Privacy Policy

• Your trading data — trades, fills, P&L, account balances, net liquidity — stays in a database on your own device. We never receive it.
• If you create an IAG Journal account for Leather Edition features, we store your email address, your subscription/entitlement status, and basic information about each device you sign in from.
• Payments are processed by Stripe on the website, or by Google Play / the App Store when you subscribe in the mobile app. We never see or store your full card number.
• We never sell your data to third parties, and we don't use third-party advertising or analytics trackers on the website or in the app.

The app keeps your imported trades and everything derived from them — positions, P&L, account balances, net liquidity, charts, journal notes — in a local database on your device. CSV files you import are processed locally. That local database is a standard, unencrypted SQLite file: anyone with access to your user account (or an unencrypted backup of it) can read it, so we recommend full-disk encryption (FileVault on macOS, BitLocker on Windows) and care with backups. A journal snapshot you share yourself — the .iagjournalfile the app can send to another of your devices, e.g. over AirDrop — is an unencrypted copy of that same database, so treat it like the journal itself and don't share it with anyone you wouldn't show your trading history.

Broker connections (AutoSync). Each broker connection runs from your device to the broker or its connection provider — brokerage data is never proxied through IAG servers, and IAG never receives your broker credentials or the data fetched with them:

• TastyTrade — direct from your device to TastyTrade, using a read-only OAuth grant you create in your own TastyTrade account.
• Charles Schwab (thinkorswim) — direct from your device to Schwab, using an app key and secret you create in your own Schwab developer account. One caveat we want to be explicit about: Schwab requires an https redirect URL, so during connection the one-time OAuth authorization code passes through a relay page on iagjournal.com before your device exchanges it. That code can appear in our hosting provider's standard request logs; it is short-lived, single-use, and useless without your app secret, which never leaves your device.
• Interactive Brokers — direct from your device to IBKR's Flex Web Service, using a Flex token and query you create in your own IBKR account.
• SnapTrade-connected brokers (e.g. Fidelity) — you sign in to SnapTrade and approve IAG Journal's registered OAuth app with read-only scope. SnapTrade holds the brokerage connection and returns your accounts (names and numbers, sometimes masked), balances, positions, orders and transactions to your device, where they are stored locally. The access token lives in your device's secure store and rotates automatically. Requests go from your device to SnapTrade and never through our servers; we receive nothing from SnapTrade. Note that “Disconnect” in the app deletes the local token but cannot revoke the grant itself — to fully revoke IAG Journal's access, remove it in your SnapTrade dashboard. SnapTrade's handling of your brokerage connection is described in SnapTrade's own privacy policy.

Credential storage.Broker credentials and sign-in tokens are stored in your operating system's secure store — Keychain on macOS/iOS, Credential Manager on Windows, Secret Service on Linux, encrypted preferences on Android. If the secure store refuses a write (some Linux setups have no keyring; rarely, a broken keychain), the app falls back to a JSON file in its data folder so you aren't locked out: that file is restricted to your OS user account (owner-only permissions), but it is not encrypted, and the app notes in its log when the fallback is in use. The app's QR key-transfer feature (moving TastyTrade/IBKR keys to your phone) is offline — nothing is uploaded — but the QR code itself carries the keys in plaintext, so do the transfer in private and don't photograph or share the code.

Besides your brokers, the app fetches market reference data from a few third parties. These requests go straight from your device, and they carry no account information — but a request itself reveals something to the service that receives it, so here is exactly what each one sees:

• Yahoo Finance — ticker symbols and date ranges, for underlying prices (daily closes and intraday history for charts, trade replay, and 0DTE tools). The tickers requested are the ones in your journal or on your watchlist, so Yahoo sees which symbols you follow — associated with your IP address, not your IAG account.
• Bank of Canada — a fixed request for the published USD/CAD exchange-rate series, used for currency conversion. No symbols, no personal data.
• GitHub — the app downloads installers and updates from our public GitHub releases. (GitHub also stores the bug reports you choose to send — see “Feedback and bug reports” below.)

If you create an IAG Journal account (required for Leather Edition features):

• Email address — for sign-in and account-related email. Desktop and mobile sign-in works by emailed login code; the code is stored on our servers only as a SHA-256 hash and expires quickly.
• Account & entitlement records — your subscription tier and status, period dates, and identifiers linking you to your Stripe customer and subscription.
• Device records — for each installation you sign in from we store a per-install random identifier (a UUID the app generates), your computer's hostname as the device label, the app version, the platform (macOS/Windows/Linux/iOS/Android), and a last-seen timestamp. We use these to enforce the per-account device limit, to let you (and support) see and sign out devices, and to know which app versions are in use. The install identifier also accompanies feedback you send from the app, which links that feedback to your account's device records.
• Authentication tokens — session and refresh tokens needed to keep you signed in. Refresh tokens are stored server-side only as hashes.

Payment information. When you start a subscription, Stripe collects and processes your payment details directly. We receive only limited information from Stripe (such as the last four digits of your card, billing country, and subscription state) — never the full card number. When you subscribe in the mobile app instead, Google Play or the App Store handles payment, and we receive the subscription's product, status, renewal dates and price through RevenueCat (see Service providers).

Server logs. Our hosting provider records standard request logs (IP address, timestamp, request path, user agent) for security and reliability. These are retained for a limited period.

Watchlist activity.The Smart Watchlist has one privacy switch: Settings → Watchlist → “Share watchlist activity with IAG”, on by default. While it is on, the app sends us the ticker symbols you add to, hide from, or unhide on your watchlist (as popularity signals for the shared list, recorded with a hashed, per-day identifier used only for de-duplication), and asks our servers to compute scores for the custom tickers you follow — which necessarily tells our servers those tickers. Turning the switch off stops all of that: no symbol lookups, no watchlist events, nothing about your watchlist leaves the device. The shared IAG list still downloads (that request carries no symbols), and your custom tickers fall back to price data fetched directly from Yahoo Finance. What you give up with the switch off: cloud-computed B-Xtrender scores for your custom symbols. Your watchlist itself — the lists, pins, and alerts — is stored only on your device either way; there is no cloud copy.

Feedback and bug reports.Reports are sent only when you press send, and the app shows you the exact text first — what you preview is what is transmitted. Depending on the report type, the diagnostics can include: your app version, platform and OS version; the path of the app's data folder (which contains your OS username); counts of accounts, transactions and trades in your journal; the tail of the app's own log file; a diagnostic row from a brokerage file that failed to import; or example broker records the app didn't recognize (which can contain a symbol, a quantity, a price and a date). Your brokerage account numbers are removed before the preview is built — even if you untick the additional masking — and the report carries your install identifier, plus your email address only if you type one in for a reply. Reports are stored as issues in a private GitHub repository that only we can read; GitHub processes them as our hosting provider.

We do not use cookies for advertising, and we do not embed third-party analytics, crash reporters, or ad trackers in the app or on the website. The website uses only the cookies necessary to keep you signed in.

• To authenticate you and keep you signed in.
• To provide and manage Leather Edition features, your subscription, and billing.
• To send transactional email — login codes, receipts, and important account or service notices.
• To operate, secure, and debug the service.
• To respond to your feedback or support requests.
• To decide which tickers join the shared watchlist (aggregate popularity, if you leave watchlist sharing on).
• To contact you for purposes related to IAG Journal and other IAG products or services — such as technical support outreach, service and product updates, and other communications related to your use of our products.

We use your contact information only for purposes related to IAG and its products and services. We will never sell your personal information to third parties, and we do not share it for cross-context behavioral advertising.

We rely on a small set of processors that handle data on our behalf:

• Supabase — authentication and the account/subscription database.
• Stripe — payment processing and subscription management.
• Google Play and the App Store — billing for subscriptions bought in the mobile app. They collect and process your payment details directly; we receive the subscription's product, status, renewal dates and price, never your payment details.
• RevenueCat — verifies Google Play / App Store subscription purchases and tells us their status. It receives your IAG Journal account identifier (a random ID, not your email) and the store's purchase records.
• Vercel — website and API hosting.
• Resend — delivery of transactional email.
• GitHub — hosting the app installers you download, and the private issue tracker that stores feedback and bug reports you send.
• xAI (Grok) — generates the shared market commentary and watchlist research that every subscriber sees. These are single shared generations about market conditions and the curated symbol list; no personal data, none of your custom tickers, and nothing from your journal is ever sent to xAI.

Each processes data only as needed to provide its service to us. Some may process data outside your country; where required, appropriate safeguards apply.

We keep your account data for as long as your account exists. When you delete your account (from the account page on this site or from inside the app), we cancel any active Stripe subscription and delete your sign-in identity together with your profile, entitlement, device, and session records. A subscription bought through Google Play or the App Store can only be cancelled by you, in the store, so cancel it there as well. Step-by-step instructions are on our account deletion page.

Some records are kept after deletion, with the link to your account identity removed where the record allows it: our internal payment records and our sign-up log (which holds a normalized email address, an IP address, and a device hostname captured at sign-up) are retained with the account identifier cleared, and Stripe retains its own customer, invoice, and payment records. We keep these because billing, tax, and fraud-prevention records have to survive the account they describe — refunds, chargebacks, and tax filings can arrive long after an account is gone. Server logs are kept only for a limited period.

You can request access to, correction of, or deletion of the personal data we hold about you by emailing support@iagjournal.com. Depending on where you live, you may have additional rights under laws such as the GDPR or the CCPA/CPRA; we honor those requests. You can stop watchlist sharing at any time with the switch described above, and you can stop all account-related processing by deleting your IAG Journal account. Because the app requires an active subscription, deleting your account ends your access to the app, but your trading data remains in the app's local files on your device, under your control.

IAG Journal is not directed to anyone under 18, and we do not knowingly collect personal information from children.

We may update this policy from time to time. When we do, we'll revise the “Last updated” date above, and for material changes we'll provide additional notice where appropriate.

Questions about this policy or your data? Email support@iagjournal.com.