Privacy Policy

Effective [DATE] · Last updated [DATE]

Note to operator: this is a first-pass template describing The Desk's actual data practices. Fill the [bracketed] fields and have it reviewed by qualified counsel before you rely on it. It is not legal advice.

Who we are

The Desk ("we", "us") is operated by [Company legal name], [address / jurisdiction]. Questions about this policy or your data: [privacy@thedesk.app].

What we collect

Account data — your email address and a securely hashed password (we never store your password in plain text). Optionally, the referring website that sent you to us.
Billing data — handled by our payment processor, Stripe. We store a Stripe customer/ subscription identifier and your plan status; we never see or store your card number.
Your trading inputs — the challenge attempts and trades you log or import into the journal (instrument, size, prices, times, P&L, notes). This is data you choose to enter.
Technical & usage data — product-analytics events (e.g. "ran a simulation"), a truncated/anonymised IP address, and your browser's user-agent string, used for security and to understand which features are used.

Cookies & local storage

We use a single essential session cookie to keep you logged in, and your browser's local storage to remember preferences (light/dark theme). We do not use third-party advertising or cross-site tracking cookies.

How we use your data

To provide and secure the service, process subscriptions, send transactional email (verification, password reset, receipts), run the analytics you request, and improve the product. We do not sell your personal data, and we do not use your logged trades for anything other than showing you your own analytics.

Third parties who process data for us

Stripe — payment processing (their privacy terms govern card data).
[Email provider — e.g. SendGrid] — transactional email delivery.
[Hosting provider — e.g. Render] — application + database hosting.
Google Fonts and a JavaScript CDN (unpkg / Cloudflare) — these serve fonts and libraries and therefore receive your IP address when a page loads. (If you prefer to avoid this, we can self-host these assets — see "Changes" below.)

Retention

We keep account and journal data for as long as your account is active, and for [period, e.g. 30 days] after you delete it, unless a longer period is required by law. Analytics event logs are retained for [period, e.g. 12 months] and then deleted or further anonymised.

Your rights

Depending on where you live (e.g. under GDPR or the CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. To exercise these — including deleting your account and its journal data — email [privacy@thedesk.app]. Subscription and payment details can be managed any time via the Billing portal (the "Billing" link in the top navigation once you're subscribed).

Security

Passwords are hashed with argon2, traffic is encrypted in transit (HTTPS), and access controls are enforced server-side. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

Children

The Desk is not directed to, and may not be used by, anyone under 18.

Changes

We may update this policy; material changes will be posted here with a new "last updated" date. Questions: [privacy@thedesk.app].