Privacy Policy

The honest version, in five lines:

• We collect what we need to run PropMind: your email, your trading data through APIs you authorise, the rules and journal entries you create, and basic device info.
• We don't sell your data. We don't share it with advertisers. We don't use it to train AI models that other customers can query.
• We use a small set of named subprocessors — Stripe, MetaApi, Resend, Cloudflare, Anthropic, Sentry — to deliver specific parts of the service. Each one is listed below with what they see.
• You can export everything, delete your account, withdraw consent for the AI coach, and ask us what we hold on you. We answer within 30 days.
• We hold your data on servers in the European Union and the United States, and we encrypt sensitive fields (broker credentials, journal screenshots) at rest.

The sections below are the precise version of the same thing.

PropMind Technologies (Addis Ababa, Ethiopia) is the controller of personal data processed through the PropMind service. For users in the European Economic Area and the United Kingdom, PropMind acts as a controller in the meaning of the GDPR and the UK GDPR.

You can reach our privacy team at privacy@propmind.app, and our data protection officer at dpo@propmind.app.

Account data

Email, password (stored as an argon2 hash — we never see your clear-text password), display name if you set one, two-factor authentication secret (encrypted), preferred timezone, and the email-verification + login timestamps we need for account security. Legal basis: performance of the contract.

Trading account data

When you connect a broker, we receive — through MetaApi or the broker's API — your account number, account balance, open positions, trade history, and live equity. We do not see your broker password; you enter it directly on the integration provider's page. We store the encrypted integration token, not the password. Legal basis: performance of the contract.

Rules, journal, and content you create

Every rule you configure, every journal entry you write, every screenshot you upload, every conversation with the AI coach. Screenshots are encrypted at rest on Cloudflare R2. Journal text is stored in our primary PostgreSQL database alongside your trades. Legal basis: performance of the contract.

Billing data

The fact that you have a subscription, the tier, the billing interval, the renewal date. We do not store card numbers. Card data is collected and held by Stripe under their PCI-compliant infrastructure. For crypto, we store the transaction hash and the pay-from currency, never the private key. Legal basis: performance of the contract and legitimate interest in operating a paid service.

Usage and device data

IP address, browser user-agent, the pages you visit inside PropMind, the timestamps of your sessions, and any errors your browser hits while using the app. We keep this for 90 days for operational debugging and security, then it ages out of our logs automatically. Legal basis: legitimate interest in keeping the service available, secure, and improving.

Communications

If you email us at hello@propmind.app or any of our other addresses, we keep the message and our reply for as long as we need to resolve your case and for two years after, for audit and tax purposes. Legal basis: legitimate interest in operating support.

We use the data above to do the following — and nothing else unless we ask you first or are required to by law:

• Run the rule engine on your live trades and decide whether to send a warning, render a lockout, or instruct your broker.
• Render your dashboard, your journal, your analytics, your morning briefing.
• Generate AI coach responses by sending the relevant portion of your trading history and journal context to our AI inference provider (see Section 07).
• Send you transactional emails — verification, trial reminders, billing receipts, security alerts. You cannot opt out of transactional email while you have an active account; you can cancel the account to stop them.
• Charge you for paid subscriptions and run refunds when requested.
• Detect abuse, fraud, and security incidents, and respond to them.
• Comply with legal obligations, including tax and accounting recordkeeping, and lawful requests from competent authorities.
• Analyse your own trading history for behavioural patterns (for example, losing more often after a run of consecutive losses) in order to suggest guardrail rules tailored to you. These are suggestions only — a rule is never created or enforced unless you accept it. See Section 05.
• Improve the service in aggregate — for example, looking at which rules fire most often across the user base to refine defaults. This kind of analysis is always on de-identified, aggregated data.

When you use the AI coach, the following gets sent to our AI inference provider (currently Anthropic, model family Claude 4):

• The text of your message.
• A summarised window of your recent trading activity — the specific trades the message references, your current rule configuration, your tilt score, and your last few journal entries.
• The prior turns of the same conversation.

The provider responds, we display the answer in the app, and we store both the prompt and the answer in your account so your next session has context.

We have contractually disabled prompt and response logging for model-training on our inference provider account. Your AI coach conversations are not used to train Anthropic's or anyone else's models. You can delete a conversation at any point and it is removed from our database within 30 days.

You can permanently disable the AI coach for your account from Settings → Privacy. Once disabled, we delete all stored AI coach conversations within 30 days and stop sending anything to the inference provider.

Automated behavioural analysis for rule suggestions

Separately from the chat coach, PropMind runs a periodic analysis of your own trading history to spot risk patterns — for instance, that you lose disproportionately often on trades taken right after a string of losses, or that a small number of days account for an outsized share of your losses. Where a pattern is clear, we use it to propose a tailored guardrail rule (such as a pause after a number of consecutive losses, or a daily-loss alert), with the reasoning and the supporting numbers shown to you. This analysis uses your trades and our AI inference provider; the same contractual no-training protection above applies.

These are recommendations, not automated decisions. PropMind never creates, changes, or enforces a rule from this analysis on its own — a proposed rule does nothing until you choose to accept it, and you can adjust or decline it. Accepted rules start in alert-only (“soft”) mode. We keep an internal record of what was proposed and whether you accepted it so we can review and improve the suggestions. If you no longer want PropMind analysing your trading to suggest rules, email privacy@propmind.app and we will switch the suggestions off for your account.

We share personal data only in the following scenarios:

• With subprocessors we have contracted to deliver part of the service, listed in Section 07. Each one is bound by a Data Processing Agreement and is allowed to use your data only for the narrow purpose we specify.
• With your broker, when our rule engine sends a close-position or cancel-order instruction. The instruction includes only the data necessary to act on it.
• With law enforcement or a competent regulator, when we receive a valid, lawful, written request, and only the data the request specifically covers. We push back on overbroad requests.
• With a successor in the event PropMind is acquired or merges with another company. Personal data transferred in that scenario remains protected by this policy or one materially equivalent, and you will be notified before the transfer.

We do not sell personal data. We do not share personal data for cross-context behavioural advertising. We do not have third-party advertising trackers on propmind.app.

These are the third parties who process personal data on our behalf. Each one is named, scoped, and located, so you can audit our supply chain.

We update this list when we add or remove a subprocessor. Active subscribers can subscribe to the change feed by emailing privacy@propmind.app with the subject line subprocessor-changes.

Several subprocessors are located in the United States. When personal data leaves the European Economic Area we rely on the European Commission's Standard Contractual Clauses, plus supplementary technical measures (encryption in transit, encryption at rest, minimum-necessary scoping) to give that data a level of protection equivalent to what it would receive inside the EEA.

You can request a copy of the SCCs we have in place by emailing dpo@propmind.app.

We take the security of the data you trust us with seriously. Concrete controls:

• All traffic to and from propmind.app and api.propmind.app is TLS-encrypted. Certificates are managed by Cloudflare and renewed automatically.
• Passwords are stored as argon2id hashes. We never log or transmit plaintext passwords.
• Broker credentials and 2FA secrets are encrypted at rest using AES-256-GCM with keys held in a managed secrets store. They are decrypted in memory only at the moment of use.
• Admin access to the production database requires hardware two-factor authentication and is logged to an append-only audit table enforced at the database level — even an administrator cannot rewrite that log.
• Backups run daily and are retained for 30 days. Backups are encrypted with a separate key and stored in a different geographical region.
• We monitor for unauthorised access via Sentry, structured logs, and an internal anomaly alert. In the event of a breach affecting personal data, we will notify affected users within 72 hours of becoming aware of it, per GDPR Article 33.

We use a small number of strictly-necessary cookies and one analytics cookie. We do not use advertising cookies.

You have the following rights over the personal data we hold about you, regardless of where you live. Some are stronger in some jurisdictions; we extend them to everyone:

• Access — ask us for a copy of everything we hold on you. We return a machine-readable export within 30 days.
• Correction — fix anything inaccurate. Most fields you can edit yourself from Settings; for the rest, email us.
• Deletion — delete your account and the data it contains. Some billing records are retained for tax law, as noted in Section 09.
• Portability — get your data in a structured, common, machine-readable format (we export JSON + CSV).
• Restriction — ask us to stop processing your data temporarily while a complaint or correction is being handled.
• Objection — object to processing we do under a legitimate-interest basis. We respect this unless we have an overriding lawful reason not to (e.g. fraud investigation).
• Withdraw consent — for anything you have opted into separately (the AI coach, optional analytics), pull that consent back from Settings → Privacy at any time.
• Complain to a supervisory authority — EEA / UK users may complain to their national data protection authority. We'd appreciate it if you tell us first so we can fix the issue, but you don't have to.

To exercise any of these rights, email privacy@propmind.app from the email address on your account. We may ask one follow-up question to verify it's really you.

PropMind is for adults trading their own or a prop firm's capital. The service is not directed at, and we do not knowingly collect personal data from, anyone under 18 years old. If you believe a minor has created an account, email us at privacy@propmind.app and we will delete it.

We may update this policy. The date at the top always reflects the most recent change. For substantive changes that expand the scope of data we collect, the purposes we use it for, or the subprocessors we share it with, we will notify you by email and inside the app at least 14 days before the change takes effect.

General privacy questions: privacy@propmind.app
Data Protection Officer: dpo@propmind.app
Postal address available on request — we are a remote-first team and don't publish a permanent street address for safety reasons.

See also our Terms of Service for the contractual side of the relationship.