Security and data protection

We never ask for your broker username or password and we do not connect to your brokerage account. Trades reach the journal in two ways: you upload the execution export your broker gives you as a CSV file, or you enter trades by hand.

• CSV import is read-only. The file is parsed into journal entries and nothing is sent back to your broker.
• DayTradingSoftware cannot place, change or cancel orders. It has no trading permissions anywhere.
• Scans, alerts and watchlists use licensed real-time US market data, not your account.

All traffic between your browser and the service uses TLS. Data is stored encrypted at rest with our hosting provider in the EU or US. Passwords are stored only as salted hashes, and confirmation codes sent by email are stored as hashes and expire.

Starter and Pro accounts have a single user. Desk accounts add roles so a firm can decide who sees what.

• Owner manages billing, seats and roles.
• Risk manager sees the team view, daily loss limits per trader and exports for review.
• Trader sees and edits their own scans, alerts and journal.

Desk supports SSO so traders sign in with the firm's identity provider, and an audit log records sign-ins, role changes, seat changes and exports, so the owner can see who did what and when.

Payments are handled by our payment processor. Card numbers are entered on the processor's secure checkout and are not stored on our servers. We keep only the subscription status, plan and invoice records needed for billing.

You can export your journal from the dashboard at any time. To delete your account and your data, or to request a full export, write to [email protected] from the email address on your account. Details on what we keep and for how long are in the privacy policy.

If you believe you have found a vulnerability, email [email protected] with a description and steps to reproduce. Please do not access other users' data while testing.