This policy explains how SetupBook ("we", "us") handles personal data when you visit setupbook.io or use the SetupBook app. It is written to meet the EU and UK General Data Protection Regulation (GDPR), Türkiye's Personal Data Protection Law No. 6698 (KVKK), Brazil's LGPD and the US state privacy laws. Sections near the end add what is specific to each region.

Who is responsible

The data controller is Mustafa Kahraman (ALAZ.). You can reach us at hello@alaz.pro. Full operator details are in the legal notice.

The short version

  • We collect what you type into SetupBook, what you import, and what the platforms you connect send us. That data exists to run your journal and nothing else.
  • We do not sell personal data, we do not show ads, and we do not run analytics or tracking scripts.
  • Your journal is private by default. Only a trade you choose to share becomes visible to others, and only the details you leave on.
  • You can download everything as CSV or JSON and delete your account, with all its data, from Settings → Data at any time.

What we collect

Account data. Your email address, a display name, an avatar you pick, and your password, which our authentication provider stores only as a salted hash. If you sign in with Google we receive your name, email address and Google account ID from Google.

Settings. Language, time zone, base currency, theme and display preferences.

Journal data. Everything you enter or import: trading accounts (name, broker, type, balance, prop firm rules), trades (symbol, direction, prices, size, fees, result, times), strategies, tags, mistakes, checklists, ratings, the emotion label you pick for a trade, notes, day notes, rules and screenshots you upload. CSV and Excel files you import are read in your browser; only the resulting trades are saved.

Wellbeing check-ins (optional, with your consent). If you turn on check-ins, we store your 1 to 5 self-ratings for sleep, energy and mood on a day, and for how calm you were when you opened a trade. Some laws treat information about sleep or mood as health data, so the scales stay hidden until you agree to them in the app. The rest of SetupBook works without them. See Sensitive data below.

Platform connections (optional). When you connect MetaTrader 4/5, cTrader, Binance, Bybit or OKX, we store what is needed to fetch your trade history: an access token for the MetaTrader Expert Advisor, the OAuth grant from cTrader, or the API key and secret you give us for an exchange. Secrets are encrypted on our server before they are stored and are never sent back to your browser. We then store the trade history (fills, orders, positions, balances) those platforms return. We ask you to use read-only keys; SetupBook never places, changes or closes trades.

Shared trades (optional). When you share a trade, we create a public card at a link of the form setupbook.io/s/... containing only the details you left switched on. We count views of the card. If you react to someone else's card, the card stores your account ID next to the emoji you chose; other visitors see only the count.

Feedback. If you send feedback from the app we store your message, the category, the email address and page address if you choose to include them, your language, your browser's user agent string and any screenshots you attach.

Technical data. When your browser requests a page, our hosting provider's servers receive your IP address, browser type, the requested address and the time, as every web server does. Our authentication provider processes your IP address and device information to keep sign-in secure (for example, to block repeated failed attempts).

Market data requests. To draw price charts for your trades, your browser fetches public candle data directly from Binance's public market data service (data-api.binance.vision). That request carries your IP address and the symbol and time range of the chart, as any web request does. It does not carry your account details or any other journal data.

We do not collect payment card data: SetupBook is free and has no payment system today.

Purpose Data Legal basis (GDPR / KVKK)
Create and secure your account, sign you in Account data, technical data Performance of our contract with you; legitimate interest in security
Store and analyse your journal, generate reports Journal data, settings Performance of contract
Fetch trades from platforms you connect Connection secrets, trade history Performance of contract, at your request
Store wellbeing check-ins and show their statistics Wellbeing check-ins Your explicit consent (GDPR Art. 9(2)(a); KVKK Art. 6)
Publish a trade you chose to share The details you left on Performance of contract, at your request
Answer feedback and support requests, fix bugs Feedback, emails you send Legitimate interest in running and improving the service
Prevent abuse, comply with law, handle legal claims Technical data, relevant records Legitimate interest; legal obligation

We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not use it to train AI models.

Sensitive data

Wellbeing check-ins may count as health data (a special category under GDPR Article 9 and KVKK Article 6). We process them only with your explicit consent:

  • The check-in scales are hidden until you read a short explanation and press Agree and turn on check-ins. We record the date and time you agreed.
  • The ratings are used only to show your own statistics. They are never shared, never put on a shared trade card, and leave the app only in exports and PDF reports you create yourself.
  • You can withdraw consent at any time in Settings → Data → Turn off and delete check-ins. This deletes every sleep, energy, mood and calm rating in your journal at once. Your notes and trades stay.

Withdrawing consent does not affect the lawfulness of processing before you withdrew it.

Who receives data

We share personal data only with the providers that run SetupBook for us, under contracts that limit them to our instructions, and with third parties you choose to connect. The current list, with what each one does and where, is on the subprocessors page.

  • Google (Firebase). Authentication, database and file storage. Your account and journal data are stored in Google Cloud's United States multi-region.
  • Hostinger. Runs the website and the server functions that handle platform connections, in a data centre in Frankfurt, Germany, and hosts the mailbox of our support address.
  • Platforms you connect. When you connect a broker or exchange, we send them the credentials you provided so they return your history. Their own privacy policies govern what they do.
  • The public. Shared trade cards are visible to anyone who has the link. We ask search engines not to index them.
  • Authorities. When the law requires it, for example a valid court order.

We never sell personal data or share it for cross-context behavioural advertising.

International transfers

We operate from Türkiye. Your account and journal data are stored by Google in its United States multi-region, and the website server runs in Frankfurt, Germany. Personal data of users in the EEA, the UK, Türkiye and other countries is therefore transferred abroad.

  • From the EEA, the UK and Switzerland to Google in the United States: Google LLC is certified under the EU-US Data Privacy Framework and its UK and Swiss extensions, and Google's Cloud Data Processing Addendum adds the standard contractual clauses approved by the European Commission where they are needed. Germany is inside the EEA, so data processed there needs no further mechanism.
  • From Türkiye: transfers to Google and Hostinger are made under Article 9 of the KVKK, on the basis of the standard contracts published by the Personal Data Protection Board, which are notified to the Authority as the law requires.
  • Platforms you connect: when you connect a broker or exchange, we send your credentials and requests to that platform, wherever it operates, because you asked us to. This is necessary to perform our contract with you.

You can ask us for a copy of the safeguards that apply to your data at the address above.

How long we keep it

  • Account and journal data: until you delete it or delete your account. Account deletion removes your profile, trades, check-ins, screenshots, shared cards, your reactions on other members' cards, connections and stored secrets straight away. Feedback you sent is kept as described below. Copies in our providers' backups and logs are erased on their schedules; Google states that deleted data leaves its systems within about six months.
  • Feedback: up to 24 months after we have dealt with it, or earlier on request.
  • Server logs: kept by our hosting provider for a short period for security and troubleshooting.
  • Emails you send us: as long as needed to answer and for up to 24 months afterwards.

If we must keep something longer to meet a legal obligation or to defend a legal claim, we keep only that and only for that purpose.

Security

Traffic is encrypted with TLS. Database rules let each account read only its own data. Platform secrets are encrypted server-side and are never readable from a browser. No system is perfectly secure; if a breach affects your data, we will tell you and the competent authorities as the law requires.

Your rights

Depending on where you live, you can:

  • access the data we hold about you and receive a copy,
  • correct it,
  • delete it,
  • take it with you in a machine-readable format (portability),
  • restrict or object to certain processing,
  • withdraw consent where processing is based on consent,
  • complain to a data protection authority.

Most of this is self-service: Settings → Data downloads all your journal data as CSV or JSON, turns off wellbeing check-ins and deletes them, and deletes your account with everything in it. For anything else, write to hello@alaz.pro. We answer within one month (30 days under KVKK) and may ask you to confirm your identity first. Using your rights is free.

Children

SetupBook is for adults. You must be at least 18 to create an account. If we learn that a child has given us personal data, we delete it.

Cookies and local storage

We do not use advertising or analytics cookies. Sign-in and a few preferences are kept in your browser's storage. Details are on the cookies page.

Region-specific information

European Economic Area and United Kingdom

You can complain to the supervisory authority where you live or work, or where you think an infringement happened. In the UK this is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to resolve your concern first.

Türkiye (KVKK)

This section is our disclosure under Article 10 of Law No. 6698. The data controller is Mustafa Kahraman (ALAZ.). We process the categories of data listed above for the purposes and on the legal grounds in the table above, which correspond to Article 5(2)(c) (performance of a contract), 5(2)(f) (legitimate interest) and 5(2)(ç) (legal obligation), and for wellbeing check-ins to your explicit consent under Article 6, which you give in the app before the check-in scales appear. We collect it electronically, through the website and app, and through the platforms you connect. It is transferred abroad as described under International transfers. You can exercise your rights under Article 11 by writing to hello@alaz.pro; if we reject your request or do not answer within 30 days, you can complain to the Personal Data Protection Authority (kvkk.gov.tr).

United States

Residents of California and other states with consumer privacy laws have the right to know, delete and correct personal data and to opt out of its sale or sharing. We do not sell or share personal data as those laws define it, and we do not use sensitive personal information to infer characteristics about you. We will not discriminate against you for using your rights. You or an authorised agent can make a request at the address above.

Brazil

You have the rights in Article 18 of the LGPD, including confirmation, access, correction, anonymisation, portability, deletion and information about sharing. You can complain to the ANPD.

Everyone else

Wherever you live, you can use the rights described above. If local law gives you more, we honour it.

Changes to this policy

We will post any change on this page and update the date at the top. If a change materially affects how we use data you already gave us, we will tell you in the app or by email before it takes effect.

Contact

Questions or requests: hello@alaz.pro. You can also use the contact page.