automated decisions with legal or similarly significant effects on you, and we do not sell or share your personal information for cross-context behavioural advertising (as defined by California law).
Who processes your data for us
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting of the website and server functions | United States (global network) |
| Supabase Inc. | Database, sign-in, file storage | region being confirmed |
| Anthropic PBC or Groq Inc. | Pip AI answers (one provider at a time) | United States |
| Brevo (Sendinblue SAS) or Resend Inc. | Sending emails (one provider at a time) | European Union (Brevo) / United States (Resend) |
| Stripe | Payments and invoices | United States and Ireland |
| Telegram | Delivering your alerts, only if you connect it | Telegram's infrastructure |
| ProjectX / TopstepX | Your own broker connection, only if you connect it | United States |
Each provider only gets what it needs for its task. Under their API terms, our AI providers do not use your inputs to train their models. Stripe also acts as an independent controller for fraud prevention and its legal duties. Market quotes and the economic calendar are fetched by our server; your data is not sent to those sources.
We never load advertising or analytics scripts from other companies. Fonts, libraries and logos are served from our own domain.
International transfers
Propbook is run by a company based in the United States, and several providers are based there. When your data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) included in our providers' data processing terms, or on the EU-U.S. Data Privacy Framework where the provider is certified. You can ask us for a copy of these safeguards.
How we protect it
Encrypted connections (HTTPS) everywhere; row-level access rules so each user can only read their own rows; broker API keys encrypted with AES-256 on the server; two-factor confirmation required before PropSync can place live orders; admin access protected by two-factor authentication; a strict content security policy that blocks third-party scripts.
Your rights
Depending on where you live, you can ask to access your data, correct it, delete it, get a copy in a reusable format (portability), restrict its use, object to uses based on legitimate interest (including the product emails and usage statistics), and withdraw consent at any time. Californian residents can also ask what personal information we collect and disclose, and will not be treated differently for using their rights.
- Yourself, instantly: Settings → Your data lets you export your journal and delete your account. Deleting your account removes your journal, sign-up answers, broker connection, PropSync setup, Telegram link and public profile; backups roll over within 30 days. Invoices are kept as the law requires.
- Usage statistics: switch them off in Settings → Your data or with the “Usage statistics” link at the bottom of our home page. Nothing is collected if your browser sends a Global Privacy Control signal.
- Product emails: one-click unsubscribe link in every email.
- Anything else: write to propbookoff@gmail.com. We may ask you to confirm your identity from your account email. We answer within one month (extendable by two months for complex requests, and we will tell you if so), for free.
If you are not satisfied, you can complain to your data protection authority — for example the CNIL in France (cnil.fr), the ICO in the UK (ico.org.uk), or the authority of your EU country (list of EU authorities).
Age
Propbook is for adults: you must be at least 18 to create an account. We do not knowingly collect data from children; if you think a child has signed up, write to us and we will delete the account.
Changes
If we change how we use your data in a way that matters, we will tell you in the app or by email before it applies. The date at the top shows the last update.
See also: Cookies & storage · Terms of Use · Legal notice