Privacy Policy

1. Information we collect

• Account details — name, email, date of birth (for age eligibility), and a securely hashed password.
• Journal content — trades, notes, strategies, rules, tags, prop-firm or account labels (including practice / Backtest journals), day notebook / diary entries, screenshots you upload, CSV trade exports you paste for import, Games results where applicable, and related preferences you save to your account.
• Billing data — subscription status and Stripe customer/subscription identifiers. Card details are handled by Stripe; we do not store full card numbers.
• Usage and technical data — IP address, browser/device information, and log data used for security (including rate limiting), diagnostics, and to provide the Service. We use Vercel Analytics for aggregated product usage (for example page views); this is not used for advertising.
• Market data requests — when you use Backtesting (Beta), Games charts, trade replay, Nomad grades on ICT-based trades, or related chart features, our servers request historical price bars from market-data providers using symbols, dates, and intervals tied to your activity. Those requests are not used to build a personal advertising profile.
• Economic calendar requests — when you open Diary, tag news on a trade, use Backtesting session news, or load News Edge widgets, our servers may fetch economic-event calendars (Forex Factory and, for some history, Internet Archive). We may cache event metadata and store event IDs you tag, plus your news-filter preferences.
• Custom / quote enquiries — if you submit a quote or contact form, the fields you enter (and metadata such as time submitted).
• Device preferences — some settings and Backtest state (chart drawings, appearance, cookie-notice acknowledgement) may live only in your browser and are not sent to our servers unless a feature requires it.

2. How we use your information

To create and manage your account; provide journaling, diary, Games, analytics, reports, strategies and rules, CSV import, Nomad process grades (including ICT chart reads on eligible trades), AI features (including analytics chat), and Backtesting (Beta) according to your plan; process payments; authenticate you and keep the Service secure; understand product usage; provide support; and comply with legal obligations.

Free accounts include dashboard, manual trade entry, and CSV import (up to 20 trades per month), the daily diary, and economic news calendar features. Pro adds unlimited trades, analytics coach, Nomad grades, strategies and rules, AI features, Games, and Backtesting (Beta). We do not sell your personal information.

We collect only what we need to operate the Service you signed up for. We do not require government ID numbers, health records, or biometric templates to use Nomad Journal.

3. AI processing

If you use Pro AI features, relevant content is sent to our AI providers to generate analysis and return results to you. CSV text you paste for import is stored as journal trades on our servers; it is not sent to AI providers unless you later use an AI feature on those trades. We do not use your content to train Nomad’s own models. Providers process content under their own terms and privacy commitments.

Systems currently in use (summary — full detail on AI Disclosure):

• Claude (Anthropic) — Primary AI for screenshot / chart analysis, trade note helpers, analytics chat, and Nomad process grades (including ICT-style chart reads on eligible trades).
• OpenAI models (OpenAI) — Optional fallback vision / analysis path when configured by Nomad.
• Cursor / agentic coding tools (Cursor and related model providers) — Software development assistance used by Nomad to build and maintain products (“built with AI”). Not a runtime feature of your journal account.
• Web Speech API (Your browser / OS) — Optional voice-to-text for trade notes where the browser supports it.

Nomad products are also built with AI development tools (including Cursor). That engineering use is separate from runtime processing of your journal account.

4. Who we share it with

We share personal information only with service providers ("subprocessors") who help us run the Service, and only as needed to provide it:

• Vercel — Application hosting, delivery, and product analytics (Vercel Analytics) (United States / global edge).
• Neon — PostgreSQL database hosting (account, journal, and product data) (United States / EU).
• Stripe — Payment processing and subscription billing (card data handled by Stripe) (United States).
• Resend — Transactional email delivery (auth, billing, support-related mail) (United States).
• Anthropic (Claude) — AI analysis of screenshots, trade notes, analytics chat, and Nomad process grades including ICT chart reads from entry candles (Pro features) (United States).
• OpenAI — Optional fallback AI vision analysis when configured (United States).
• Polygon (Massive.com) — Historical market data for Backtesting (Beta), Games charts, and related chart features (United States).
• Forex Factory — Economic calendar events (titles, currencies, impact folders, scheduled times) shown in Diary, trade tagging, Backtesting session news, and dashboard News Edge widgets (United States).
• Internet Archive (Wayback Machine) — Historical Forex Factory calendar HTML when live pages are unavailable to our servers (United States).

We may also disclose information where required by law, to enforce our Terms, or to protect the rights, safety, and security of our users and the Service. We do not sell personal information and do not share it with advertisers for their marketing.

5. Overseas transfers

Some subprocessors are located outside Australia (primarily the United States). By using the Service, you acknowledge that your information may be stored and processed overseas. We take reasonable steps to ensure recipients handle your information appropriately (including contractual and organisational measures with providers).

6. Cookies and similar technologies

Categories (see the Cookie Policy for detail):

• Essential (required) — Auth session cookie so you stay signed in, CSRF/security protections where used, and load-balancing / hosting cookies required to deliver the site. Without these, login and core product features will not work.
• Preferences (local storage) — Theme, dashboard layout, Backtest chart drawings/appearance, cookie-notice acknowledgement, and similar preferences stored in your browser. These stay on your device unless a feature needs to sync them to your account.
• Product analytics — Vercel Analytics for aggregated page-view and product-usage measurement so we can improve reliability and UX. Not used for advertising or selling profiles to advertisers.

7. Security

We protect your information with measures including those listed on our Security Practices page. In summary:

• Transport encryption — HTTPS / TLS for traffic between your browser and our hosted application.
• Password hashing — Account passwords are stored hashed (not in plain text). We never email your password to you.
• Session controls — Signed session cookies; sessions are invalidated on password reset so a stolen cookie stops working after you change your password.
• Access control — API routes that touch your journal require an authenticated session. Accounts are isolated in the application data model.
• Rate limiting — Sensitive auth and high-cost endpoints are rate-limited to reduce brute-force and abuse.
• Payments via Stripe — Full card numbers are handled by Stripe, not stored in our database. We keep Stripe customer/subscription identifiers needed to run billing.

No method of transmission or storage is completely secure. We work continuously to improve safeguards and to contain impact if something goes wrong.

8. Data retention

We keep your information while your account is active and as needed to provide the Service. When you delete your account or request deletion, we delete or de-identify your personal information within a reasonable period, except where we must retain certain records (for example billing records) to meet legal or accounting obligations. We will not retain personal information we have committed to delete once deletion is completed, and we will not delete records we are legally required to keep. Device-only preferences remain on your device until you clear them.

9. Your rights (Australia and internationally)

You may request access to, correction of, deletion of, or a portable copy of personal information we hold about you, and you may raise a complaint. Practical steps are on Your Data Rights. Email privacy@nomadsys.tech. We aim to respond within 30 calendar days.

Australia: if you are not satisfied, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

EEA / UK (GDPR / UK GDPR): where those laws apply to you, you may also have rights to restrict or object to certain processing, and to lodge a complaint with your local supervisory authority. Our lawful bases typically include performing our contract with you (providing the Service), legitimate interests (security, product improvement that does not override your rights), and consent where required for optional features. Contact privacy@nomadsys.tech to exercise these rights.

10. Children

The Service is not intended for anyone under 13. We do not knowingly collect personal information from people under that age. Registration requires a date of birth so we can enforce this rule. If you believe a minor under 13 has provided us information, contact us and we will delete it.

11. Health data and HIPAA

Nomad Journal is a trading journal and related productivity software. We are not a healthcare provider, health plan, or HIPAA-covered entity, and the Service is not designed to store protected health information (PHI). Do not upload medical records or PHI. Claims about “HIPAA compliance” do not apply to this product. If you need a HIPAA-covered system, do not use Nomad for that purpose.

12. Payments and transaction data

Subscriptions and invoices are processed by Stripe. Card data is subject to Stripe’s security and compliance program. We store only the identifiers and subscription metadata needed to recognise your plan, open the customer portal, and handle support.

13. Data breaches

If a data breach is likely to result in serious harm, we will notify affected individuals and the OAIC as required by the Notifiable Data Breaches scheme, and take reasonable containment steps. See also Security Practices.

14. Marketing and honesty

We do not fabricate customer reviews or testimonials. If we publish feedback, it reflects real users. We do not send marketing spam; transactional email (auth, billing, security) is sent as needed to operate your account.

15. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with an updated date and, where appropriate, notified to you.

16. Contact

Privacy requests and questions: privacy@nomadsys.tech