Privacy Policy
Last updated · · v2.2
01 What this covers
TradeAon ("we", "our", or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share information when you use the Service. It applies to all users of the TradeAon platform, including the dashboard, webhook endpoints, and trade journal.
The one exception worth naming. If you connect a cTrader account, that connection is made through cTrader's OAuth flow, which means we do hold an access token and a refresh token for that account so our servers can place the trades you send. Those tokens are encrypted at rest, they are not a password, and revoking access in your cTrader account (or disconnecting the account in your dashboard) invalidates them immediately. See §02 and §05.
02 What we collect
Information you provide:
- Account information: Name and email address provided via Google OAuth at sign-up.
- Trading account data: MT4/MT5 account numbers, broker names and account nicknames — never passwords.
- cTrader authorisation (only if you connect a cTrader account): the cTrader account id you select, plus an OAuth access token and refresh token issued by Spotware. These are stored encrypted at rest and are used solely to place, modify and close the orders you send. They are deleted when you disconnect the account, and revoking TradeAon in your cTrader account invalidates them immediately.
- Webhook configuration: Signal settings, symbol mappings, and alert payload structure you define.
- Journal content: Trade annotations, custom tags, and screenshots you upload voluntarily.
Information collected automatically:
- Usage data: Features used, signals processed, trades logged, and plan usage metrics.
- Session records: For each signed-in session we store the IP address and browser user-agent that created it, so you and we can spot unauthorised access.
- Ad-view records (Free plan only): when you watch an ad to activate an account we record the time, the account, the ad unit and the IP address. This exists to detect automated/fake ad views, which our Terms prohibit.
- Server logs: IP address, browser type, operating system, access times and error logs. These are written to a rotating log file capped at roughly 40 MB in total, so how far back they reach depends on traffic volume rather than on a fixed number of days — in practice weeks, not months. We do not archive them elsewhere.
- Cookies: Session cookies required for authentication. On the ad-supported Free plan only, Google AdSense also sets third-party advertising cookies (see §05 and §06). Paid plans are ad-free and set no advertising cookies.
03 How we use it
We use your data only to:
- Provide and maintain the Service (process webhook signals, execute copy trades, store journal records).
- Manage your subscription and process payments through Stripe.
- Send service-related notifications — billing confirmations, plan limit warnings, and critical outage notices.
- Respond to support requests.
- Detect and prevent abuse, fraud, or violations of our Terms of Service.
- Improve the Service and develop new features based on aggregate, anonymized usage patterns.
- Comply with legal obligations.
We do not use your trading data to train machine-learning models or for any purpose beyond operating the Service for you.
04 Where we store it
Your data is stored on a server operated by us in Thailand. Trade records and account configuration are kept in a database on that server, and a copy of trade records and copy-pair configuration is synchronised to Supabase (PostgreSQL), the managed database provider listed in §05, so the dashboard keeps working if one side is unavailable. Journal images are stored on the same server and count toward your plan's storage limit. If we move the service to a different hosting provider or country, we will update this section before the move takes effect.
Stripe stores payment method and billing details on their PCI-compliant infrastructure — we never see or store card numbers.
You can export your trade history at any time from the Trading Records page as a CSV file. The export is generated server-side so it covers your whole history rather than only the page currently loaded in your browser.
05 Who we share it with
We share your data only with the following sub-processors, each of which has access only to what they need for their specific function:
- Stripe — payment processing. Stripe Privacy Policy
- Google — OAuth authentication. Google Privacy Policy
- Supabase — secondary trade records storage. Supabase Privacy Policy
- Spotware (cTrader Open API) — only if you connect a cTrader account. Order instructions and the OAuth tokens described in §02 are exchanged with Spotware's servers so your trades can be placed. Spotware Privacy Policy
- Cloudflare — DNS, CDN and bot protection in front of the site. Every request, including your IP address, passes through Cloudflare's network before it reaches us. Cloudflare Privacy Policy
- Google AdSense — advertising on the Free plan only. Google may use cookies and device identifiers to serve and measure ads. How Google uses advertising data
Our public pages also load two open-source assets from third-party CDNs (icon and font libraries from unpkg.com, cdnjs.cloudflare.com and Google Fonts). Requesting a file from a CDN exposes your IP address to that CDN; we do not use these requests for tracking.
We do not share your data with any other third party, and we do not sell your data.
We may disclose data if required by law, court order, or government authority, or if necessary to protect the rights and safety of TradeAon or its users.
06 Cookies, advertising & tracking
On paid plans we use only essential cookies:
- Session cookie: Required for authentication. Expires when you sign out or after a period of inactivity.
- Preference cookie: Stores lightweight UI preferences (e.g., table sort order). No personal data.
On the ad-supported Free plan, Google AdSense additionally sets advertising cookies and may use device identifiers and web beacons to serve and measure ads, including personalised ads where permitted. We ourselves do not operate our own analytics pixels or cross-site trackers.
Third-party advertising disclosure.
- Third party vendors, including Google, use cookies to serve ads based on a user's prior visits to your website or other websites.
- Google's use of advertising cookies enables it and its partners to serve ads to your users based on their visit to your sites and/or other sites on the Internet.
- Users may opt out of personalised advertising by visiting Google Ads Settings. Alternatively, users can opt out of a third-party vendor's use of cookies for personalised advertising by visiting www.aboutads.info.
Google AdSense is currently the only third-party ad vendor used on this site. If we add another, it will be named here.
Upgrading to a paid plan removes all advertising and advertising cookies. Disabling cookies in your browser will prevent you from signing in.
07 Your rights (incl. GDPR & CCPA)
Depending on your location, you may have the right to:
- Access: Request a copy of the personal data we hold about you.
- Correction: Ask us to correct inaccurate data.
- Deletion: Request deletion of your account and associated personal data. TradeAon will remove or anonymize your data within 30 days, except where retention is required by law (e.g., payment records).
- Portability: Export your trade data via Settings → Export at any time.
- Objection: Object to processing based on legitimate interest.
To exercise any of these rights, email [email protected] with "Privacy Request" in the subject line. We aim to respond within 14 days.
If you are in the EEA or the UK (GDPR). TradeAon is the data controller for the data described in this policy. We rely on the following legal bases: performance of a contract for everything needed to run your account and execute the signals you send; legitimate interests for security, abuse prevention and service improvement; consent for advertising cookies on the Free plan; and legal obligation for records we must keep, such as payment records. You may withdraw consent at any time, and you have the right to lodge a complaint with your local supervisory authority. Because our server is in Thailand and our sub-processors operate internationally, your data is transferred outside the EEA/UK; those transfers rely on the transfer mechanisms operated by the sub-processors listed in §05.
If you are a California resident (CCPA/CPRA). You have the right to know what personal information we collect and why (set out in §02 and §03), to request deletion, to request correction, and not to be discriminated against for exercising those rights. We do not sell your personal information, and we do not share it for cross-context behavioural advertising in exchange for anything of value. Advertising on the Free plan is served by Google as described in §05 and §06; you can limit personalised advertising through the opt-out links there. To make a request, use the same email address and subject line above.
08 Children
The Service is not directed at individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a minor, contact us immediately and we will delete it.
09 Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-dashboard notice at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects when the most recent version was published. Continued use of the Service after changes constitutes acceptance of the revised policy.
10 Contact
For privacy questions, data requests, or concerns:
- Email: [email protected]
- Subject line for privacy requests: "Privacy Request"
- Response SLA: 14 business days