Privacy policy

1. Data we collect

• Account data. Your email, username, first and last name, and a salted hash of your password (never the password itself). If you sign in with Google, we receive your name, email and Google account ID from Google.
• Email verification and password reset codes. Six-digit codes we email you; we keep only a hash of each code, and it expires after 15 minutes.
• Market-data and broker connection. If you connect a ProjectX (e.g. TopstepX) account, we store its username and API key. The API key is encrypted at rest. We use it read-only: to stream CME market data to your account and, if you turn on journal sync, to read your trading accounts, fills and open positions into your journal. Sentio never places, changes or cancels orders.
• Journal and trade data. Trades you log, mark as taken or rejected, import from a CSV file (from Tradovate, TopstepX, NinjaTrader, Quantower, Rithmic or another platform) or sync from your broker, with the notes, levels and outcomes attached to them.
• Product configuration. Your models (built-in settings and custom models), discipline rules, alert and voice preferences, chart and time-zone settings, and the disclaimers you have ticked, stored per account so Sentio behaves the same on every device.
• Content you give the AI features. Questions you ask Sentio AI, descriptions you give the model builder, chart images and files you attach, and YouTube links you import (we fetch the video's transcript).
• Activity and service records. A log of changes you make in your account (models, rules, connections, imports) that you can see and clear under Activity; AI credit usage; and, if you send them, your feedback and the reason you give when cancelling a plan. These are tied to your account; they are not anonymised.
• Billing data. Handled by Stripe. We store your Stripe customer and subscription IDs and your plan status; we never see or store card numbers.
• Technical data. A session cookie that keeps you signed in, and settings your browser keeps locally (for example the last screen you had open). Our hosting providers keep standard server logs (IP address, time, request) for security and troubleshooting.
• Website visits. Our website uses Cloudflare Web Analytics, which counts page views, the referring site, country and device type in aggregate, without cookies and without identifying you. If you arrive through a tagged link (for example one we posted on Reddit or X) or from another site, your browser remembers that source and, if you sign up, we store it with your account so we know which channels bring people in.

2. What we do not collect

• Card numbers or bank details: payments are handled entirely by Stripe.
• The ability to trade: Sentio has no order-placement access to any broker.
• Your screen, browser tabs or anything outside Sentio: only what you type, upload or connect in the product.
• Advertising or cross-site tracking: we run no ad trackers and no cross-site tracking, and we do not sell your data. Website analytics are cookie-free and aggregate (see above).

3. How we use it, and why

• To provide the service you signed up for (performance of our contract with you): your account and sign-in, market data, the scanner and alerts, discipline rules, the journal and its broker sync, the AI features, and billing.
• To keep it secure and working (our legitimate interests): verifying your email, preventing abuse and fraud, fixing errors, and understanding which features are used so we know what to improve.
• To email you: verification and reset codes, receipts and account notices; product news only if you have opted in, and you can switch that off in Settings.
• To meet legal obligations: for example keeping billing records for tax purposes.

4. Who we share it with

We use these service providers (subprocessors) to run Sentio. Each receives only what it needs for its job:

• Railway: application servers and database hosting (United States).
• Cloudflare: website hosting, security and routing of requests to our servers.
• Stripe: payments and subscriptions.
• Google: "Sign in with Google", only if you use it.
• Anthropic and OpenAI: the AI features (Sentio AI, the model builder, reading chart images). What you send the AI features is processed to produce the answer; under our agreements with these providers it is not used to train their models. Sentio AI may run web searches through Anthropic to answer questions about recent market events.
• ElevenLabs: turns alert text into the spoken voice alert. It receives the alert wording only.
• Resend: sends our emails (codes, receipts, notices).
• TranscriptAPI: fetches the transcript of a YouTube video you import into the model builder.
• ProjectX / TopstepX: when you connect your account, we exchange data with it on your behalf (market data, and your accounts and fills if journal sync is on).

Some of these providers process data outside the EU/UK, mainly in the United States. Where they do, the transfer is covered by the provider's standard contractual clauses or an equivalent safeguard.

5. How long we keep it

We keep your data for as long as your account is open. When you delete your account in Settings → Data & privacy, your profile, journal, models, settings, connections and activity are deleted straight away. Stripe keeps the billing records it is required to keep for tax purposes, and our providers' backups and server logs are overwritten on their normal schedules. An account that signs up but never verifies its email is removed automatically after about a day.

6. Your rights

Depending on where you live (for example under the GDPR in the EU/UK, or the CCPA in California), you have the right to:

• Access the personal data we hold about you, and get a copy: Settings → Data & privacy exports your data as CSV and PDF.
• Correct it: most of it you can edit in the product.
• Delete it: Settings → Data & privacy → Delete account removes it immediately.
• Object to or restrict some uses, and withdraw consent (for example to marketing email) at any time.
• Complain to your data-protection authority (in Ireland, the Data Protection Commission).

For anything you cannot do in the product, email support@sentiotrader.com. We answer within 30 days.

7. Security

Passwords are stored as salted hashes, broker API keys are encrypted, sign-in uses a signed, HTTP-only cookie, and all traffic is encrypted in transit (HTTPS). No system is perfectly secure; if we learn of a breach that affects your data, we will tell you and the relevant authority as the law requires.

8. Children

Sentio is for adults. You must be 18 or older to use it, and we do not knowingly collect data from anyone younger.

9. Contact and changes

Privacy questions: support@sentiotrader.com. If we change this policy in a way that matters, we will tell you by email or in the product before it takes effect; the date at the top always shows the latest version.