Privacy policy

Who is responsible

The controller of your personal data is individual entrepreneur Bohdan Kirov (Kirov Bohdan Serhiiovych), Kyiv, Ukraine, Unified State Register of Ukraine record No. 2010350000000982306 of 3 March 2026 (“we”). Contact for any privacy question or request: support@statwidget.com.

What we collect

• Account data: your email address, an encrypted (hashed) password or your Google account identifier if you sign in with Google, the language you chose.
• Content you enter: checklists and strategies, day readiness answers, trades, prices, notes, tags, ratings, emotions you describe and screenshots you upload.
• Settings: units, deposit and risk values, limits and other dashboard preferences.
• Technical data: IP address, browser and device information, timestamps and error logs created when you use the Service.
• Feedback: messages you send from the dashboard or the widget, together with the section you were in, the app version and your system.
• Requests from the website: your name, email, phone (if you give it) and comment from the request form for mentors and schools, and the IP address the request was sent from.
• Partner program: if you came through a partner’s (a mentor’s or school’s) link or code, which partner it was, whether it was the link or the code, and the IP address at that moment. If you are a partner: your payout wallet address and the history of your commissions and payouts.
• Visit statistics, only if you allow analytics in the cookie banner: the pages you open on the website and on the sign-in and payment pages, where you came from, approximate location (country and city), device and browser, under a random identifier set by Google Analytics.

We do not connect to your broker or trading accounts and we do not collect payment card numbers.

Why we use it

• To provide the Service: create your account, sync the widget with the dashboard, show your statistics (performance of a contract, GDPR Art. 6(1)(b)).
• To keep the Service secure and working: prevent abuse, investigate errors, keep backups (legitimate interests, Art. 6(1)(f)).
• To send service emails: confirming your email, resetting your password, important changes to the Service (performance of a contract).
• To meet legal obligations, for example accounting once paid plans start (Art. 6(1)(c)).
• To answer feedback and requests from the website and discuss working together (steps before entering into a contract and legitimate interests, Art. 6(1)(b) and (f)). The IP address of a request is used only to protect the form from spam.
• To run the partner program: credit the partner who brought you and give you the student discount (performance of a contract and legitimate interests, Art. 6(1)(b) and (f)). The partner sees your name, a masked email (like i•••@gmail.com), your subscription status and the commissions your payments brought — never your journal, trades or checklists. The IP address is used only to detect partners signing up themselves.
• To understand how the website is used and what to improve, with Google Analytics — only with your consent (Art. 6(1)(a)). You can withdraw it at any time with “Cookie settings” at the bottom of the site.

We do not sell your data, do not use it for advertising and do not share your journal with anyone unless you invite them (for example, a mentor you connect in Settings → Mentors, who sees only what you allow).

Where your data is stored

• Supabase (database, sign-in, file storage) — servers in Frankfurt, Germany (EU).
• Vercel (website and application hosting) — global edge network.
• Resend (delivery of service emails).
• Paddle (payments and invoices, once paid plans start) — the seller of record for your purchase; it receives your payment details directly, we never see your card number.
• Google — only if you choose “Continue with Google”.
• Google Analytics (Google Ireland Limited) — visit statistics for the website and the sign-in and payment pages, only with your consent; it does not run in the dashboard.
• Cloudflare Turnstile — checks that the sign-up form is filled in by a person, not a bot; it sees the visitor’s browser and IP address at that moment.

These providers process data on our instructions under data processing agreements. Where data leaves the EU/EEA, transfers rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep it

We keep your data while your account is active. When you delete your account, your data is deleted from the live database immediately and from backups within 30 days; your feedback messages are deleted with the account. The account activity log (sign-up, sign-ins, IP address, browser and device, subscription events, the number of records per day — never their contents) is kept for 18 months, the error log for 90 days after an error last occurred. Requests from the website are kept for up to 24 months, the IP address of a request for 90 days. Partner attribution is kept while the account exists, its IP address for 90 days. A partner’s commission records are kept while the partner account exists; payout records (amount, wallet address, transaction and the partner’s email) are kept for as long as accounting rules require, also after the account is deleted; link visit counts (without any personal data) for 18 months. An account whose email address was never confirmed is deleted after 7 days. Google Analytics keeps visit statistics for 14 months.

Your rights

You can access, correct, export (CSV or Excel from the dashboard) or delete your data at any time, and object to or restrict processing. You can also complain to your local data protection authority. To use any right, write to support@statwidget.com; we answer within 30 days.

Security

Data is encrypted in transit (HTTPS) and at rest. Every record is tied to its owner and the database refuses access to anyone else’s rows. Passwords are stored only as hashes. No system is perfectly secure; if a breach affects you, we will tell you without undue delay.

Cookies

We use cookies that are needed for the Service to work (sign-in session, chosen language, your cookie choice); if you follow a partner’s link, a cookie with that partner’s code for 60 days, so that the discount reaches you; and Google Analytics cookies only if you allow them. Details are in the Cookie policy.

Age

The Service is intended for people aged 18 and over. We do not knowingly collect data from minors.

Changes

If we change this policy in a meaningful way, we will notify you by email or in the dashboard before the change takes effect.