LiquidJournalPrivacy Policy
LiquidJournal is a trading journal. It only works if you put real, personal, sometimes uncomfortable information into it: your trades, your losses, your notes about why you broke your own rules. This page explains exactly what happens to that information, in plain language.
1. Who is responsible for your data
Marek Kosorin, trading as LiquidJournal (“we”, “us”) is the data controller for the information described here. You can reach us at liquidjournaling@gmail.com for any privacy question or request, including deletion.
2. What we collect
Information you give us
- Account details: your email address and display name. If you sign up with a password we store a one-way hash of it, never the password itself. If you sign in with Google we receive your email, name and profile picture from Google. If you sign in with Apple we receive your email (or Apple's private relay address, if you hide yours) and, the first time only, your name; when you delete your account we ask Apple to revoke that sign-in.
- Your trading data: trades, entry and exit prices, position sizes, P&L, tags, grades, screenshots and chart images you upload, journal entries, daily and weekly reviews, playbooks and strategies, and prop-firm account details you choose to track.
- Community content: posts, replies, likes, reposts, follows, direct messages, Live chat messages, your public profile, and any avatar or banner image you upload. When you speak on a Live stage, your voice goes out live to the people listening; lives are not recorded, and Live chat is deleted 30 days after the live.
- Support messages: anything you send us through the in-app problem or feature forms, or by email.
Information created by using the service
- Subscription status: your plan, and identifiers from our payment processor so we know what you are entitled to.
- Founding member number, if you have one, and any leaderboard entries or achievements you have opted into publishing.
- Ordinary server logs generated by our hosting provider, which may include IP address, browser type and timestamps. These are used for security and debugging.
What we deliberately do not collect
- No advertising or analytics trackers. There is no Google Analytics, no Meta pixel, no Segment, no session-replay tool and no ad network in this product. We do not build advertising profiles and we do not sell or rent your data to anyone.
- No card numbers. Payment details are entered on our processor's own systems and never touch our servers.
- Broker logins only if you connect one. If you choose to connect a Rithmic account, you give us that Rithmic login so we can read your fills (see section 4). We never ask for the password to your prop firm's website, your bank or your email. Anyone asking for those in our name is not us. Please report it.
3. Why we use it, and our legal basis
| Purpose | Data used | Legal basis (UK/EU GDPR) |
|---|---|---|
| Run your account | Account details, subscription status | Performance of our contract with you |
| Store and show your journal | Trading data, journal entries, uploads | Performance of our contract with you |
| AI coaching and analysis | The trades, journal entries and Study Room notes relevant to what you asked for | Performance of our contract; you choose when to use it |
| Community features | Profile, posts, messages | Performance of our contract with you |
| Public leaderboards | Derived stats, name or anonymous label | Your consent (opt-in, and withdrawable at any time) |
| Take payment | Email, subscription identifiers | Performance of our contract; legal obligation for records |
| Security, abuse prevention, debugging | Server logs | Our legitimate interest in a working, non-abused service |
4. Who else touches your data
We use a small number of specialist providers to run the product. They may only process your data on our instructions, for the purposes below.
| Provider | What it does | What it sees |
|---|---|---|
| Supabase | Database and file storage | Everything you save in your account |
| Vercel | Hosting and delivery | Requests and server logs |
| OpenRouter (DeepSeek) | AI coaching, reviews, CoWork (including screenshots you attach), journal analysis | The content sent for a given request, images included; not used to train models |
| Rithmic | Reading your fills if you connect a Rithmic account | Your Rithmic username and password when you sync. We store the password, encrypted, only while Remember sign-in is ticked, and delete it when you disconnect |
| Stripe | Payments and subscriptions | Your email and payment details you enter with them |
| Optional sign-in | Only that you signed in, if you use it | |
| Apple | Optional sign-in (Sign in with Apple) | Only that you signed in, if you use it |
| YouTube (Google) | Playing a video you add to a Study Room note | Nothing until you press play. Then your browser loads the video from YouTube's privacy-enhanced player, which sees your IP address and browser details. To show a video's title, our server asks YouTube about the video link only, never about you |
| Apple (Push Notification service) | Notifications on your phone in the LiquidJournal iOS app, if you allow them | Your phone's notification address and the words of each notification. Amounts are hidden on the lock screen unless you choose to show them |
| LiveKit | Carrying the sound and the shared screen of Community Live | Your Community name and picture while you are in a live, your voice if you speak on the stage, and your IP address and connection details. Nothing is recorded |
| GIPHY | GIFs in the Live chat | The words of a GIF search, sent by our server, never who searched. The GIF pictures load from GIPHY, which sees your IP address and browser details |
| Resend | Delivering support emails you send us | The message you submitted |
Our AI provider does not use data submitted through its business API to train its models, and we do not permit our providers to use your content for their own purposes.
In the LiquidJournal iOS app, nothing goes to the AI until you allow it on the screen the app shows you. You can change that at any time in Settings, Data & Privacy.
If you allow notifications in the app, we keep your phone's notification address, its time zone, the hours you picked and a log of what we sent, so the same insight never repeats. Daily and weekly reminders are set on the phone itself. Signing out on that phone stops them; deleting your account removes these records.
Market data providers (for candles and the economic calendar) receive only a symbol and a date range. They are never sent anything about you.
We may also disclose data if we are legally required to, or to protect our rights or someone's safety. If our business is ever transferred to someone else, your data may transfer with it, and this policy travels with your data.
5. Where your data goes
Our providers may process data outside your home country, including in the United States. Where that happens for users in the UK or EEA, transfers are covered by the standard safeguards those providers offer, such as Standard Contractual Clauses.
6. How long we keep it
- While your account is open: your journal and community content stay until you delete them or close your account. That is the point of a journal: a trade you logged three years ago is only useful if it is still there.
- When you delete your account (Settings, Data & Privacy, or ask us): we close it at once. A free account is erased the same day. If you pay for a plan, we cancel the subscription and erase everything once it has ended. Either way your personal data is gone within 30 days, except where we must keep something longer.
- Payment and tax records are kept for as long as the law requires, typically six to seven years.
- Backups roll off on their own schedule, normally within 30 days.
7. Your rights
Depending on where you live you have some or all of the following rights. If you are in the UK or EEA you have all of them under GDPR; if you are in California you have comparable rights under the CCPA/CPRA.
- Access: get a copy of what we hold about you.
- Correction: fix anything inaccurate.
- Deletion: have your data erased. Delete your account yourself in Settings, Data & Privacy, or ask us.
- Portability: receive your data in a machine-readable format.
- Object or restrict: tell us to stop a particular use.
- Withdraw consent: for anything you opted into, such as leaderboards.
- No discrimination: exercising any of these will never get you a worse price or a degraded service.
Email liquidjournaling@gmail.com and we will respond within 30 days. We never sell personal information, so there is nothing to opt out of on that front.
If you are unhappy with how we handled a request you can complain to your local data protection authority (in the UK, the Information Commissioner's Office).
8. Cookies
We use cookies only to keep you signed in and to remember basic preferences such as your chosen theme. These are strictly necessary for the service to work, so they do not require a consent banner. We do not set advertising or tracking cookies. Blocking cookies will stop you being able to stay signed in.
Some of your settings, including drafts and preferences, are stored locally in your own browser rather than on our servers. Clearing your browser storage will clear them.
If you play a video in the Study Room, YouTube's privacy-enhanced player may store its own data in your browser from that moment. Nothing from YouTube loads before you press play.
If you open a Liquid affiliate's link, we ask whether to credit them. Only if you say yes do we set one cookie for 60 days holding that link's code and when you opened it, so the affiliate is credited if you sign up. It holds nothing about you, and saying no stores nothing. Opening the link is counted as a visit (the time only). An affiliate never learns who you are: they see only how many people visited, signed up and paid through their link, and what that earned them.
If you apply to be a Liquid affiliate, we keep what you send: your name, email, country if you give it, your social handles and follower counts, and what you post, so we can review the application and write back. Only the owner reads it. We email you twice at most: once to confirm we got it, once with the answer. Ask us and we delete it.
Liquid Points work the same way. If you open a member's invite link, we ask whether to credit them; only a yes sets one cookie for 60 days with that link's code. If you then join, pay and use the journal, the member earns points. To decide that, Liquid checks whether you have paid, been refunded, and on how many different days you logged trades or journal entries (the count only, never their content). The member sees your first name, or a shortened email if you have not set a name, and how far along you are. Nothing else about you.
If you open a gift link and choose to claim it, we set one cookie that holds the gift's code for up to 7 days, so the gift reaches your account when you sign up or sign in. When you buy a gift we keep a record of it so you can see whether it was claimed. The person who opens your gift sees your journal name, never your email.
9. Security
Data is encrypted in transit. Your LiquidJournal password is stored only as a one-way hash. A Rithmic password is the one exception: while Remember sign-in is ticked we keep it encrypted, because syncing needs it, and we delete it when you disconnect. Access to production data is restricted, and our database rejects direct client access outright: every read and write goes through our server, which checks who you are first. No system is perfectly secure, so please use a strong, unique password. If we ever discover a breach that puts you at risk, we will tell you and the relevant regulator without undue delay.
10. Children
LiquidJournal is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
11. Changes to this policy
If we change this policy we will update the date at the top. For anything significant (a new category of data, or a genuinely new purpose) we will tell you directly rather than quietly editing this page.
12. Contact
Privacy questions, data requests, or anything that looks wrong: liquidjournaling@gmail.com. See also our Terms of Service and Risk Disclaimer.