1. Who we are
PlotMyTrade is a trading journal, analytics and execution service. This policy explains what we collect when you use our website and app, why we collect it, and the choices you have. When we say “we”, we mean PlotMyTrade. When we say “you”, we mean the person using the service.
2. What we collect
- Account details: your email address, password (stored only as a secure hash), time zone, currency and trading preferences.
- Trading records: trades, orders, deals, positions and account details imported from MetaTrader 5 or cTrader, and trades you add by hand.
- TradingView alerts: the time, symbol, timeframe, strategy and payload of alerts you send to your webhook.
- Journal content: notes, checklists, emotions, ratings and screenshots you add.
- Billing details: your plan, payment status and receipts. Card and mobile money details are handled by Paystack; we do not store full card numbers.
- Security and usage records: sign-in events, security notifications, connector health and error logs.
3. What we never collect
We never ask for, or receive, your broker password. The MetaTrader 5 connector runs on your own computer or VPS, with your terminal already signed in, and authenticates to us with a scoped key that you can revoke. cTrader access uses cTrader’s own authorisation, limited to the permissions the import needs.
Deposits and withdrawals are not imported.
4. How we use your information
- To import, store and show your trades, journal, analytics and reports.
- To pass orders you confirm to your own MetaTrader 5 terminal, through the PlotMyTrade executor EA, if you use the execution bridge.
- To send the emails you ask for, such as reports, confirmations and security notices.
- To manage your plan and payments.
- To keep the service secure, detect abuse and fix problems.
We do not use your trading records or journal for advertising, and we do not sell your data.
5. AI features and your key
AI features are optional. If you use them, you choose a provider and add your own API key. Your key is encrypted with authenticated encryption, and the encryption keys are kept outside our application database.
Before anything is sent, we show which provider will receive the data needed for the analysis. We send only what that analysis requires, and you choose whether journal notes and other personal content are included.
The provider you choose processes that data under its own terms and privacy policy, and bills you directly.
7. What our team can see
Our administrators manage accounts, plans and the health of the service. They do not have access to your API keys, your private journal entries or your trading account credentials. Sensitive administrative actions are recorded in an audit log.
8. How we protect it
- All traffic is encrypted in transit.
- Sensitive credentials are encrypted at rest, and access follows least privilege.
- Connector keys are scoped and revocable, and your terminal is never exposed to the internet.
- Sign-in, webhooks, AI requests and execution are rate limited, and webhook requests are validated.
- API keys, tokens and unnecessary personal details are kept out of our logs.
9. How long we keep it
We keep your account data for as long as your account is open. Logs and cached data are removed under fixed retention periods. When you delete your account, your trades, journal, screenshots and keys are deleted, except for billing records we must keep by law.
10. Your choices and rights
- Export: download your trade history and journal as CSV from Settings.
- Correct: update your profile and preferences at any time.
- Delete: delete your account and its data from Settings.
- Disconnect: revoke a connector or cTrader access, and remove an AI key, whenever you like.
12. Changes and contact
If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect.
Questions about your data? Contact us, or read our Terms of service.