Privacy Policy.

SetupBook (“the app”) is made by ALAZ Software (“ALAZ”, “we”, “us”), a software studio. ALAZ is the controller of the personal data processed through the app. You can reach us at hello@alaz.pro; our office addresses are listed on alaz.pro.

This policy explains what the app collects, why, who receives it, how long it is kept and what you can do about it. It covers the iOS and Android app. Our website has its own privacy policy.

SetupBook is a trading journal. The mobile app uses the same account and data as the web app at setupbook.io; this policy covers both when you use the app.

Account. Your email address, display name, sign-in method (email and password, Google, or Apple where offered) and your preferences (language, time zone, theme, display options, goals). Passwords are handled by Firebase Authentication; we never see them.

Your journal. What you record: trading accounts (name, type, currency, starting balance, prop firm rules), trades (symbol, side, executions, stop loss and take profit, fees, P&L, risk, notes, ratings, strategies, mistakes, checklists, chart links), tags, rules, symbols, day notes and up to 5 screenshots per trade (resized and converted to WebP before upload).

Wellbeing check-ins (optional). Sleep, energy, mood and how calm you felt at entry. They stay off until you explicitly agree to turn them on; we record when you agreed. They are never shown on shared trade cards.

Platform connections (optional). If you connect MetaTrader, cTrader, Binance, Bybit or OKX, we store the connection details (label, login, server, broker, account currency, sync status), the trades and fills it imports, and the credentials needed to read them: exchange API keys (only read-only keys are accepted) and cTrader access tokens are encrypted on our server with a key kept outside the database; a MetaTrader sync token is stored only as a hash. We never place trades.

Shared trades (optional). When you share a trade, a copy of it — without the details you choose to hide — is published at a public link, with your display name and avatar if you choose. Other signed-in users can react to it.

Feedback. Your message, its type, an optional email address and up to 3 screenshots, the screen it came from, the app language and your device or browser.

Purchases. SetupBook is free today. If you buy a paid plan in the app in the future, its status is managed through the App Store or Google Play (and a subscription service such as RevenueCat), linked to your account ID; payment details stay with Apple or Google.

Technical data. Our servers log requests (IP address, device or browser, time, errors) for security and troubleshooting. Price charts load public market data directly from Binance's public API, which receives your IP address and the symbol requested.

There is no advertising, no analytics or tracking SDK, and your data is never used to train AI models.

• To run your journal: store and sync your trades, compute your statistics, import and sync from the platforms you connect.
• To publish the trade cards you choose to share.
• To keep the service secure and prevent abuse.
• To answer feedback and support requests.

Where the GDPR, the UK GDPR or Türkiye's KVKK applies, we rely on these legal bases:

• Contract — to provide the journal, sync and sharing, as described in the terms.
• Explicit consent — for wellbeing check-ins, which may reveal information about your health. You can withdraw it at any time in the settings; doing so deletes them.
• Legitimate interests — security, fraud prevention and reliability. You can object at any time.
• Legal obligation — purchase records required by tax law, and lawful requests.

• We don't sell or rent your personal data.
• We don't use it for advertising and we don't share it with data brokers.
• We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

We use a few service providers to run the app. They process data on our behalf, under contracts that limit them to that purpose:

• Google Firebase / Google Cloud — sign-in (Authentication), database (Cloud Firestore) and screenshot storage (Cloud Storage) (Google LLC, United States)
• Hostinger — hosting of setupbook.io and the server functions that run platform sync and share images, and our support mailbox (Hostinger International Ltd., servers in Frankfurt, Germany)
• Apple and Google — sign-in with Apple or Google, and payment for anything bought in the App Store or Google Play

Apart from them, we disclose data only when the law requires it (for example a valid court order), to protect our rights or users' safety, or to a successor if ALAZ or the app is sold or merged, in which case this policy keeps applying to your data.

The trading platforms you connect (MetaQuotes, Spotware cTrader, Binance, Bybit, OKX) are independent companies: they send us your trading history at your request, under their own terms. Shared trade cards are visible to anyone with the link.

Your account and journal are stored by Google in the United States (multi-region), and our server functions run in Germany. This may be outside the country where you live. When data leaves the European Economic Area, the United Kingdom, Switzerland or Türkiye, we rely on the safeguards the law provides, such as the European Commission's adequacy decisions (including the EU–US Data Privacy Framework for certified providers) and standard contractual clauses in our providers' data processing terms.

• Account and journal: until you delete them or your account. Deletion is immediate for your profile, trades, check-ins, screenshots, share cards, reactions and connections; Google's backups expire within about 6 months.
• Connection credentials: until you disconnect the platform or delete the account.
• Feedback: up to 24 months.
• Server logs: a short period, for security.
• Emails you send us: up to 24 months after we answer.

Depending on where you live (for example under the GDPR, the UK GDPR, Türkiye's KVKK, Brazil's LGPD or US state privacy laws such as the CCPA), you can ask us to:

• tell you what data we hold about you and give you a copy;
• correct it, or delete it;
• export it in a portable format;
• restrict or object to how we use it, and withdraw any consent you gave.

In the app and on the web you can edit or delete anything you recorded, turn off and delete check-ins, disconnect platforms, export all your data as CSV or a JSON backup, and delete your account (how).

For anything else, email hello@alaz.pro from the address on your account, with “SetupBook” in the subject. We may need to confirm it's you. We answer within 30 days and don't charge for it. You can also complain to your local data protection authority (in Türkiye, the KVKK Authority at kvkk.gov.tr; in the UK, the ICO). California residents: we don't sell or share personal information as those terms are defined by the CCPA, and we won't treat you differently for using your rights.

Data travels over encrypted connections (TLS) and is encrypted at rest by our cloud providers. Access is limited by per-user rules, so one user can't read another's data, and only the people at ALAZ who need it for support or operations can reach it. Platform credentials are additionally encrypted on our server. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.

The app is meant for adults. You must be 18 or older to use it, and we don't knowingly collect data from anyone younger. If you believe a minor has given us data, write to hello@alaz.pro and we'll delete it.

When we change how the app handles data, we update this page and the date at the top. If a change is significant, we also tell you in the app before it takes effect.

Questions about this policy or your data: hello@alaz.pro. Help with the app: SetupBook support.