Privacy Policy

Last updated: 30 September 2026

1. Controller and principle

The controller is PhinLabs (Markus Egolf), a sole proprietorship based in Stäfa, Switzerland, contact: markus@tradephin.com. We collect only the data needed to operate TradePhin. We do not sell any data. Data is passed only to the service providers listed below and only as far as needed to operate the service. This page summarises everything; the detailed version is at app.tradephin.com/privacy. Both describe the same processing.

2. This website (tradephin.com)

The website is delivered via Vercel Inc. (USA); processing may take place in Europe and in the USA. Vercel temporarily stores technical access data (IP address, time) for security and operation. The domain and the routing of requests run through Cloudflare Inc. (USA).

3. Cookies and analytics (only with consent)

Always active and technically necessary: your cookie choice (browser entry 'tradephin-cookie-consent', 1 year) and, after login in the app, the session cookie 'tradephin.sid' (httpOnly, secure, valid until 30 days after the last activity). Only with your consent via the cookie banner do we load Google Analytics 4 (Google Ireland Ltd. / Google LLC, USA). Without consent, Google Analytics is not loaded. According to Google, Google Analytics 4 does not store IP addresses; the data is pseudonymous, not anonymous. The «Marketing» option is prepared, but no advertising service is currently integrated; your choice is only stored. The app (app.tradephin.com) does not use Google Analytics. You can change your choice at any time via «Cookie settings» in the footer.

4. App hosting and security

The app (app.tradephin.com) and the API (api.tradephin.com) run on a server of Hetzner Online GmbH in Nuremberg (Germany). Your account and trading data, screenshots and backups are stored there. Cloudflare forwards requests to this server. Transmission is encrypted via HTTPS. Passwords are stored only as hashes (bcrypt); credentials and tokens of broker connections are additionally encrypted (AES-256-GCM).

5. Phin AI (AI processing)

For Phin AI we send the trading data and notes needed for the respective feature to one of two AI providers — without your email address, password or broker credentials. Information about emotions and mindset is only included if you have given your explicit consent (Art. 9 GDPR). (a) Google Gemini API (Google, USA; paid access): for the regular chat, the pre-market briefing, automatic trade tags and the import assistant. Processing may take place in the USA and other countries. Under Google's terms, inputs and outputs are not used to improve Google's products or for training; Google retains them for a limited period to detect abuse and meet legal obligations. (b) Amazon Bedrock (Amazon Web Services, based in the USA) with language models from Anthropic: for in-depth analyses, post-trade reflection, the weekly review and Trader DNA, as a fallback when Google is unavailable, and for searching our knowledge base. Requests go to the AWS Frankfurt region and are processed in AWS data centres within the EU. According to AWS, inputs and outputs are by default neither stored nor used for training, and Anthropic has no access to them. The automatic analyses (post-trade reflection, weekly review, pre-market briefing) are switched on by default and can be switched off in the settings at any time. Transfers to the USA are based on the EU-US Data Privacy Framework (or Swiss-US Data Privacy Framework) or on EU Standard Contractual Clauses.

6. Paddle (payment processing as Merchant of Record)

We use Paddle.com Market Ltd as Merchant of Record for all payments. Paddle is the legal seller and contractual partner for the payment transaction. Data processed: name, email, billing address, country, payment method, transaction history, IP address. Purpose: subscription billing, invoicing, VAT handling, fraud prevention. Legal basis: Art. 6(1)(b) GDPR (contract performance), Art. 31 DPA (Switzerland). Registered office: Paddle.com Market Ltd, Judd House, 18-29 Mora Street, London EC1V 8BT, UK. Data transfer: UK adequacy decision (EU Commission, 28 June 2021) + Standard Contractual Clauses. Retention: as required by law (max. 10 years for tax records). Data Processing Agreement signed and available upon request. Privacy policy: paddle.com/legal/privacy

7. Email

For sending emails (e.g. confirmations, password reset, notices about your subscription, weekly review) and for our correspondence we use Zoho Mail (data centres in the EU and in India). Your email address and the content of the email are transmitted to Zoho. If you write to us, we store your message in order to answer it.

8. NinjaTrader & Tradovate integration (optional)

When the NinjaTrader® / Tradovate® integration is enabled, TradePhin retrieves historical trade fills (order executions) from your account via the official API. Data processed: symbol, quantity, price, timestamps, long/short, account ID, encrypted OAuth access and refresh tokens (AES-256-GCM). NO order placement, NO position modification, NO redistribution of market data. OAuth tokens are stored encrypted on our server in Germany (Hetzner, Nuremberg) and are neither visible to TradePhin staff nor in the user interface after being stored. You can revoke the integration at any time. Legal basis: Art. 6(1)(a) GDPR (consent). Mandatory attribution: NinjaTrader® is a registered trademark of NinjaTrader Group, LLC. Tradovate® is a registered trademark of Tradovate Holdings, LLC. Kinetick® is a registered trademark of Kinetick, Inc. No NinjaTrader company is affiliated with or endorses TradePhin.

9. Other connections (optional)

Rithmic (USA): if you connect a Rithmic account, TradePhin retrieves your trade fills; your credentials are stored encrypted (AES-256-GCM). Telegram: if you connect Telegram, we send you notices about economic events; your chat ID and the content of the message are transmitted to Telegram. The transfer is necessary for the feature you requested (Art. 49(1)(b) GDPR). You can disconnect both at any time.

10. Retention

We keep account and trading data until you delete your account. Deleted trades remain in the trash for 30 days and are then permanently deleted. Daily backups are kept for 14 days, then one weekly backup for up to 60 days; until then, deleted data may still be contained in backups. Further retention periods are listed in the detailed version.

11. Your rights (GDPR Art. 15-22 & nDSG Art. 25)

You have the right at any time to access, rectification, erasure, restriction of processing, data portability and objection, and to withdraw any consent you have given. You can export your data as a file in the app and delete your account yourself. You may also lodge a complaint with the competent supervisory authority (Switzerland: FDPIC, EU: your member state's data protection authority). Contact us at markus@tradephin.com.

12. Changes

We update this privacy policy when our services or service providers change. The current version is always available on this page.

Privacy inquiries: markus@phin-labs.com