Privacy policy

Controller under the GDPR: Mindexa. Postal address: see the legal notice (Impressum).

Email: hello@mindexa.space

We do not appoint a data protection officer. For privacy requests, write to the email above.

This policy applies to the website, the signed-in app, onboarding, demo mode, support tickets, and emails we send about the service. Payment at checkout is handled by Lemon Squeezy as merchant of record — their privacy policy also applies to card and invoice data.

You are not required to create an account to read the public site. An account is required to keep a live journal.

Account: email address, optional name, timezone, display currency, language, theme and number-display preferences, plan and trial status, onboarding answers.

Login and security: sign-in with email and password (including password-reset links), or Google / Discord OAuth, optional authenticator-app 2FA, trusted-device flags, IP address and similar technical data for rate limits and abuse prevention, Cloudflare Turnstile bot-check tokens at sign-in and on public forms.

Journal: trades (symbol, side, prices, size, times, P&L, fees), tags, notes, emotions, screenshots, calendar/day stats, recaps, Guardian rules and check-ins, session-gate history, dashboard layout, progress checklists.

Broker (optional, from Pro / trial): encrypted broker login details you submit, MetaAPI account identifiers, synced closed trades and open positions, last-sync timestamps.

AI: prompts and the snippets of journal context sent to generate coach replies, recap insights, or short answers — plus usage counts (tokens/requests) for plan limits.

Support: ticket text, email, and attachments you send.

Billing (on our side): Lemon Squeezy customer/subscription identifiers, plan, renewal dates, and webhook status. We do not store full card numbers.

Device/local: theme, language, cookie choice, and some layout/workspace data in the browser (cookies or localStorage).

Contract (GDPR Art. 6(1)(b)): creating and running your account, journal, imports, broker sync you request, AI features included in your plan, exports, support, and billing status so the product works.

Legitimate interests (Art. 6(1)(f)): keeping the service secure (rate limits, bot checks, logs), preventing abuse, debugging outages, and understanding whether the product is reliable. You may object to processing based on legitimate interests; we will stop unless we have compelling grounds.

Consent (Art. 6(1)(a)): optional analytics (e.g. Sentry with consent), reserved marketing cookies (not used for ads today), and any optional emails that are not needed to run the account. You can withdraw consent at any time via Cookie settings or by writing to us — withdrawal does not affect processing already done.

Legal obligation (Art. 6(1)(c)): invoices, tax, and bookkeeping where we or Lemon Squeezy must keep records.

You can sign in with email and password. If you forget it, we send a password-reset link to your email. Google or Discord sign-in uses their OAuth screens; we receive an identifier and email (and name if the provider shares it). Those providers process data under their own policies.

If you turn on an authenticator app, we store the secret needed to verify codes and optional “remember this device” flags. We do not receive the live codes from your phone except when you type them in.

Cloudflare Turnstile may run on login and public forms to block bots. Cloudflare then processes a short technical token.

Journal content is your data. We store it so you can see it across devices, run analytics, and use AI features you switch on.

You can export JSON/CSV where your plan allows it, reset selected categories in Settings, or delete the whole account. Demo mode uses sample data and is not a live account export/delete path.

Broker connection is optional and plan-gated (MetaTrader 4/5 auto-sync from Pro / Pro trial). If you connect, encrypted credentials are stored so we can deploy a MetaAPI terminal, pull trades, and then undeploy the terminal to limit provider cost. MetaAPI acts as a processor for that sync.

Open-position P&L between syncs may use market quotes (e.g. Finnhub) and FX rates. The economic calendar may use Forex Factory and, if configured, Finnhub. Those providers receive only what is needed for the request (typically instrument/event queries, not your full journal).

We are not your broker. Connecting a live account is at your risk; keep read-only or investor passwords if your broker offers them.

Paid plans and card-on-file trials are charged by Lemon Squeezy, Inc. as merchant of record. Lemon processes payment data as an independent controller (or as described in their terms). We receive subscription status, plan, and identifiers via webhook so we can unlock features.

The 7-day Pro trial goes through Lemon checkout with a card on file. Lemon’s checkout, refund, and privacy terms apply to that payment. Lite stays free and does not collect a card.

Coach, recap insights, and similar features send prompts plus limited journal context to our configured inference provider (NVIDIA / the model we have configured). We do not sell your journal to train public foundation models.

AI output can be wrong. It is not investment advice. Token and request limits follow your plan; unused allowance does not always roll over.

Necessary: session/login, CSRF-style protections, theme, language, display mode, cookie-choice record, and similar items without which the app would not work. These do not require consent under typical EU cookie rules.

Analytics (optional): error/reliability telemetry such as Sentry, only after you accept analytics in the cookie banner.

Marketing (optional): reserved for future campaigns; not used for advertising pixels today. Only after you accept marketing cookies.

You can change or withdraw optional cookies anytime via “Cookie settings” in the footer. Blocking necessary cookies may break login.

We send service email needed for the account (sign-in codes, security, billing-related notices we generate). Recap or digest emails depend on your notification settings. Transactional mail uses Resend as processor.

Typical processors: Vercel (hosting), Supabase (database and auth), Resend (email), Sentry (errors, if consented or strictly needed for security), Cloudflare (Turnstile / CDN as used), NVIDIA or the configured LLM host (AI inference), MetaAPI (optional broker terminal), Forex Factory and Finnhub (calendar/quotes as configured).

Lemon Squeezy handles checkout and subscriptions. Google or Discord handle OAuth if you choose those buttons.

We do not sell your personal data.

Some providers are in the United States or other countries outside the EEA (for example Vercel, Lemon Squeezy, Google, Discord, NVIDIA, Sentry, Cloudflare, Finnhub). Where required, we rely on an adequacy decision, the EU-US Data Privacy Framework if the provider is certified, and/or Standard Contractual Clauses plus supplementary measures from the provider.

A transfer still means authorities in that country might access data under local law. You can ask us which safeguards apply to a named provider.

Account and journal: while the account is open. After you delete the account, we remove or anonymize app data unless a short residual copy is needed for backups, security logs, or law (typically up to 90 days for backups, longer only where tax/bookkeeping requires it).

Security logs (IP, rate-limit, failed login): kept only as long as needed to run limits and investigate abuse, then deleted or aggregated.

Support tickets: until the request is closed plus a reasonable archive period.

Lemon invoices and tax records: retained for the statutory period (often 10 years in Germany for accounting documents held by the merchant of record).

If you downgrade, storage above the new plan may be deleted after the grace period shown in the app (currently 30 days after period end for screenshot overhang).

You may request access, rectification, erasure, restriction, portability, and — where processing is based on legitimate interests or consent — objection or withdrawal of consent.

Use Settings (export, data reset, delete account) or email us. We may need to verify it is you. We will answer within the GDPR time limits (usually one month).

You can lodge a complaint with a supervisory authority, in particular in your EU member state of residence or work, or where the alleged infringement occurred. In Germany this is the data protection authority of the Land where the controller is established, or the Federal Commissioner (BfDI) for guidance.

We do not make legally binding decisions about you solely by automated means (GDPR Art. 22). Plan limits, rate limits, and bot checks are technical enforcement, not credit scoring or similar.

Mindexa is aimed at adults. The service is not intended for anyone under 18.

If we change this policy in a material way, we will update the date above and, where required, notify you in the app or by email.