Privacy Policy
This policy describes what happens to information when you read this site and when you send us something. It is written to be read rather than to be waved at a regulator, so it says what is collected, why, who else sees it, and how long it stays.
Last updated: 31 Jul 2026
Who is responsible
[ PLACEHOLDER. Name of the person or entity operating this site, the country it operates from, and a postal address if one exists. If the site is run by an individual rather than a registered company, say so plainly. A privacy policy naming an entity that does not exist is worse than one naming a person who does. ]
Questions about anything below go to [email protected].
Reading the site
You can read every page here without giving us anything, including the sample report and the full method. There is no account, no email gate and no registration anywhere on this site.
Two things still happen automatically, as they do on any website.
Server logs. Our hosting provider records the usual technical entries for each request: IP address, date and time, the page requested, the referring page, and the browser’s user-agent string. These logs exist to keep the site running and to investigate abuse, and they are kept for [ RETENTION PERIOD, ask your host ] before being discarded.
Content delivery and security. The site sits behind Cloudflare, which handles traffic before it reaches our server. Cloudflare processes IP addresses and sets a small number of technical cookies to distinguish visitors from automated traffic. Their processing is described in their own privacy documentation.
Fonts are hosted on our own server rather than loaded from Google Fonts or any other third party. Loading fonts from an external service would transmit your IP address to that service on every visit, and it is avoidable, so we avoid it.
Cookies
This site sets no advertising cookies, no tracking pixels and no social media widgets. The cookies present are these:
| Set by | Purpose | Lifetime |
|---|---|---|
| Cloudflare | Separates human visitors from bots and mitigates attacks | Up to 30 minutes per session, plus a longer-lived security token |
| WordPress | Keeps a session open, but only for users who log in to administer the site | Session, or up to 14 days if “remember me” is used |
None of these are used to profile you or to follow you across other sites. If analytics are added to this site in future, this section will be updated before they are switched on, and a consent mechanism will be added where the law requires one.
[ PLACEHOLDER. Delete the previous sentence and describe the tool honestly if you install analytics. If you use anything that sets non-essential cookies, you need a consent banner in the EU and the UK, and it must block those cookies until consent is given. ]
When you write to us
An enquiry reaches us by email. We receive whatever you choose to put in it: your email address, your name if you sign it, and the description of your situation.
We use that only to answer you and, if the work goes ahead, to carry it out. Correspondence is kept while a conversation is live and for [ RETENTION PERIOD ] afterwards, so that a returning client is not asked to explain everything twice. Ask us to delete it earlier and we will.
Nothing you send is added to a mailing list, sold, rented, or shared with anyone for marketing. Nobody pays us to introduce them to you, which is the same commercial position described on the rest of this site.
Trading data during an engagement
This is the section that matters most, because it covers the only genuinely sensitive material we ever handle.
A review needs your execution record: a statement export from a trading platform, or a CSV of closed positions from an exchange. Where an export is unavailable, a read-only API key may be used instead. Nothing is requested until scope and fee are agreed in writing, and nothing is requested from anyone who is only browsing.
What is never requested, at any stage
- Account passwords.
- API keys carrying permission to trade or to withdraw.
- Wallet seed phrases or private keys.
- Remote access to your terminal or your computer.
- Copies of identity documents, unless a law we are subject to requires them, in which case we will say which law.
If anyone claiming to represent this practice asks you for any of the above, they do not represent this practice.
How that material is handled
Working files are stored [ PLACEHOLDER: where, and whether encrypted at rest. Be specific and be truthful. “Encrypted cloud storage” is only worth writing if it is accurate. ] and are used for one purpose: producing your report.
Read-only API keys, where used at all, are revoked by you on delivery. We will remind you to do it.
Your record is never published, never used as an example, and never used to illustrate a finding to anyone else. Redaction is not treated as sufficient anonymisation, because a trade log with distinctive timestamps and instruments frequently identifies its owner to someone who knows them. The sample report on this site is constructed for that reason rather than borrowed from a client.
Working files are deleted [ RETENTION PERIOD, for example 12 months ] after the report is delivered, or immediately on request. The report itself is yours; keep it as long as you like.
Who else processes your data
We use a small number of service providers, and only for the purposes below. None of them are permitted to use your data for their own ends.
| Provider | What it handles | Where |
|---|---|---|
| [ HOSTING PROVIDER ] | Website hosting and server logs | [ COUNTRY ] |
| Cloudflare | Traffic delivery, bot filtering, security | Global network |
| [ EMAIL PROVIDER ] | Correspondence | [ COUNTRY ] |
| [ FILE STORAGE, if separate ] | Working files during an engagement | [ COUNTRY ] |
Beyond these, your data is disclosed to no one, except where a competent authority compels disclosure under a law that applies to us. Should that happen, we will tell you unless we are legally prohibited from doing so.
Where your data is held
[ PLACEHOLDER. Name the country or region where hosting, email and file storage sit. If any of it leaves the EEA or the UK while you are handling data belonging to people there, name the safeguard you rely on, such as Standard Contractual Clauses or an adequacy decision. This is the sentence a data protection authority reads first. ]
Why we are allowed to hold it
For readers in the European Economic Area and the United Kingdom, the legal bases are these:
- Legitimate interests for server logs and security processing: keeping a website available and defending it against abuse.
- Steps prior to a contract, and then the contract itself, for correspondence about a possible review and for the trading data a review requires.
- Consent for anything optional, such as a subscription to new articles, if and when that exists. Consent can be withdrawn at any time, and withdrawing it costs you nothing else.
- Legal obligation where a law that applies to us requires records to be kept.
Your rights
You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to processing based on legitimate interests, or ask for it in a portable format. Write to [email protected] and we will respond within [ RESPONSE TIME, one month is the GDPR default ].
We will not ask you to justify a deletion request. If you would rather your trade log did not exist on anyone else’s machine, that is reason enough.
If you think we have handled your data badly, tell us first and we will try to put it right. You are also entitled to complain to the data protection authority in your country without speaking to us at all.
Children
This site is not intended for anyone under 18 and we do not knowingly collect information from minors. Where we learn that we have, we delete it.
Changes
When this policy changes, the date at the top changes with it. Where a change affects how we handle something already given to us, we will say what changed rather than quietly replacing the text and hoping nobody compares versions.