Privacy

This describes what TradeGen actually does with data. It is written to be checkable against the source rather than to be comprehensive, and where a thing does not happen it says so plainly instead of staying silent.

What is collected

If you sign in with Google, TradeGen receives and stores:

• Your email address, used as the identity of your account.
• Your name and profile picture, used to show who is signed in.
• A Google account identifier, so that the account still resolves if your email address changes.

That is the whole of it. TradeGen asks Google only for the openid, email and profile scopes. It cannot read your Gmail, Drive, contacts or calendar, and it never sees your Google password.

What you create

Anything you enter is stored against your account: trades, watchlist, alerts, saved theses, and the history of analyses you have run. Only you can see it. Other people signed into the same installation cannot read it, and that separation is enforced by the database query rather than by the interface hiding things.

One thing is deliberately shared: the measured strategy record, which says how a given strategy has behaved on a given instrument. It contains no personal information, describes markets rather than people, and is what makes the analysis better as more of it accumulates.

Where data goes

To produce an analysis, TradeGen sends the instrument you asked about to the sources it reads. It does not send your identity, your positions or your journal to any of them.

What does not happen

• No advertising, and no advertising identifiers.
• No analytics or tracking scripts. The pages load no third-party JavaScript at all.
• No selling, renting or sharing of personal data with anyone.
• No cookies except the one that keeps you signed in. It holds an opaque session token and nothing else.

Keeping and deleting

Your data stays until you remove it. Every dataset can be downloaded as CSV or JSON from the Account page at any time, without asking anyone. Deleting your account removes your trades, watchlist, alerts, theses and analysis history immediately and permanently; the shared strategy record stays, because it was never yours alone and contains nothing about you.

Sessions expire after 30 days. Signing out ends the session on the server rather than only in the browser.

Security

Sign-in uses Google's authorization code flow with PKCE, exchanged between servers. Session tokens are random, opaque and stored, so they can be revoked. Credentials are read from the environment and are never written to a configuration file.

Questions about this page: mousihleb@gmail.com