Privacy Policy
Last updated 20 September 2026
This Privacy Policy explains what information PipFlo (“PipFlo”, “we”, “us”) collects when you use pipflo.com and the PipFlo application (the “Service”), how we use it, and the choices you have. By using the Service you agree to this Policy.
1. Information we collect
Account information
When you create an account we collect your email address and, optionally, a display name and a profile photo you choose to upload.
Payment information
If you subscribe to Pro, our payment provider (Paddle) collects and processes your payment details to take the payment. We never see or store your full card number — from Paddle we receive only your subscription status, plan, renewal dates, and a customer/subscription reference, so we can keep your account on the right plan.
Content you put into the Service
PipFlo is a trading journal, so most of what it stores is content you create or import: trade records (pair, direction, entry and exit, size, profit or loss, dates, tags, and any notes you add), data from broker statement or CSV files you upload (PipFlo does not connect to your broker), trade screenshots you attach, your trade plans, notebook entries, and your settings and preferences. You decide what goes in.
Technical information
As with any website, our hosting and infrastructure providers automatically record technical data when you use the Service — your IP address, browser type and version, device and operating system, referring pages, and timestamps — in server logs used for security, debugging, and abuse prevention.
Usage analytics
We use Vercel Web Analytics to understand which pages are visited and where visitors come from. It is privacy-friendly by design: it sets no cookies, does not store your IP address, uses no cross-site or persistent identifiers, and cannot single you out or follow you to other websites. The data we see is aggregate — page views, referrers, and coarse device and country information.
Measurement and advertising
We load Google Tag Manager, which is a container for the two measurement tools below. It sets no cookies of its own, though loading it means your browser contacts Google.
Google Analytics 4 tells us how the site is used — pages visited, where visitors arrive from, and which steps people complete. It sets cookies (_ga and similar) that recognise your browser on return visits.
Meta Pixel measures how well our advertising works. It sets an advertising cookie (_fbp), reports your visit to Meta, and can be used to show you PipFlo ads on Meta’s services. It runs on the marketing site and the sign-in pages only — never on the pages inside your account, so what you log in your journal is never reported to Meta.
Conversions sent from our servers. When a trial starts or a payment succeeds, we report that to Google Analytics and Meta from our own servers rather than your browser, because the amount charged is only known there. That report includes the amount, a one-way cryptographic hash of your email address, your IP address, and the identifiers the tools above already set in your browser. Meta uses the hashed email to match the sale to an advertising profile; it cannot be reversed back into your address by us or by them.
None of this runs until you accept it. See Cookies and local storage.
What we do not collect
We do not run behavioural profiling of what you do inside your account, we do not sell personal data, and we do not share your trades, notes or performance with anyone. We never ask for or store your broker login, API keys, or banking details.
2. Cookies and local storage
Essential cookie. We set one cookie to keep you signed in (your authentication session). The Service does not work without it, and it is the only cookie we set ourselves — our usage analytics is cookieless.
Analytics and advertising cookies. Google Analytics and the Meta Pixel set cookies, described in section 1.
If you are in the EEA, the UK or Switzerland, they are switched off until you accept them: a banner asks on your first visit, and nothing is loaded, set or sent until you choose. Ignore it and nothing runs. Elsewhere, where consent of that kind is not required, they run from the start — and you can switch them off at any time with Cookie settings below.
Declining means no analytics or advertising cookie is written, no conversion is reported to either company, and the Service works exactly as before — the only difference is that we cannot see how you found us.
Changing your mind. Use Cookie settings in the site footer, from anywhere and in any country, to make or change this choice. It is remembered in a cookie of its own (pipflo_consent), alongside one recording whether your location requires us to ask (pipflo_consent_required); clearing your cookies resets both.
Local storage. Your browser stores small preferences locally — your light/dark theme choice, sidebar state, saved filters, and a flag noting you have seen the loading screen. This stays in your browser and is not transmitted to us.
Third party. The price chart on the Trading page is an embedded TradingView widget. When it loads, TradingView receives the symbol you are viewing and may set its own cookies, governed by TradingView’s privacy policy. It loads only on that page. Apart from that widget and the measurement tools described above, the Service embeds no third-party content.
3. How we use your information
We use the information above to:
- provide and operate the Service — store your journal, calculate your statistics, and render your dashboard;
- authenticate you and keep your account secure;
- send you service email — sign-up confirmation, password reset, and important notices about your account or the Service. These are not marketing; we currently send no marketing email;
- respond to your support requests;
- understand, in aggregate, how the Service is used so we can improve it;
- monitor for, prevent, and investigate abuse, fraud, and security incidents;
- comply with legal obligations.
We do not use your trade data to train models, and we do not share it with anyone except the providers listed below who process it on our behalf to run the Service.
4. Legal bases (EEA / UK users)
Where the GDPR or UK GDPR applies, we process your data to perform our contract with you (providing the Service you signed up for); on our legitimate interests (securing the Service, preventing abuse, and keeping it reliable), balanced against your rights; and to comply with law. Analytics and advertising measurement — including the conversions we send to Google and Meta from our servers — run on your consent alone, asked for before anything loads and withdrawable at any time from Cookie settings in the footer. You can object to processing based on legitimate interests — see Your rights.
5. Service providers
We use a small number of processors to run the Service. They act on our instructions and are bound to protect your data.
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, authentication, and file storage (your account, journal, and screenshots) | India (Mumbai region) |
| Vercel | Application hosting, content delivery, server logs, and cookieless usage analytics (Vercel Web Analytics) | Global edge network |
| Resend | Delivers transactional email — sign-up confirmation and password reset | EU (Ireland) |
| Paddle | Processes Pro-plan payments and billing as merchant of record; handles your card details (we never receive them) | — |
| Tag Manager, Google Analytics 4 and Google Ads — site analytics and advertising measurement, with your consent | Global | |
| Meta | Meta Pixel and Conversions API — advertising measurement, with your consent. Receives a hashed email address and IP address with a completed purchase | Global |
| TradingView | Renders the embedded price chart on the Trading page (loads in your browser only) | — |
We will update this list if it changes.
6. Data retention
We keep your account and its content for as long as your account is open. If you close your account (email support@pipflo.com from your account address), we delete your account and its content within 7 days, except for a minimal amount of information we must keep to meet legal, accounting, or dispute-resolution obligations, or that remains briefly in encrypted backups before those backups rotate out. Server logs are retained for a short period by our infrastructure providers for security and then discarded.
7. Security
Data is transmitted over HTTPS and stored with our infrastructure providers, who maintain access controls, encryption at rest, and network isolation. Access to production data is limited to what is needed to operate and support the Service. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you and any regulator as required by law.
8. Your rights
At any time you can:
- view and correct most of your information in Settings;
- export your entire trade log to CSV from Settings, on every plan;
- delete your account and all its data by emailing support@pipflo.com from your account address.
If you are in the EEA, the UK, or another region with similar laws, you also have the right to access, correct, delete, restrict, or object to our processing, to data portability, and to withdraw consent where processing relies on it. You may lodge a complaint with your local data protection authority. To exercise any right, email support@pipflo.com. We will not discriminate against you for doing so.
9. International transfers
Your data is stored with providers whose infrastructure is in India and the EU, and on globally distributed networks. If you use the Service from another country, your information will be transferred to and processed in these locations, which may have different data-protection laws than your own. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for those transfers.
10. Children
The Service is intended for adults. It is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact support@pipflo.com and we will delete it.
11. Changes to this Policy
We may update this Policy as the Service changes or the law requires. We will post the new version here and update the “Last updated” date. If a change is significant, we will make reasonable efforts to notify you, for example by email or an in-app notice. Continuing to use the Service after a change means you accept the updated Policy.
12. Contact
Questions about this Policy or your data: support@pipflo.com.