Privacy Policy

Last updated September 26, 2026

TradeHarbor (the "Service") is operated by Constellation Strategic Capital LLC ("we," "us," or "our"), which is responsible for the personal information described here. This policy explains what information we collect, how we use it, and the choices you have. We collect only what we need to run the Service.

Information we collect

• Account information: your email address and a securely hashed version of your password (we never store your password itself).
• Your Data: trades, accounts, journal entries (including check-in ratings, plans, mistake and emotion tags), screenshots you upload, and settings you enter or import. Screenshots are stored privately and shown only to you.
• Broker connections: if you connect a broker (ProjectX, Tradovate, Interactive Brokers or Alpaca), the sign-in details that broker needs, such as a username, API key, API secret, password or Flex token. They are encrypted before they're stored, are never shown back to you or anyone else, and are used only to read your accounts, fills, and (for ProjectX) price history, to import your trades and run your backtests. They can't place, change, or cancel orders. Removing the connection deletes them.
• Billing information: if you subscribe, payment is handled by Stripe. We receive your subscription status and a Stripe customer ID, not your full card number.
• Waitlist details: if you join the waitlist, your email address and any optional answers (what you trade and which platform you use), used only to send you a beta invite.
• Feedback and support: messages you send with the in-app feedback button, the support chat, or by email to support@tradeharbor.co, along with the page you were on and your browser type, so we can answer and fix what you report.
• Alert destinations: if you turn them on, the push subscription for your browser or phone, the Discord webhook address you enter, or your Telegram chat ID, used only to deliver the alerts you choose.
• Plan details: your plan, trial dates, and which account is your Free account.
• Technical information: IP address, browser type, and request logs, used to secure the Service (for example, to limit repeated sign-in attempts) and to diagnose errors.

How we use it

• To provide the Service: store your data and calculate your statistics.
• To secure your account: authentication, rate limiting, and abuse prevention.
• To send service emails: your beta invite, email verification, password resets, security notices, billing receipts, rule alerts and daily summaries you turn on in Settings, and notice of material changes to the Service or your plan. We don't keep marketing lists or send newsletters.
• To process payments for paid plans.

We never sell, rent, or share your personal information or Your Data with prop firms, brokers, advertisers, data brokers, or anyone else, and we don't use it for advertising. The only exceptions are the service providers below, which process it on our behalf, and disclosures required by law.

Cookies and local storage

We use a single, strictly necessary cookie to keep you signed in. We store your light/dark display preference in your browser's local storage. We use Cloudflare Web Analytics to count page visits; it doesn't use cookies or track you across sites. We don't use advertising trackers.

Who we share it with

We share information only with service providers that help us run the Service, under agreements that restrict their use of it:

• Cloudflare — hosting, database, file storage, security, and transactional email. Support messages are answered first by an AI assistant running on Cloudflare Workers AI. If you choose a language other than English, text shown on the page is translated by Workers AI too; numbers are removed first, text you're typing is never sent, and a translated phrase is only reused for other people once at least three different users have needed it. We don't use your messages or Your Data to train AI models.
• Stripe — payment processing for paid plans.

If you connect a broker, we send your own sign-in details to that broker (ProjectX or your firm's ProjectX gateway, Tradovate, Interactive Brokers, or Alpaca) to read your data on your behalf. We don't send them your TradeHarbor data.

If you turn on push, Discord or Telegram alerts, the alert text is sent to your browser's push service (for example Apple, Google or Mozilla), to Discord, or to Telegram so it can reach you.

We may also disclose information if required by law, or to protect the rights and safety of our users or the Service.

Retention and deletion

Waitlist entries are kept until the beta ends or you ask us to remove them. We keep your account information for as long as your account is open. You can export your data at any time from Settings → Data, and permanently delete your account from Settings → Delete account. Deleted data is removed from our live systems immediately and from backups within 30 days.

Security

Data is encrypted in transit (HTTPS) and at rest. Passwords are hashed with a slow, salted algorithm. Sign-in sessions are stored only as one-way hashes. No system is perfectly secure; if you believe your account has been compromised, contact us right away.

Your rights

You can access, correct, export, and delete your information from within the app. Depending on where you live, you may have additional rights — for example to object to certain processing or to lodge a complaint with a regulator. To make a request, email support@tradeharbor.co.

Children

The Service is not intended for anyone under 18, and we don't knowingly collect information from minors.

Changes

If we make material changes to this policy, we'll notify you by email or in the app before they take effect.

Contact

Privacy questions or requests: Constellation Strategic Capital LLC, support@tradeharbor.co.