PRIVACY POLICY

Account data: your email address and password, handled by our authentication provider (Supabase Auth) — we never see or store your raw password.

Trading data you enter: your account balance, risk-per-trade setting, daily loss limit, and every XRILL session (daily check-in answers, trade plan, risk math, execution check, journal outcome/P&L/lesson) you run through the site. This is the core of the product — it's how the journal, analytics, and Star Unlocks work — and it's visible only to you (and to admins, for support purposes) via row-level security on our database.

Payment data: if you upgrade to Pro or Elite, checkout is handled entirely by Stripe. We never see or store your card number — we only receive your subscription status and tier from Stripe's webhook.

Discord data: if you connect Discord (Elite tier), we request the identify and guilds.join OAuth scopes — just enough to confirm who you are on Discord and add you to our server with the correct role. We don't request access to your messages, other servers, or friends list.

Technical data: standard things any web host collects — IP address, browser type, and request logs — via our hosting provider (Vercel) and database provider (Supabase), for security and abuse prevention.

We don't sell your data. It's shared only with the service providers that make the Service work, each only for the purpose described:

• Supabase — database and authentication.
• Vercel — hosting.
• Stripe — payment processing for Pro/Elite subscriptions.
• Resend — transactional email (welcome emails, receipts).
• Discord — server membership and role sync for Elite members who opt in.

Each of those providers has its own privacy policy governing how they handle data on our behalf.

We use Supabase's authentication cookies to keep you signed in — that's it. We don't run third-party advertising or tracking pixels.

We keep your account and session data for as long as your account is active. If you want your account and associated data deleted, email us at [privacy@yourdomain.com] and we'll process the request within [X] days, subject to what we're legally required to retain (e.g. Stripe transaction records).

The Service is not directed to anyone under 18, and we don't knowingly collect data from minors.

If this policy changes in a material way, we'll update the date at the top of this page and, for significant changes, notify active users by email.

Questions about this policy or your data — email [privacy@yourdomain.com].