Privacy Policy
Last updated 22 October 2026 · TradingTools Android app and tradingtoolsapp.com
1. Who is the data controller
The TradingTools app (the "App") and the website tradingtoolsapp.com (the "Website") are run by Szymon Surmacz, a private individual based in Poland ("we", "us"). Contact: tradingtoolssupport@pm.me.
In short: the App has no accounts and no cloud. Everything you type stays on your phone. The App connects to the internet only for ads, crash reports, usage statistics, purchases, to download up-to-date prop-firm and broker data from our Website, for live crypto prices in the Amber theme and — if your account currency is not USD — to download exchange rates. Each of these is described below.
2. Data stored only on your device
- Your settings (theme, selected broker, account currency)
- Values entered into the calculators (balance, risk, prices, lot size)
- Prop-firm mode state (account size, balances)
- Your trade journal entries
- The latest downloaded exchange rates and, if you entered one, a manual exchange rate
- The latest downloaded prop-firm presets and broker data
- Your ad consent choices (saved on the phone by Google's consent tool)
- Whether you accepted the disclaimer
This data is never sent to us. If Android backup is turned on for your Google account, Android may include it in your own device backup on Google Drive and restore it when you reinstall the App or set up a new phone; otherwise it is permanently deleted when you uninstall the App. If you export your journal to CSV, the file goes wherever you choose to share it.
3. Data processed when the App goes online
3.1. Exchange rates (National Bank of Poland)
If your account currency is not USD, the App downloads the official average exchange rate table from the National Bank of Poland's public API (api.nbp.pl) about once a week, and again when you change the account currency. This lets you enter and read amounts in your own currency.
The request contains no identifier, no account data and nothing about your trades. As with any internet request, NBP's servers receive your device's IP address and basic technical information. We do not receive or store this data. NBP processes it under its own policy: nbp.pl/link/polityka-prywatnosci. If your account currency is USD, the App does not contact NBP at all.
3.2. Prop-firm and broker data (our Website)
Every few days the App downloads a public data file from tradingtoolsapp.com with the current prop-firm rules and typical broker spreads, so these stay up to date without an app update. The request contains no identifier and nothing you entered in the App. Our hosting server records the request in its standard access log (IP address, time, device type), as described in section 4.1.
3.3. Ads (Google AdMob) and your consent
The free version shows banner ads served by Google AdMob. In the European Economic Area, the United Kingdom and Switzerland, the App first shows Google's consent form (Google's User Messaging Platform, a consent tool certified under the IAB Transparency & Consent Framework). You choose whether Google and its ad partners may store or read information on your device and whether ads may be personalised. Without your consent the App requests no personalised ads; if the form says ads cannot be shown, the App shows none. Outside those regions Google may show personalised ads where local law allows; where US state privacy laws give you a right to opt out, the same form lets you do so.
You can change or withdraw your choice at any time in the App: Settings → Legal & support → Ad privacy choices. Google processes your device's advertising ID, IP address and technical device data to serve and measure ads and to prevent fraud. Premium removes ads completely. See how Google uses data from apps and Google's privacy policy.
3.4. Crash reports (Sentry)
If the App crashes, it sends a technical crash report: the error trace, App version, device model and operating-system version. It also sends a short technical error report when something fails in the background without a crash (for example, an exchange-rate or data download, or the consent form failing to load). The App does not send usage sessions or performance data to Sentry. The App is configured not to send personal data (no names, email addresses or journal contents). Reports are stored by Sentry in the European Union (Germany); your IP address is processed only to deliver the report. See sentry.io/privacy.
3.5. Usage statistics (Google Firebase Analytics)
To learn which features people use, and which to improve or remove, the App sends pseudonymous usage events (linked to a random app-instance identifier, never to your name or email) to Google Firebase Analytics: which screen or calculator was opened, the instrument category or symbol, the theme, whether a trade was added to the journal, and similar feature names. It never sends account balances, amounts, prices, journal notes, names or email addresses. Google also processes an app-instance identifier, your IP address (to derive an approximate country) and technical device data such as model, operating-system and App version.
In the European Economic Area, the United Kingdom and Switzerland, usage statistics are collected only if you allow storing information on your device and measuring content performance in the consent form described in 3.3; otherwise nothing is collected. You can change your choice at any time in Settings → Legal & support → Ad privacy choices. See Google's privacy policy and how Google safeguards Analytics data.
3.6. Subscriptions and purchases (Google Play and RevenueCat)
Premium is a subscription billed by Google Play; earlier buyers may have a one-time purchase. We use RevenueCat to confirm, renew and restore your Premium status and to check whether you qualify for the loyalty price. RevenueCat processes a purchase or subscription identifier, your plan, purchase, renewal and expiry dates, and a random app user ID that is not linked to your name or email. We never see your payment details. See revenuecat.com/privacy.
3.7. Live crypto ticker (Amber theme)
If you choose the Amber theme (in the style of Binance), the App shows a scrolling ticker with public crypto prices. While the ticker is on screen and the App is open, the App downloads these prices about every 30 seconds from Binance's public market-data API (data-api.binance.vision). The request contains no identifier, no account data and nothing you entered in the App. As with any internet request, Binance's servers receive your device's IP address and basic technical information. We do not receive or store this data. Binance processes it as an independent controller under its own policy: binance.com/en/privacy. With any other theme, the App does not contact Binance at all.
4. Data processed by the Website
4.1. Visiting the Website
The Website is hosted by SEOhost.pl in Poland. The hosting server keeps standard access logs (IP address, date and time, requested page and browser type) to keep the Website secure and working. The Website uses no analytics, no tracking cookies and no third-party scripts or fonts. After you join the beta, your browser remembers a simple "already signed up" flag (no personal data) so the form is not shown again.
4.2. Beta sign-up
When you join the beta, we store your email address, the time of sign-up, which form you used, your browser's user-agent string and which version of this notice you agreed to. We then email you a confirmation link; only after you tap it do we send you beta-related messages. We do not store your IP address with your sign-up. We use your email to invite you to the Android beta, which means adding it to the testers list in Google Play Console, and to send you beta-related messages. Joining the testers group on Google Groups and becoming a tester on Google Play happen on Google's own pages, under Google's privacy policy. To block automated sign-ups, the server keeps a one-way hash of your IP address (for IPv6, of its network part) with the time of each attempt; entries older than one hour are deleted at the next sign-up attempt.
Who receives this data: SEOhost.pl (stores the sign-up file on its server), Proton AG (our email provider in Switzerland, which receives a notification with your email address) and Google (when we add your email as a beta tester). We keep sign-up data until 90 days after the beta ends, or until you withdraw your consent, whichever comes first. To withdraw, email tradingtoolssupport@pm.me; we will delete your data and remove you from the testers list.
4.3. Launch list
On tradingtoolsapp.com/launch you can join a separate list to be told when TradingTools becomes publicly available on Google Play. We store your email address, the time, which form or campaign link you came from, your user-agent (only against abuse), which phone you use (Android or iPhone) and which version of this notice you agreed to. We email you a confirmation link and, once you confirm, send you one email when the App launches publicly on your platform. We do not store your IP address with your sign-up. The same providers as in section 4.2 receive this data (SEOhost.pl, Proton AG). We delete the list 90 days after the public launch, or earlier if you withdraw your consent by emailing tradingtoolssupport@pm.me.
5. Legal basis (GDPR)
- Performance of a contract (Art. 6(1)(b) GDPR): providing App features, including exchange-rate conversion and the live price ticker in the Amber theme, and providing, renewing and restoring your Premium subscription or purchase
- Legitimate interest (Art. 6(1)(f) GDPR): crash reports, usage statistics outside the EEA, UK and Switzerland, keeping prop-firm and broker data up to date, Website security logs and preventing sign-up abuse. Where Google relies on legitimate interest for some ad purposes, you can object in the consent form.
- Consent (Art. 6(1)(a) GDPR, and the ePrivacy rules on storing information on your device): ads and usage statistics in the EEA, UK and Switzerland as chosen in the consent form, beta sign-up and beta emails, and the launch list. You can withdraw consent at any time without affecting earlier processing.
6. Transfers outside the EEA
Google and RevenueCat are based in the United States. Transfers to them rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses, as described in their policies. Proton AG is in Switzerland, which the European Commission recognises as providing adequate protection. Sentry stores our crash reports in Germany, and NBP and SEOhost.pl are in Poland. Binance, which serves the crypto ticker described in 3.7, operates outside the EEA; it receives only the technical connection data described there.
7. Your rights
- Right of access, rectification and erasure
- Right to restrict processing and to data portability
- Right to object to processing based on legitimate interest
- Right to withdraw consent at any time
- Right to lodge a complaint with the President of the Personal Data Protection Office (UODO, Poland) or the authority in your country
Send requests to tradingtoolssupport@pm.me. We reply within 30 days. Because the App keeps your data only on your phone, uninstalling it deletes that data, except for any copy in your own Android device backup, which you control in your Google account settings.
8. How long we keep data
- On-device data: until you uninstall the App (and, if Android backup is on, in your own Google device backup until you delete it)
- Ad consent choices: on your phone until you change them or uninstall the App
- Hashed IP addresses used against sign-up abuse: one hour, deleted at the next sign-up attempt after that
- Launch list: until 90 days after the public launch, or until you withdraw consent
- Crash reports: up to 90 days, then deleted automatically
- Usage statistics (Firebase Analytics): up to 14 months (our Google Analytics retention setting), then deleted automatically by Google
- Subscription and purchase records (RevenueCat, Google Play): while your subscription is active and afterwards as long as needed to restore it and as required by tax and accounting law
- Beta sign-up data: until 90 days after the beta ends, or until you withdraw consent
- Website access logs: for the period set by the hosting provider
- Your advertising ID can be reset or deleted in your phone's settings (Android: Settings → Google → Ads)
9. Children
The App and the Website are not directed to children under 16, and we do not knowingly collect their data. If you believe a child has signed up for the beta, contact us and we will delete the data.
10. Changes to this policy
We publish every change on this page and update the date at the top. If a change affects how the App uses your data, we will also mention it in the release notes on Google Play.