Profit Pal ("Profit Pal," "we," "us") is a read-only application that aggregates and displays your trading and
brokerage profit & loss (P&L) across the accounts you choose to connect. This policy explains what we collect,
why, how we protect it, and the choices you have. By creating an account or using the app, you agree to this policy.
The short version: We collect only what we need to show you your own P&L. We never place trades.
We do not sell your data or share it with advertisers. Credentials and access tokens you provide are encrypted.
You can delete your account and all associated data at any time from within the app.
Information we collect
Account details. Your email address and a password. Passwords are never stored in plain text —
only a one-way cryptographic hash (scrypt). If you use Sign in with Apple, we receive the identifier Apple
provides and, if you allow it, a relay email address; we do not receive your Apple password.
Connection credentials you provide. To display your P&L, you may give the app the API keys,
tokens, or platform login details for the trading platforms and prop firms you connect (for example TradeLocker,
DXtrade, Match-Trader, cTrader, or TopstepX/ProjectX). These are encrypted at rest using
AES-256-GCM and are used only to read your account data.
Brokerage connections via SnapTrade. For supported brokerages (for example Questrade, Qtrade,
Wealthsimple, and others), we use SnapTrade, a third-party
aggregation service, to establish a secure, read-only connection. When you connect a brokerage, you authenticate
directly with SnapTrade and your brokerage — Profit Pal never sees your brokerage username or password.
We store only the access handles SnapTrade returns, encrypted at rest.
Financial data we read on your behalf. Account balances, equity, open and realized P&L,
positions, currency, and the labels you give your accounts. This is read-only market/position data — we cannot and
do not execute trades, transfers, or any other action on your accounts.
Basic technical data. Standard information needed to operate the service, such as request
timestamps and error logs. We do not use third-party advertising or cross-app tracking SDKs.
How we use your information
To authenticate you and keep your account secure.
To retrieve and display your live and historical P&L in the app, its widgets, and Live Activities.
To operate, maintain, debug, and improve the service.
To communicate with you about your account or support requests you send us.
We do not sell your personal information, and we do not share it with advertisers or data brokers.
How your information is shared
SnapTrade — only for brokerage connections you initiate, to read your account data. See
SnapTrade's own privacy policy for how they handle it.
Infrastructure providers — we host the service on cloud infrastructure (currently Railway) and,
for Apple sign-in and push-based Live Activities, communicate with Apple. These providers process data on our
behalf to run the service.
Legal — we may disclose information if required by law or to protect the rights, safety, and
security of our users or the service.
How we protect your information
Connection credentials and brokerage access tokens are encrypted at rest with AES-256-GCM.
Data in transit is protected with TLS/HTTPS.
Passwords are stored only as salted one-way hashes.
Every API response is scoped to your own account; the app connects read-only and can never place a trade.
No method of transmission or storage is 100% secure, but we work to protect your data using industry-standard
measures.
Data retention and deletion
We keep your data for as long as your account is active. You can delete your account at any time from
Settings → Delete account in the app. Deleting your account permanently removes your profile,
connected-account credentials, and stored financial data from our systems. You may also disconnect any individual
connected account at any time.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal
information. You can exercise the core of these rights directly in the app, or contact us using the details below and
we will respond as required by applicable law.
Children's privacy
Profit Pal is not directed to, and is not intended for use by, anyone under 18. We do not knowingly collect personal
information from children.
International users
We operate the service from Canada. Our cloud infrastructure providers host data in the United States, so your
information may be processed in the United States and other countries where those providers operate.
Changes to this policy
We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above and,
where appropriate, communicated in the app.