Privacy Policy
1.Who is responsible
[FloSignals LLC — confirm legal name and state of formation], [registered address, if required], is the controller of the personal data described here. Write to [support@flosignals.com or flosignals@gmail.com — pick one] about anything on this page, or use the Privacy Rights Request page.
[owner: if the company has no establishment in the EEA or the UK, appoint and name a representative for each (GDPR Art. 27 / UK GDPR) here — or state "We have no establishment in the EEA or the UK; contact the controller directly" if counsel confirms none is required]
2.What we collect
When you sign in
You sign in with Whop. Whop sends us your Whop user id, name, username and email address, and whether your membership is active. We keep the user id only as a one-way hash, which is your member reference everywhere else; we keep your name and username inside the signed session cookie so pages can greet you; we use the email only to recognise staff accounts and do not store it. When you write to us from that address, we ask Whop which membership it belongs to. We set a session cookie that lasts seven days. You cannot use the member areas without signing in.
What you put into the service
- Journal entries, tags, notes and the screenshots you attach to them.
- Saved chart layouts, drawings, indicator settings and preferences such as your theme.
- Scripts you write or ask Quant to write, what you type to FLO or any other assistant we offer, and the chart snapshot FLO reads.
- Trade history imported from an exchange with a read-only API key you give the journal. The key is sent to our platform, sealed there and never returned; it is used only to read your closed trades.
- If you turn on key sync for FloCharts (where the feature is on): an encrypted blob of your Toobit key, encrypted in your browser under a passphrase we never receive. We cannot read it.
- Before your first live trading connection: the consent sentence you typed, its version, the time, and your browser's user-agent string, kept with your member reference.
- If you install the FloSignals app and allow notifications: the push token your phone's platform assigns to the app, the platform name and a device label, kept with your member reference so alerts can reach the phone. It is removed when you remove the device in the chart's alert settings, and when Google or Apple report it invalid. Up to ten devices per member.
What the service records on its own
- Server logs: the time, path, status and IP address of requests, kept for operating and securing the service.
- The trade relay logs the time, your member reference, the method, the path and the response status of each request it forwards — never a body, a query string or a key id — so we can investigate a problem you report.
- Analytics: which pages and features are used, through Google Analytics and Vercel Web Analytics (no cookie). In the EEA, the UK and Switzerland, Google Analytics sets its cookie only if you accept it in the banner; elsewhere it is set when the page loads. Separately, when you sign in our server tells Google Analytics that a sign-in happened, with your hashed member reference, setting no cookie, whether or not you accepted the banner; we rely on our legitimate interest in knowing how many members use the service for that. Analytics never receives your name, email or anything you typed.
- A rough country lookup from your IP address, used only to decide whether to show the consent banner. The IP is not stored for it.
- If you link your Discord account to your membership through Whop, Whop and Discord exchange your Discord user id so roles can be granted and removed; that happens under their policies, and we do not receive it.
What we do not collect
We never see your card or bank details — Whop handles payment. We do not collect government identifiers, precise location, biometrics or any other sensitive category of data. Your FloCharts trading secret never leaves your browser. Nothing you paste into the FloScript converter is uploaded.
3.Why we use it
- To run the service you asked for — signing you in, keeping your journal and layouts, importing your trades, answering in Quant, relaying the orders you sign. Legal basis: performing our agreement with you.
- To keep it working and safe — logs, abuse prevention, debugging. Legal basis: our legitimate interest in running a secure service.
- To understand what is used — analytics. Legal basis: your consent where the law needs it, otherwise our legitimate interest in improving the service.
- To tell you things that matter — changes to terms, security notices, support replies. Legal basis: our agreement with you and our legitimate interest. News and offers are sent only with your consent, and every such email has an unsubscribe link.
- To meet legal obligations — tax, accounting, a lawful request from an authority.
We do not sell personal data, and we do not use it for advertising.
5.Where it is processed
Our providers process data in the United States and in Germany [owner: add the country of the journal platform (VM 212) if it is elsewhere]. If you are in the EEA, the UK or Switzerland, transfers out of your region rely on the European Commission's standard contractual clauses, the EU–US Data Privacy Framework where a provider is certified under it, or an adequacy decision, as each provider offers them.
6.How long we keep it
- Session cookie: 7 days, or until you sign out.
- Journal exchange keys: until you press Disconnect in the journal, or until we delete them [owner: days after membership ends, as implemented on the platform — proposed: 90] after your membership ends.
- Synced FloCharts key blobs (where the feature is on): deleted when you remove the key, 90 days after your membership ends, or after 180 days without a change, whichever comes first.
- Journal entries, screenshots, layouts, scripts and Quant history: [owner to set — proposed: kept while your membership is active and for 12 months after, then deleted].
- Live-trading consent records: for as long as you are a member and [owner: proposed 6 years after, as evidence of consent].
- Server and request logs: [owner: the hosting plan's log retention, and the recorder's journald retention].
- FLO conversation logs (counts, not text): [owner].
- Google Analytics data: [owner to confirm the GA retention setting — per Google's retention setting, at most 14 months].
- Records we must keep for tax or accounting, which Whop holds rather than us: as long as the law requires, typically up to [owner/counsel: 7 or 10 years, by jurisdiction].
Ask us to delete your account data sooner and we will: we cancel any active membership, delete your member data within 30 days, and keep only what tax, accounting and fraud-prevention law requires, for as long as it requires, and the record of any live-trading consent you gave, as evidence that you gave it.
7.How it is protected
Everything travels over TLS. Journal keys are sealed with a key held only in the memory of the machine that uses them. Synced trading keys are encrypted in your browser and are useless to anyone without your passphrase — including us. Screenshots live in a private store that is not listed publicly. Your trading secret never reaches our servers.
If you ask the chart to remember your FloCharts key on a device, it is kept encrypted in that browser; if you choose "this tab only", your browser keeps it unencrypted in that tab's storage until the tab closes. Either way it stays on your device.
No system is perfectly secure; if we learn of a breach that affects you we will tell you without undue delay. How to report a security problem to us is on the Security page.
8.Your rights
Wherever you live, you can ask us what we hold about you, ask for a copy, ask us to correct or delete it, and object to or restrict how we use it. The journal has a CSV export so you can take your trades with you at any time.
If you are in the EEA, the UK or Switzerland you also have the right to data portability, to withdraw consent at any time (which does not affect what was done before, and is as easy as giving it), and to complain to the data-protection authority where you live.
We make no decisions about you by automated means that have legal or similarly significant effects. Nothing an assistant produces is used to profile you or to decide what you may buy or do.
To exercise any of these, use the Privacy Rights Request page or email [support@flosignals.com or flosignals@gmail.com — pick one] from the address on your Whop account, or tell us how else to confirm it is you. We confirm receipt within 10 days and answer within 30 days, extendable where the law allows for a complex request, in which case we tell you. If the law prevents us from doing what you ask, we tell you why in writing. You may use an authorised agent; we may ask for proof of their authority and may confirm the request with you directly. We will not treat you differently for asking.
9.If you are in California or another US state
Whether or not a state privacy law applies to a company of our size, if you live in California or another US state with a privacy law you have the right to know the categories of personal information we collected and disclosed in the last 12 months — identifiers, account content and usage data, as listed under What we collect, disclosed only to the processors under Who it is shared with — to delete and correct it, and not to be discriminated against for asking. We do not sell or share personal information for cross-context advertising, and we offer no financial incentive for it. If your browser sends a Global Privacy Control signal, we treat it as declining analytics on this site: the analytics cookie is not set and the banner does not ask. An authorised agent may ask for you with written permission. We answer within 45 days, extendable where the law allows.
The "Do Not Sell or Share My Personal Information" link in the footer goes to the Privacy Rights Request page, where you can make any of these requests.
10.The Discord
What you post in the Discord is visible to every member and is stored by Discord under its policy. Moderators keep a log of warnings, removals and bans, with the message involved, for as long as the server exists, so that decisions can be reviewed.
11.Other sites
Whop, Toobit, Discord, TradingView and any site we link to have their own privacy policies. We do not control them; read them before you use them.
12.Children
The service is for adults. We do not knowingly collect data from anyone under 18; if you believe we have, tell us and we will delete it.
13.Changes
When this policy changes, the date at the top changes, and for a change that affects your rights we tell members by email or in the Discord before it takes effect.
14.Contact
[support@flosignals.com or flosignals@gmail.com — pick one], or the Privacy Rights Request page.