1. Information We Collect

We collect the following types of information:

Account data: email address, username, and any optional profile information you provide (name, company, position, phone number, bio, timezone, avatar image), plus your plan, notification and privacy preferences, and two-factor authentication secrets where you enable 2FA.
Content you create: community posts, comments, and direct messages; trade journal entries including free-text notes; watchlists; feedback you submit; and messages you type into the AI analysis chat.
Broker credentials: if you enable trade execution, the broker API credentials you provide. These are encrypted at rest (AES-256-GCM) and used solely to transmit orders you authorize.
Security telemetry: IP address, browser user agent, and login events, retained to detect unauthorized access to your account.
Technical data: device and push-notification tokens for devices you register, and cookies for session management. Optional analytics (page and feature usage) run only if you accept the cookie banner.
Billing data:your Stripe customer reference and payment event history (plan, amount, currency). Card details are entered on Stripe's hosted checkout and never touch PecuDesk systems.

2. How We Use Your Information

To provide and maintain the Platform
To authenticate your account and manage sessions
To send transactional emails (verification, password reset)
To improve our services through aggregated analytics
To comply with legal obligations

3. Data Storage & Security

Passwords are hashed with bcrypt and never stored in plain text. Broker API credentials are encrypted at rest with AES-256-GCM. All data is transmitted over HTTPS/TLS. Card details never touch PecuDesk systems: payment is completed on Stripe's hosted checkout. Access to production systems is restricted and authenticated.

4. Third-Party Services

We share data with the following categories of processors, only as needed to operate the Platform:

Payments: Stripe processes subscriptions and receives your email, name, and an internal user reference. Your card details are held by Stripe, not by PecuDesk.
Email: Resend delivers transactional and, where you opt in, newsletter email (email address, name, message content).
AI providers: messages you send to AI analysis features, and the market context needed to answer them, are processed by a third-party AI model provider. We do not send your account, billing, or broker data to AI providers.
Analytics: Google Analytics, only after you accept the cookie banner. Declining loads no analytics script and sets no analytics cookies.
Error monitoring: Sentry receives error reports, which can include IP address and request context.
Infrastructure: the Platform runs on Vercel (web), Hetzner (compute), Cloudflare (network, image and backup storage), Supabase and MongoDB Atlas (databases), and Tiger Cloud (market data warehouse). These providers host data on our behalf.
Push notifications:if you enable them, notification content is delivered through Expo and your browser or device vendor's push service (Google, Mozilla, or Apple).
Market data: OANDA, Alpaca, Polygon, and other market data providers supply prices and reference data. No personal data is shared with them, except broker credentials you explicitly connect for execution (sent to that broker only).

We do not sell your personal data to third parties.

5. Cookies

We use essential cookies for authentication and session management. Optional analytics cookies are only set with your consent. You can manage your cookie preferences at any time.

6. Your Rights (GDPR)

If you are in the European Economic Area, you have the right to:

Access your personal data
Rectify inaccurate data
Request deletion of your data
Object to processing of your data
Data portability
Withdraw consent at any time

You can delete your account directly in Settings. To exercise any other right, including access and data portability, contact us at privacy@pecudesk.com and we will fulfil the request manually.

7. Data Retention

We retain your account data for as long as your account is active. Deleting your account immediately and permanently removes your core account record, devices, watchlists, and login history. Community content, journal entries, and billing records may persist for up to 30 days before removal, and payment records are retained where required by law. To request expedited removal of specific content, contact privacy@pecudesk.com.

8. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or a prominent notice on the Platform.

9. Contact

For privacy inquiries, contact us at privacy@pecudesk.com.