Security and your data

Your journal is private by default. Each account can read only its own rows in the database, every request to our API is checked against your signed-in session, broker access is read-only, and images you attach stay in your own Google Drive.

Who can see your journal

• Only you. The database enforces row-level security: every table holding your data is limited to your account.
• Verified sign-in. Each API request carries your sign-in token, which is verified before any data is read or written.
• Sharing is off by default. Anonymous aggregate statistics and leaderboards use your data only if you switch them on, and you can switch them off at any time.

Broker access

Broker connections use read-only data such as your tradebook. The app has no code that places, changes or cancels orders.

Images and screenshots

Charts are redrawn from stored market levels instead of being saved as images. Screenshots you attach are uploaded from your browser to a “DisciplineTrade Journal” folder in your own Google Drive, using a permission that lets the app see only the files it created. We keep the file ID and a small preview.

Locked records

Closed days, plans and reviews are locked by the database. New thoughts are added as dated notes, so your record stays honest.

Reporting a problem

A contact address for reporting security issues will be listed here before public launch. Please do not test against other users' data.