Privacy & Terms

Privacy Policy

1.Who we are

Marginalia is the trading-journal service operated at marginalia.trade ("Marginalia", "we", "us"). For the purposes of the EU General Data Protection Regulation (GDPR), Marginalia is the data controller for the personal data described in this policy. We operate from Ireland.

Privacy questions and requests: support@marginalia.trade.

2.What we collect — and what we don't

Account data. Your email address and a securely hashed password (we never store or see the password itself), managed through our authentication provider. Optionally, a display name and avatar you set yourself, and your two-factor authentication preference.

Content you create. Your journal is your data: trades, pre/post-market notes and written plans, backtest sessions, strategies and entry models, and any chart screenshots you upload. We store this solely so the service can show it back to you.

Subscription data. Whether you're on the Free or Pro plan, your subscription status and renewal date, a Stripe customer reference, and any access code you've redeemed.

Technical data. Standard, short-lived server and function logs (such as timestamps and error diagnostics) used to keep the service running and secure.

What we do not collect:

• No payment card data. Card numbers, expiry dates, and billing details go directly to Stripe and never touch our servers. We only receive a customer reference and subscription status.
• No advertising or cross-site trackers, no marketing pixels, no fingerprinting, and no behavioural advertising profiles.
• No sale of personal data — to anyone, ever.

3.How we use your data

• To provide the service: authenticate you, store and display your journal, sync across devices, and enforce plan limits.
• To process subscriptions: start, renew, and cancel Pro billing through Stripe.
• To send essential, transactional email only — signup confirmation, password reset, email change, security notifications, and two-factor codes. We do not send marketing email.
• To keep the service secure and diagnose faults.

Legal bases (GDPR): performance of our contract with you (Art. 6(1)(b)) for the service and billing; our legitimate interest (Art. 6(1)(f)) in security and fault diagnosis; and your consent where you opt in to optional features such as email two-factor authentication.

4.Who can see your vault

Your vault is private by default. Every table in our database is protected by row-level security rules, so your data is only ever returned to your own authenticated session — other users cannot query it.

Our team does not browse or read user vaults. Limited administrative access to the underlying database exists, as it does for any hosted service, and is used only where strictly necessary: to resolve a support issue at your request, to investigate abuse or a security incident, or to comply with a legal obligation. We never access your content for any commercial purpose.

Sharing is entirely in your hands. If you create a share link (view-only or view-plus-notes, for your whole vault or a scoped part of it), anyone holding that link can see exactly what the link covers — so treat share links like the content itself. You can revoke any link at any time from inside the app, which cuts off access immediately.

5.Our processors (who handles data on our behalf)

We deliberately keep the list short. These providers process data strictly to run Marginalia, under their own GDPR-compliant data processing terms:

Where a provider processes data outside the EEA (for example, some Stripe or Netlify infrastructure), transfers are covered by recognised safeguards such as the EU Standard Contractual Clauses.

6.Cookies & local storage

We use no advertising or analytics cookies. The browser storage we do use is strictly necessary or functional:

• Authentication session — keeps you signed in (Supabase auth token).
• Preferences — your theme and display-performance choice.
• Trusted device — if you enable email 2FA, a local flag remembers this device for 30 days so you aren't asked for a code on every sign-in.

Because none of this is used for tracking or advertising, no cookie consent banner is required — there is simply nothing to consent to.

7.Retention & deletion

We keep your data for as long as your account exists, because the service is the data — your journal has no value to you if we delete it early. If you want your account and all of its content permanently deleted, email support@marginalia.trade from your account address and we will erase your account data without undue delay, except for the minimal records we are legally required to keep (for example, invoicing records held by Stripe for tax law).

8.Your rights (GDPR)

You have the right to access the personal data we hold about you, to rectify it, to erase it, to restrict or object to processing, and to data portability. To exercise any of these, email support@marginalia.trade. We will respond within one month.

You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Irish Data Protection Commission (dataprotection.ie), though you may complain to the authority in your own EU member state.

9.Security

• All traffic is encrypted in transit (TLS/HTTPS).
• Passwords are hashed — never stored or visible in plain text.
• Row-level security is enforced at the database layer, not just in the app.
• Optional email two-factor authentication with 30-day device trust.
• Subscription state is written only by verified Stripe webhooks — it cannot be forged from a browser.

No online service can promise absolute security, but if we ever become aware of a personal-data breach that risks your rights, we will notify the Data Protection Commission and affected users as the GDPR requires.

10.Children

Marginalia is not directed at children and is not intended for anyone under 16. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.

11.Changes to this policy

If we make material changes, we will update the date at the top of this page and, for significant changes, notify you by email or in the app before they take effect.

Terms of Service

1.The service

Marginalia is a personal trading journal: a place to log trades, write pre- and post-market notes, run backtest journals, and view statistics computed from the data you enter. It is provided as a web application at marginalia.trade.

2.Your account

• You must provide a valid email address and keep your credentials secure. You are responsible for activity under your account.
• You must be at least 16 years old (or the age of digital consent in your country, if higher).
• One account is for one person. Don't share credentials; use share links instead — that's what they're for.
• We may require email verification and offer optional two-factor authentication; we recommend enabling it.

3.Plans, billing & cancellation

Free plan. The Free plan includes the core journal with usage limits (shown on the pricing page). Limits may be adjusted over time; we won't retroactively delete content that was within the limits when you created it.

Pro subscription. Pro is a monthly subscription billed through Stripe at the price shown at checkout. It renews automatically each month until cancelled.

• Cancel anytime — in one click from Settings, or through the Stripe billing portal. Cancelling stops the next renewal; you keep Pro access until the end of the period you've already paid for. You can resume just as easily.
• Payments are processed by Stripe. By subscribing you also agree to Stripe's terms for payment processing. We never see or store your card details.
• Immediate access. Pro features unlock the moment your payment succeeds. By subscribing, you request immediate performance of the service and acknowledge that, once the service has been fully provided for a billing period, the EU 14-day withdrawal right no longer applies to that period. This does not affect your statutory rights, and you can always stop future renewals.
• Price changes. If the Pro price changes, we'll notify you in advance by email or in the app; the new price applies from your next renewal, and you're free to cancel before it takes effect.
• Access codes are promotional grants of Pro. They can carry a duration and usage limit, are non-transferable once redeemed, have no cash value, and a code may be deactivated for new redemptions at any time (existing redemptions keep their granted time).
• When Pro ends, your account returns to the Free plan. Content above Free limits isn't deleted, but creating new content may be limited and Pro-only features (such as Advanced Statistics) become unavailable until you upgrade again.

4.Your content

You own your journal. Everything you put into Marginalia — trades, notes, screenshots, backtests — remains yours. You grant us only the limited licence needed to host, store, process, and display that content back to you (and to anyone you share it with), solely to operate the service.

You are responsible for what you upload. Don't upload content you have no right to use, and don't upload other people's personal data without their permission.

5.Sharing

Share links are created by you, scoped by you, and revocable by you. Anyone with a link can view what the link covers, so you are responsible for who you give links to. Revoking a link takes effect immediately. We are not responsible for copies made by viewers while a link was active.

6.Acceptable use

• No attempts to breach, probe, or circumvent security or access controls, including plan limits and row-level security.
• No use of the service to store or distribute unlawful content, malware, or other people's confidential data.
• No scraping, reselling, or offering the service to third parties as your own.
• No abuse of infrastructure (excessive automated load, spam via share links, and similar).

We may suspend or terminate accounts that violate these rules. Where practical, we'll warn you first.

7.Availability, changes & data

We work hard to keep Marginalia fast and available, but the service is provided "as is" and "as available", without warranties of uninterrupted operation. Features may evolve, be added, or be retired; we won't remove a core capability you've paid for mid-billing-period without a remedy.

We take data durability seriously and rely on professionally managed, replicated infrastructure — but you should not treat any online service as your only copy of irreplaceable records. Keep your own copies of critical screenshots and documents.

8.Liability

To the fullest extent permitted by law: we are not liable for indirect or consequential losses, lost profits, or trading losses of any kind; and our total aggregate liability arising from the service is limited to the amount you paid us in the 12 months before the claim arose (or €15 if you've paid nothing). Nothing in these terms excludes liability that cannot be excluded under applicable law, and nothing affects the statutory rights you hold as a consumer in your country of residence.

9.Termination

You can stop using Marginalia at any time and request account deletion as described in the Privacy Policy. We may terminate or suspend accounts for material breach of these terms. On termination, your right to use the service ends; deletion of your data follows the Privacy Policy.

10.Governing law

These terms are governed by the laws of Ireland. If you are a consumer in the EU, you also benefit from any mandatory protections of the law of your country of residence, and you may bring proceedings in your local courts.

11.Changes to these terms

We may update these terms as the service evolves. For material changes we'll give notice by email or in the app before they take effect; continuing to use the service after that date means you accept the updated terms. The current version always lives at this page.

12.Contact

Questions about these terms or this policy: support@marginalia.trade.