Privacy Policy

1. What we collect

• Account. Your email address, your display name, and a hashed password (we cannot read it). Your email is verified with a code when you sign up.
• Profile. What you tell us in onboarding and Settings: years trading, the platform you use, your time zone, age range, an optional gender, your struggles, your strategy description, the instruments you trade, your interests, and your A+ setups (including any screenshots you attach). These exist to match you into a cohort and to run the ritual.
• Rules and accounts. The trading accounts you add (a label, the platform's account name, and the limits you set), your cooldown lengths, your Rule Lock commitments, and your blackout settings.
• Trading activity. The trades you log or that the platform connection reports: time, result, profit or loss, which setup you classified it as, whether it was on plan, and the running daily profit and loss per account. This drives your limits, your streak, and your journal.
• Platform connection. When you connect Tradovate, NinjaTrader or Interactive Brokers Trader Workstation, the app reads executions, open positions, and profit and loss for the accounts you map. Detailed platform messages are kept in a log file on your computer; what reaches our servers is the trade and account summaries above, plus the tail of that log inside the diagnostics file described under “How we use it” (sent automatically). Your platform password stays with your platform and is never seen by the app. With Tradovate, an access token is stored on your computer so the connection can resume.
• Community. Messages you post in cohort chat and global chat, direct messages, any images you attach, daily check-ins, and whether you are online.
• Billing. Stripe handles payment. We store your Stripe customer ID, what you bought, and its status and dates. When you buy the app we also keep the name and email on the purchase, the time of your onboarding call, and any note you add when booking it. If you pay on the website before creating an app account, we also keep the email you paid with so the app can recognise you when you sign up with it. We never receive or store your card number.
• Community membership. When you connect Discord after buying a Community membership, we store your Discord user ID and username, the Stripe customer ID it belongs to, and whether the member role is currently granted. We use these only to add and remove the member role in the Degen Rehab Discord server as your membership starts, lapses, or ends. We do not read your Discord messages through this connection. These records are deleted when your membership ends and the role has been removed, or sooner on request.
• Earlier free-trial sign-ups. Before 1 October 2026 the website had a free-trial form that collected a first name and email. That form is gone. Any remaining entries are kept only to answer the people who wrote to us and are deleted on request.
• Diagnostics. The app keeps a technical log on your computer. A copy of it (the app log, the platform connection log and the app's current state) is sent to us automatically shortly after you sign in, about once an hour while the app runs, and when something crashes, so we can fix problems without asking you for the file. Tokens and passwords are scrubbed from it before it is written. Exporting it from Settings or the tray menu shows you exactly what is in it.
• Website. If you enter a giveaway on the website we store the name, email, and answers you give on that form. The weekly-email sign-up on the website is handled by MailerLite under its own policy.

We do not collect your platform login, your bank details, your location beyond the time zone you choose, or any browsing history. There is no advertising tracking in the app.

2. Why we use it

• To run the Service: enforce your rules, count your trades, keep your journal, run the ritual, and show your Dashboard.
• To put you in a cohort and run the community features.
• To take payment, to know whether you have access, and to arrange your onboarding call.
• To support you when you write to us, and to fix problems using the app's diagnostics file. The desktop app sends that file to us automatically (shortly after sign-in, about once an hour while it runs, and when something in the app crashes). It contains the app's own log, the platform connection log, and the app's current settings and state. Passwords and access tokens are removed before it leaves your computer. Sending is automatic and cannot be turned off while you use the app; exporting the file from Settings or the tray menu shows you exactly what it contains.
• To send transactional email: the sign-up verification code, password-reset codes, and important notices about your membership or these policies. We do not send marketing email from the app.

We do not sell your information, and we do not use it to build advertising profiles.

3. What other members can see

Members in the app can see your display name, whether you are online, your discipline streak, your cohort, the platform you use, the instruments you trade, your non-dollar rules (for example "stops after 3 losses in a row"), your interests, and your Pong score. Members in your cohort also see your daily check-ins and whether you followed your plan. Nobody except you ever sees your profit and loss, your dollar limits, your account names, or your trades. Anything you write in chat is visible to that chat's members.

4. What the app does on your computer

To enforce rules you set, the app may close or block your trading platform, edit your computer's hosts file to block trading websites during a lock (through a small helper that runs with administrator rights), black out your screen during a trade, and start itself when you log in. These are local actions on your own machine; nothing about them is reported to us beyond whether a lock was bypassed, which affects your streak. Uninstalling the app removes all of them.

5. Who we share it with

Only the companies that run parts of the Service for us, and only what each one needs:

• Supabase hosts our database and sign-in system. Your data is stored on its servers in the United States (us-east-2).
• Stripe processes payments and holds your card details under its own privacy policy.
• Hostinger hosts the website and sends our transactional email (verification and reset codes).
• GitHub hosts the app downloads and updates. Checking for an update sends your app version and a standard web request; no account data.
• Tradovate / NinjaTrader / Interactive Brokers (Trader Workstation) when you choose to connect a platform. Data flows from the platform to your computer under your authorisation; we do not send your Degen Rehab data to them.
• MailerLite if you join the weekly email list on the website.
• Discord if you hold a Community membership. Our bot adds and removes the member role on your Discord account; Discord's own privacy policy covers everything you do inside Discord.

We will disclose information if the law requires it or to protect the rights or safety of members or the Service.

6. How long we keep it

While you have access we keep your data so the Service works. An app purchase does not expire, so your account and data are kept until you ask us to delete them. Where access does end, because an earlier monthly membership or free trial ended, an access code expired, or a purchase was refunded, we keep your account and data for 30 days so you can come back with everything intact. After 30 days the account and all of its data are deleted automatically by a scheduled job. An account that never activated a membership is deleted 30 days after it was created. Discord member records are deleted once your membership has ended and the member role has been removed. Billing records that the law requires us to keep (invoices) stay with Stripe for the required period. Giveaway entries are deleted after the giveaway.

7. Your choices and rights

• See or change your data. Most of it is editable in the app (Settings, Accounts, Strategies). For anything else, email us.
• Delete your account. Email support@degen-rehab.com from your account email and we will delete it.
• Diagnostics. Exporting the diagnostics file from Settings or the tray menu shows you exactly what the app sends us.

If you are in Canada, the European Economic Area, the United Kingdom, or another place with data-protection law, you may have additional rights to access, correct, port, restrict, or object to processing of your information, and to complain to your local authority. Email us and we will help.

8. Security

Data travels encrypted between the app and our servers. Each member's data is isolated in the database so one member can never read another's. Passwords are hashed, verified by email, and checked against known breach lists. Payment details never touch our systems. No system is perfectly secure; if we learn of a breach affecting your data we will tell you promptly.

9. Children

The Service is for adults. We do not knowingly collect information from anyone under 18. If you believe a minor has an account, email us and we will delete it.

10. Changes to this policy

If we change what we collect or how we use it, we will update this page and, for material changes, email you or show a notice in the app before the change applies.