Privacy Policy

1. Introduction and Principles

MastiffMode LLC ("MastiffMode," "we," "us," "our") respects your privacy. This Privacy Policy explains how we collect, use, retain, delete, and protect your information.

Our Privacy Principles:

Minimization: We collect only the data necessary to provide the Service
Transparency: We explain what data we collect and why
User Control: You have rights over your information
Protection: We implement reasonable security measures
Honesty: We do not make promises we cannot keep

This Privacy Policy applies to the MastiffMode platform (the "Service") and our interactions with you.

2. Information We Collect and Why

2.1 Information You Provide Directly

Account Registration

Email address (for login and communication)
Password (encrypted, never stored in plain text)
Account type (trader or mentor)

Why: Required to create and secure your account.

Profile Information

Your name or preferred display name
Time zone (optional, for session reference)
Account balance (optional, for risk calculation)

Why: To personalize the Service and provide accurate risk/reward calculations.

Trading Records

Currency pairs traded
Trade direction (buy/sell)
Entry price, stop loss, exit price
Trade dates and times
Outcome (win/loss/breakeven/open)
Risk percentage and result in R (risk multiples)
Calculated PnL (profit/loss in dollars)
Session (Asia/London/New York/Overlap)
Strategy name
Setup grade

Why: To track your trading performance, provide analytics, and enable coach/mentor feedback.

Journal Entries

Reflections before or after trades
Trade reasoning and decision notes
Emotional state during/after trades
Execution review (checklist answers)

Why: To support your trader development and enable mentor feedback on specific trades.

Psychology Records

Emotional state assessments
Tilt/frustration markers
Discipline self-assessments
Personal reflection notes

Why: To help you develop psychological awareness and track behavioral patterns. These are not medical records and do not substitute for mental-health treatment.

Strategy Documentation

Your personal trading rules
Entry/exit criteria
Risk management guidelines
Session preferences

Why: To help you track your strategy evolution and to reference your own rules.

Development Records

Academy progress and completed modules
Growth milestones and achievements
Mentor feedback notes
Development reflections
Mastery checkpoint status

Why: To track your learning progress and facilitate mentor-led development.

Screenshots and Uploaded Evidence

Charts or broker screenshots you upload
Trade evidence or setup examples
Educational references

Why: To provide context for your journal entries and enable mentor feedback on actual setups.

Mentor Relationships

If you are a mentor: list of traders you mentor (names, trading records)
If you are a trader: name of your mentor (if applicable)
Mentor feedback you receive
Mentor communications

Why: To enable the mentor-mentee relationship and feedback mechanism.

2.2 Information Collected Automatically

Authentication and Session Data

When you log in (timestamp, account identifier)
When your session ends
Device type (desktop, mobile, tablet)

Why: To operate authentication and detect unauthorized access.

Application Usage

Which pages/features you access
Time spent on specific sections
Which modules or lessons you complete
Quiz/assessment responses and scores
Which mentor feedback you view

Why: To understand user behavior and improve the Service. This data is used in aggregated form to enhance features.

Deployment and Error Logs

Server errors or exceptions you encounter
API request metadata (not content)
Browser console errors (not capturing your data)

Why: To diagnose technical problems and improve reliability.

Cookies and Local Storage

Session authentication cookies (temporary)
Your account preferences (dark mode, sidebar state, etc.)
Feature flags (for A/B testing, if enabled)

Why: To maintain your login session and remember preferences.

2.3 Information NOT Collected

MastiffMode does not collect or retain:

IP addresses or device fingerprinting
Precise geolocation data
Keystroke monitoring or screen recording
Webcam or microphone access
Your browser history
Your system information beyond device type
Behavioral tracking outside the Service
Biometric data
Health information (psychology records are self-reported reflection only, not medical data)

3. How We Use Your Information

3.1 Core Service Operation

We use your information to:

Authenticate you and manage your account
Store and display your trading records, journal entries, and development records
Calculate your trading analytics (win rate, expectancy, risk-reward ratios, streaks)
Provide Academy content and track your progress
Enable mentor relationships and feedback
Generate your personal development recommendations
Back up your data for recovery purposes

3.2 Improvement and Development

We use aggregated, anonymized data to:

Understand how users interact with the Service
Identify features that need improvement
Diagnose technical issues
Optimize performance

We do not use your personal trading records to improve our product features without your consent, except to enhance features directly related to your own data (e.g., improving accuracy of your own analytics).

3.3 Communications

We use your email to:

Send account verification and password-reset links
Notify you of significant Service changes
Respond to your support requests
Alert you to critical security issues

We do not send marketing emails without your explicit consent.

3.4 Legal and Compliance

We use your information to:

Comply with applicable laws and regulations
Respond to lawful requests from authorities
Enforce our Terms of Service
Protect against fraud or abuse

4. Who Has Access to Your Information

4.1 Within MastiffMode

Your Own Records: You can access all of your trading records, journal entries, psychology records, strategy documentation, and development history.

Founders/Administrators: MastiffMode founders and authorized staff may access user data only:

To diagnose technical issues
To investigate alleged Terms violations
To comply with legal obligations
With appropriate access controls and audit trails

Mentors: If you have an active mentor relationship, your mentor can access:

Your trades and trade details
Journal entries (as permitted by the relationship)
Your Academy progress (if shared)
Mentor feedback notes and communications

Your mentor cannot access:

Your password or authentication data
Your email address (beyond the relationship identifier)
Trades or records outside your relationship
Psychology records unless explicitly shared

Mentor access ends immediately when the mentor relationship terminates.

4.2 Service Providers and Third Parties

We use the following third-party services to operate MastiffMode:

Supabase (Database, Authentication, Storage)

Provider: Supabase (supabase.com)
Data processed: All user accounts, trading records, journal entries, psychology records, screenshots, development records
Location: Canada (Supabase project hosted in AWS ca-central-1)
Purpose: Secure storage, authentication, real-time subscriptions, backup
Security: Supabase provides encryption in transit and at rest (where applicable to their service tier)

Vercel (Hosting and Deployment)

Provider: Vercel (vercel.com)
Data processed: Application hosting, deployment logs, build artifacts
Location: Multiple global locations
Purpose: Application hosting and continuous deployment
Security: SSL/TLS encryption in transit

Email Service Provider

Provider: The email delivery service used by our authentication provider (Supabase Auth)
Data processed: Your email address and outbound messages
Purpose: Sending account verification, password resets, critical notifications
Security: Encryption in transit; messages contain only what is needed for the notice

PostHog (Product Analytics)

Provider: PostHog (posthog.com)
Current Status: INACTIVE
Data processed: If enabled in the future, aggregated feature-usage data only (not personal trading records)
Purpose: Product analytics and feature improvement
Security: Reviewed before any re-enablement, and this policy will be updated first

We do not sell, rent, or share your personal information with any third parties for their marketing purposes.

4.3 Legal Requests

We may disclose your information if required by law, including:

Subpoena or court order
Government agency request
Fraud or security investigation

When possible and legally permitted, we will notify you before disclosing information.

5. Data Retention and Deletion

5.1 How Long We Keep Your Data

Active Account:

All trading records, journal entries, psychology records, strategy, and development records are retained as long as you maintain your account
You can delete individual trades, journal entries, or screenshots from within your account at any time

Backup Records:

Automated backups are retained by Supabase according to Supabase's retention policy
Database backups are typically retained for 30 days and then deleted, but confirm with your provider

Consent Records:

Your acceptance of Terms, Privacy Policy, and Trading Risk Disclosure is retained for as long as your account exists, plus 3 years for legal compliance

Legal Hold:

If you are involved in a legal dispute or investigation, relevant records may be retained beyond normal retention periods

5.2 Data Deletion

Deleting Individual Content:

You can delete individual trades, journal entries, screenshots, or strategy records at any time from within your account
Deleted content is removed from your view immediately
Backups may retain deleted content for up to 30 days (per Supabase retention)

Account Deletion:

You can request full account deletion through your account settings
Upon request, we will:
- Delete your account and all associated trading records, journal entries, psychology records, strategy, and development records within 30 days
- Delete your email from our active systems
- Delete your screenshots and uploaded files
- Revoke mentor access

We will NOT delete:
- Legally required records (e.g., for tax or fraud investigation)
- Records subject to legal holds
- Supabase backup copies (which are automatically deleted after 30 days per their retention policy)
- Anonymized, aggregated data used for analytics or improvement

Export Before Deletion:

Before requesting account deletion, you can export/download your trading records through your account settings (if this feature is available)

6. Security Measures

6.1 Technical Security

MastiffMode implements:

Authentication: Secure Supabase authentication with password hashing (bcrypt)
Encryption in Transit: TLS/SSL encryption for all data transmitted to/from MastiffMode servers
Access Control: Row-Level Security (RLS) policies in Supabase to prevent unauthorized data access
Secrets Management: API keys and service credentials stored securely in Vercel environment variables, not in code
Backup Security: Database backups encrypted according to Supabase standards

6.2 Administrative Security

Limited access to production databases (founder and authorized staff only)
Audit logging for administrative actions
Separation of development, staging, and production environments
Regular dependency updates to patch known vulnerabilities

6.3 What We Cannot Guarantee

We do not guarantee:

100% protection against all attacks or breaches
Immediate detection of every attempted unauthorized access
Protection against physical theft or destruction
Protection against actions by trusted insiders acting maliciously

7. Your Rights and Choices

7.1 Access Your Data

You can view and download your account information, trading records, journal entries, and development history at any time by logging in to your account.

7.2 Correct Your Data

You can update or correct your information through your account settings.

7.3 Delete Your Data

You can delete individual pieces of content (trades, journal entries, screenshots) at any time, or request full account deletion.

7.4 Data Portability

You can export your trading records and history in standard formats (if this feature is available).

7.5 Mentor Relationship Consent

You can:

Invite mentors to access your records
Revoke mentor access at any time
Specify which records are shared with each mentor

7.6 Marketing Communications

If you receive marketing emails, each email includes an unsubscribe link. You will not receive marketing communications without your consent.

7.7 Privacy Settings

You can manage your account privacy through your account settings, including:

Whether your profile is visible to other traders
Which records are private vs. mentor-accessible
Communication preferences

8. Children and Minors

MastiffMode is not intended for users under 18 years old. We do not knowingly collect information from minors. If we become aware that we have collected information from a minor, we will delete it promptly.

9. Data Transfers and International Data

If you are located outside the United States, your information may be transferred to, processed, and stored in Canada and the United States. By using MastiffMode, you consent to the transfer and processing of your information according to this Privacy Policy.

10. Changes to This Privacy Policy

We may update this Privacy Policy at any time. If changes materially affect how we use your information, we will:

Notify you by email
Post a prominent notice on the Service
Require your affirmative consent if legally required

Continued use after changes become effective constitutes acceptance.

11. Automated Decision-Making and Profiling

MastiffMode uses your trading records to:

Calculate your personal analytics (win rate, expectancy, risk-reward metrics)
Generate personalized Academy recommendations
Provide analytics visualizations

We do not use automated decision-making to:

Make decisions about your account status or access
Deny you Service features based on algorithmic profiling
Make predictive judgments about your trading future

You have the right to request human review of any automated calculation or recommendation.

12.1 Types of Cookies We Use

Essential Cookies:

Authentication tokens (necessary for login)
CSRF protection tokens (security)

Preference Cookies:

User preferences (dark mode, sidebar state, etc.)
Language settings

Analytics Cookies:

Feature-usage tracking (only when analytics are enabled)
Currently disabled per FD-004

12.2 Cookie Management

You can control cookie settings through your browser. Disabling essential cookies will prevent login.

13. Third-Party Links

MastiffMode may contain links to third-party websites (trading platforms, educational resources, etc.). We are not responsible for their privacy practices. Review their privacy policies before providing information.

14. California Privacy Rights (CCPA/CPRA)

If you are a California resident:

Right to Know: You have the right to request what personal information we collect, use, and share
Right to Delete: You can request deletion of your information (subject to exceptions)
Right to Opt-Out: You can opt out of the sale of your personal information (MastiffMode does not sell your data)
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To submit a request, contact: legal@mastiffmode.com

If you are in the EU/EEA:

Legal Basis: We process your information with your consent and to perform our contract with you
Right to Access: You can request a copy of your information
Right to Rectification: You can correct inaccurate information
Right to Erasure: You can request deletion (subject to exceptions)
Right to Restrict Processing: You can restrict how we use your information
Right to Portability: You can request your information in a structured format
Right to Object: You can object to certain processing
Right to Lodge a Complaint: You can file a complaint with your data protection authority

Our Data Protection Officer can be reached at: legal@mastiffmode.com

16. Contact Us

For privacy questions or requests:

MastiffMode LLC
Privacy Department
legal@mastiffmode.com

For data subject access requests (GDPR):
Include "GDPR Data Access Request" in the subject line

Mailing address:
Brookport, Illinois

Last Updated: August 23, 2026
Version: 1.0
Effective Date: August 23, 2026