In short: we collect only what we need to run your journal. Your journal is private to you. Your charts are not sent to outside AI services. We use essential cookies only, and we do not sell or share your personal information. You can export or delete everything at any time.
1. Who we are
Zanshin is operated by ZanshinTraders ("we", "us"), 29270 Three Notch Rd, Unit A, Mechanicsville, MD 20659. We are the controller of the personal information described here. This policy covers the Zanshin website, the web app, the installable phone (home-screen) app, the Windows desktop app and the Zanshin Support assistant. All of the apps use the same account. For any privacy question or request, contact zanshinfounder@zanshintraders.com.
[Lawyer: add an EU/UK representative or a DPO here if one is required.]
2. What we collect
- Account: your email address, your username, a hash of your password (never the password itself), confirmation that you are 18 or older, whether your email is confirmed, and your sign-in preference ("Keep me signed in").
- Journal content you add: trades (symbol, direction, prices, size, P&L, setup, notes, how you felt), chart screenshots, checklist answers, the bot verdicts, process scores and Performance Insights generated from them, goals, milestones, check-ins and playbook settings.
- Plan and billing: your plan, trial dates, billing interval (monthly or yearly), subscription status and the customer ID Stripe gives us. We never receive or store your card number.
- Discord (only if you join): your Discord user ID. See section 6.
- Push notifications (only if you turn them on): your device's push subscription and your reminder time.
- Support: messages you send to Zanshin Support and the contents of support tickets.
- Security and technical data: IP address, browser and device type, sign-in times, active sessions, and security and audit events, such as failed sign-ins, password changes and admin actions.
Screenshots uploaded to the public live demo, without an account, are analysed and then discarded. They are not stored in any journal.
3. How we use it
- To run the Service: store your journal, run the bot council on your screenshots, calculate scores and insights, show your calendar and goals, and keep you signed in across your devices.
- To manage your trial, plan and payments, and to apply the Refund Policy.
- To send service emails: email confirmation, password resets, receipts, trial and renewal reminders, the Premium weekly review email, and important notices. We do not send marketing email unless you opt in.
- To send the push reminders you have turned on.
- To answer support requests.
- To keep Zanshin secure: preventing fraud, abuse and repeated free trials, rate-limiting sign-in attempts and investigating incidents. Also to meet our legal obligations.
The bot council runs on our own servers. Your screenshots and journal are not sent to outside AI services, not used to train third-party models, and not used for advertising. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. The bots' scores are for your own self-review.
4. Legal bases
Where laws such as the GDPR or UK GDPR apply, we rely on these legal bases:
- Contract: to provide your account, journal, bots, trial, subscription, support and service emails.
- Legitimate interests: to keep the Service secure, prevent abuse and fraud, keep security logs, and improve reliability. We balance these interests against your rights.
- Consent: for push notifications, which you turn on yourself and can turn off at any time, and for any optional marketing email.
- Legal obligation: to keep tax and payment records and to respond to lawful requests.
5. Sub-processors and sharing
We share personal information only with these service providers. They process it on our instructions, only for the purposes below:
| Provider | Purpose | Data involved |
|---|---|---|
| Stripe | Payments, subscriptions, invoices and the billing portal | Email, billing details and payment method. Card data is collected by Stripe directly. |
| Resend | Sending service emails | Email address and the email content |
| Hosting provider: [Fly.io or Oracle Cloud] | Running the app and storing data and backups | All Service data |
| Discord | The Premium community, only if you join it | Discord user ID, used to assign the Premium role |
| Browser push services (Apple, Google, Mozilla) | Delivering push notifications you turned on | Push subscription and the notification text |
We do not sell or share your personal information for money, for advertising or for cross-context behavioural advertising. We may disclose information if the law requires it, to protect the rights or safety of our users or others, or to a successor in a merger or sale of the business. In that case, this policy continues to apply to your data.
6. Discord
If you are a Premium member and choose to connect your Discord account, we store your Discord user ID and use it only to give or remove the Premium role. We do not read your Discord messages, servers or contacts. What you post in the Discord server is governed by Discord's terms and privacy policy, and other members can see it. Disconnecting Discord or deleting your account removes the stored ID.
7. Push notifications
Push notifications are opt-in. You turn them on in Settings → Reminders and allow them when your device asks. You can turn them off at any time in the same place or in your device settings. When you do, we delete the push subscription for that device.
8. Cookies and local storage
We use essential cookies only: a session cookie and a security (CSRF) cookie. With Keep me signed in, the session cookie lasts up to 30 days. Otherwise it ends when you close the browser or app. Local storage holds only interface preferences. We use no advertising, analytics or tracking cookies. See the Cookie Policy for details.
9. Third-party content and links
- Daily quotes come from Wikiquote under the Creative Commons Attribution-ShareAlike licence (CC BY-SA), with the speaker and source shown.
- Podcast links in the inspiration feed open third-party sites and players, which have their own privacy policies.
10. How long we keep data
| Data | Kept for |
|---|---|
| Account and journal data (trades, screenshots, goals, settings) | Until you delete them or your account. It is kept if a paid plan or a trial ends, on the free plan. |
| Deleted accounts | Removed immediately from the live service. Copies inside encrypted backups expire within 30 days. |
| Accounts never confirmed by email | 7 days |
| Backups (encrypted) | 30 days |
| Security and audit logs | 2 years. IP addresses in them are shortened (last part removed) after 90 days. |
| Blocked IP addresses (attack protection) | 90 days after the block ends |
| Sign-in sessions | Until they expire: 12 hours, or 30 days with "Keep me signed in" |
| Email links and sign-in codes | 1 day after they expire |
| Support tickets | 2 years after the ticket is opened, if closed. Detached from your account if you delete it. |
| Payment, invoice and tax records | As long as tax and accounting law requires. Held by Stripe; these records contain no journal content. |
| Live-demo screenshots | Discarded straight after analysis |
11. International transfers
We and our providers may process data in the United States and other countries whose data-protection laws differ from yours. Where the law requires it, for example for data from the EEA or UK, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, the UK Addendum, or an adequacy decision or certified framework. Contact us for a copy of the relevant safeguards. [Lawyer: confirm the transfer mechanisms and the hosting region.]
12. Your rights
Wherever you live, you can:
- Access your data. Most of it is visible in the app, and you can ask us for a copy.
- Correct it. Edit your data in the app, or ask us.
- Delete it: Settings → Your data → Delete account, or email us.
- Export it: Settings → Your data → Export my data. Choose a ZIP with all your chart screenshots, or the data alone as JSON. We ask for your password first and email you when an export is downloaded.
- Object to processing based on legitimate interests, and ask us to restrict processing.
- Withdraw consent at any time, for example by turning off push notifications.
To make a request, email zanshinfounder@zanshintraders.com from your account email address. We may need to verify your identity first. We will respond within the time the law requires, usually within one month. Exercising your rights is free, and we will not treat you differently for doing so.
13. EEA and UK residents (GDPR / UK GDPR)
You have the rights listed in section 12, including data portability. The legal bases we rely on are in section 4. You can complain to your local data-protection authority, such as your EU member state's supervisory authority or, in the UK, the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to resolve your concern first.
14. California residents (CCPA / CPRA)
- Categories collected in the last 12 months: identifiers (email, username, IP address), commercial information (plan and payment history), internet activity (sign-in and security logs), and your journal content, including the trading information you enter. We collect these from you and your devices, for the business purposes described in section 3, and disclose them only to the service providers in section 5.
- Sensitive personal information: account sign-in credentials, used only to authenticate you. We do not use or disclose sensitive information for any purpose that would give you the right to limit it.
- We do not sell or share personal information, as the CCPA defines those terms, and we have not done so in the last 12 months. We do not knowingly sell or share the information of anyone under 16. Because of this, we do not offer a "Do Not Sell or Share My Personal Information" link: there is nothing to opt out of. We do not use tracking that would require us to respond to Global Privacy Control signals, and we treat those signals as an opt-out anyway.
- Your rights: to know, access, correct and delete your personal information, and not to be discriminated against for using these rights. You may use an authorised agent, and we may ask the agent to prove its authority.
- Retention periods are in section 10.
14a. Health information (HIPAA)
Zanshin is not a healthcare provider, health plan or healthcare clearinghouse, and is not a business associate of one, so the U.S. Health Insurance Portability and Accountability Act (HIPAA) does not apply to the Service. Zanshin is not designed to store health information. Please do not enter medical or health information in your journal, goals or support messages. If you do, it is handled like the rest of your journal data under this policy, never shared or sold, and you can delete it at any time.
15. Children
Zanshin is not for anyone under 18. Users must confirm at sign-up that they are 18 or older. We do not knowingly collect personal information from minors. If we learn that an account belongs to someone under 18, we will close it and delete its data. If you believe a minor has an account, contact us.
16. Security and breach notification
- Passwords are stored as strong one-way hashes.
- All connections are encrypted in transit (HTTPS), and data is stored encrypted at rest where our hosting provider supports it.
- Access controls and least-privilege staff access (owner and support roles with separate permissions). Staff accounts must use two-step sign-in, and every customer can turn it on in Settings → Security.
- A tamper-evident, cryptographically chained audit log of security-relevant actions.
- Encrypted backups, kept for 30 days, with a regular restore test.
- Automatic blocking of network addresses that attack the service.
- A strict content security policy, CSRF protection and rate limiting.
- Payments are handled by Stripe, so we never hold card data.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities without undue delay, within the time the law requires (for example, within 72 hours to regulators under the GDPR where it applies). We will tell you what happened and what you can do. To report a vulnerability, see our security policy.
17. Changes to this policy
We may update this policy as Zanshin changes. If we make material changes, we will notify you by email or in the app before they take effect, and update the effective date above. Earlier versions are available on request.
18. Contact and complaints
ZanshinTraders · 29270 Three Notch Rd, Unit A, Mechanicsville, MD 20659 · zanshinfounder@zanshintraders.com
If you are not happy with how we handled your data, please tell us first. You also have the right to complain to a data-protection regulator. In the EEA, that is your local supervisory authority. In the UK, it is the ICO. In California, it is the California Privacy Protection Agency (cppa.ca.gov) or the state Attorney General.