Privacy Policy

Last updated: 1 October 2026

Killzonda (“Killzonda”, “we”, “us”) is a web-based journal and analytics tool for futures day traders, operated by Killzonda LLC, based in North Carolina, United States. This Privacy Policy describes how we collect, use, store, disclose, and protect information about you when you visit killzonda.com or use the Killzonda application (together, the “Service”).

For the purposes of the EU and UK General Data Protection Regulation (“GDPR”), Killzonda LLC is the “data controller” of your personal information.

1. Information we collect

1.1 Information you provide to us

• Account information. When you create an account, we collect your email address and a password. Your password is stored only as a salted cryptographic hash by our authentication provider (Supabase); we never see or store it in readable form.
• Content you create in the Service. Everything you log: trades and their details (for example setup, instrument or fund, direction, result, points, profit and loss, position size, stop and target, risk-to-reward, time in trade, session, day of week, liquidity and draw-on-liquidity notes, maximum adverse and favourable excursion, ratings, and whether you followed your rules), no-trade days, your written notes and reviews, your trading rules and checklists, prop-firm purchase and payout entries, and any chart screenshots you attach. Screenshots are resized and compressed in your browser and then stored as part of your trade records.
• Billing information. Subscriptions are processed by Stripe. When you subscribe, you provide your payment card details directly to Stripe. Killzonda does not receive or store your card number. We store a Stripe customer identifier, a subscription identifier, your plan, your subscription status, and trial/renewal dates so we can give you access to paid features. Stripe may share limited billing metadata with us (for example the last four digits and card brand, country, and billing postal code) to display in your billing settings.
• Communications. If you email us for support or any other reason, we keep the message and our reply.

1.2 Information collected automatically

• Log and technical data. Like any website, our hosting infrastructure records standard request logs: your IP address, browser type and version, device and operating system, the pages or endpoints you request, referring URLs, and date/time stamps. We use these for security, debugging, and keeping the Service running.
• Error reports. If part of the app fails in your browser, we record the error message, its technical stack trace, the page path where it happened, your browser and operating system version, and your account identifier if you are signed in. We use these only to find and fix faults. We record the page path only — never the full web address, which can contain sign-in tokens — and we do not record form contents or your trade data in an error report.
• Authentication tokens. When you sign in, your browser stores a session token so you stay signed in. Signing out clears it.
• Local preferences. The app stores a small amount of data in your browser’s local storage, for example your custom tag options and interface state such as dismissed reminders. This never leaves your device and is not sent to us.

2. Information we do not collect

• We do not connect to your broker and do not collect broker credentials, account numbers, or automated trade feeds. All trade data is entered by you.
• We do not receive or store your full payment card number, CVC, or full bank details.
• We do not use third-party advertising networks, ad trackers or cross-site tracking pixels, and we do not build advertising profiles.
• We use three measurement tools on our public pages, and none of them advertises to you. Cloudflare Web Analytics counts visits to our public pages. It sets no cookie, assigns no identifier, and cannot follow you to any other website, reporting only aggregate figures: page visited, referring site, country, browser and device type. Google Analytics measures how the site and the app are used: pages viewed, referring site, approximate location worked out by Google from your IP address, and browser and device type. Outside the EEA, the United Kingdom and Switzerland it sets its own cookies to recognise a returning browser; inside them it is configured to run without cookies and without an identifier. Google's advertising features are switched off for everyone, so nothing here builds an advertising profile. Neither tool is ever sent your name, your email address, your account identifier or anything you write in your journal, and web addresses are stripped of sign-in and password-reset tokens before they are sent. Microsoft Clarity runs on our marketing page only - never inside the app - and shows us how that page is used: where people click, how far they scroll, and a replay of the mouse movement and clicks of a visit, so we can see which part of the page loses people. It records that page and nothing else: it is not present on your journal, on the sign-in screen, or inside the demo window embedded on the marketing page, so it never sees a trade, a figure or a note. It sets its own cookies, and for that reason it does not run at all for visitors in the EEA, the United Kingdom or Switzerland.
• We do not knowingly collect information from anyone under 18.

3. How we use information

• Provide the Service: create and secure your account, store and display your journal, compute your metrics and calendar, and run the trade filter.
• Billing: start and manage your subscription and free trial, process payments through Stripe, and show your billing status.
• Service communications: send account and transactional emails such as password reset links and, if applicable, billing notices. These are not marketing.
• Support: respond to your questions and troubleshoot issues.
• Security and integrity: detect, investigate, and prevent fraud, abuse, unauthorised access, and technical problems.
• Legal compliance: comply with applicable law and respond to lawful requests, and establish, exercise, or defend legal claims.
• Product improvement: understand aggregate, non-identifying usage patterns (for example error rates) to fix and improve the Service.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

4. Legal bases for processing (EEA / UK users)

5. How information is shared and processed

We do not sell or rent your information. We share it only with the service providers below, who process it on our behalf and under contract, and in the limited circumstances that follow.

Our providers may update their own subprocessors from time to time. We also may disclose information:

• To comply with law, in response to a valid subpoena, court order, or other lawful request, or where disclosure is necessary to protect rights, safety, or property.
• In a business transfer, if Killzonda is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you and honour the commitments in this Policy.
• With your direction, for example, if you ask us to send a copy of your data to you or a third party.

6. Local storage and cookies

Killzonda does not use advertising cookies. We use the following browser storage:

• Authentication token, set when you sign in, so you remain signed in; cleared when you sign out.
• Local preferences, small values such as custom tag options and dismissed in-app reminders, stored on your device only.
• Analytics cookies, set by Google Analytics only for visitors outside the EEA, the United Kingdom and Switzerland (_ga and _ga_C9FSBXLV2Y). They hold a random number and no personal detail, they let us tell a returning browser from a new one, and they expire after two years. They are not strictly necessary, and blocking them leaves the Service working exactly as it does now.
• Session-measurement cookies, set by Microsoft Clarity on our marketing page only for visitors outside the EEA, the United Kingdom and Switzerland (_clck and _clsk). They hold a random number so that two page views can be recognised as one visit. They are not strictly necessary, and blocking them leaves the Service working exactly as it does now.

No cookie-consent banner is presented, and here is exactly why. In the EEA, the United Kingdom and Switzerland, Google Analytics is configured to run without cookies and without an identifier, and Microsoft Clarity does not load at all, so nothing is stored on your device that would need your permission. Everywhere else, the analytics and session-measurement cookies above are set when you arrive.

You can refuse or delete them at any time in your browser settings; most browsers also block Google Analytics under their own tracking protection, and Google publishes an opt-out add-on at tools.google.com/dlpage/gaoptout. Nothing about the Service changes if you do. If we ever add a cookie that does require your consent, we will ask for it before setting it.

7. Data retention

• We keep your account information and journal content for as long as your account is active.
• If you delete your account, we delete your journal content and account record from our live systems within 30 days. Residual copies may persist in encrypted backups for up to 30 days before being overwritten on our provider’s backup rotation.
• Billing and transaction records held by Stripe, and any records we must keep for tax, accounting, or legal-compliance reasons, are retained for the period required by applicable law.
• Server logs are retained for a short period for security and debugging and then rotated out.

8. Security

We take reasonable and appropriate measures to protect your information, including:

• Encryption in transit using HTTPS/TLS for all connections to the Service.
• Passwords stored only as salted hashes.
• Database access controls that isolate each account’s data at the row level, so one user cannot read another user’s entries.
• Server-side handling of billing writes using restricted credentials.
• Secrets and keys stored as environment variables, never in application code.

No method of transmission or storage is completely secure. You are responsible for keeping your password confidential and for signing out on shared devices. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities as required by law.

9. International data transfers

We and our providers are located in, or process data in, the United States, Canada, and other countries. If you are in the EEA, the UK, or Switzerland, your information may be transferred to countries that do not provide the same level of data-protection law as your own. Where we do this, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), which Supabase, Stripe, and our other providers make available. You may request a copy of the relevant safeguards by contacting us.

10. Your rights and choices

Everyone. You can, at any time:

• Access and review your data, it is all visible in the app.
• Obtain a copy of your data. On request we will provide your trades and no-trade days in a structured, machine-readable format.
• Correct your data, edit or delete any trade, note, or entry directly.
• Delete your account, contact us at support@killzonda.com and we will delete your account and journal content as described in Section 7.
• Manage billing, cancel your subscription at any time from the billing portal in the app.

EEA / UK / Switzerland. In addition to the above, you have the right to: restrict or object to certain processing; request data portability; withdraw consent where we rely on it (without affecting prior processing); and lodge a complaint with your local data-protection supervisory authority. We will not discriminate against you for exercising any of these rights.

To exercise any right, email support@killzonda.com. We will respond within the time required by applicable law (generally within 30 days). We may need to verify your identity first.

11. California privacy rights

If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it (described above), to request access to and deletion of your personal information, to correct inaccurate personal information, and not to be discriminated against for exercising these rights.

We do not “sell” your personal information and do not “share” it for cross-context behavioural advertising, as those terms are defined under California law. The categories of personal information we collect are: identifiers (email, IP address), customer records and commercial information (subscription and billing details), internet activity (server logs), and the content you choose to store in your journal. To make a request, email support@killzonda.com.

12. Children’s privacy

The Service is intended for adults and is not directed to children. You must be at least 18 years old to create an account. We do not knowingly collect personal information from anyone under 18 (or under 16 in the EEA/UK). If you believe a child has provided us information, contact us and we will delete it.

13. Third-party links

The Service may link to third-party websites (for example broker or prop-firm sites, or payment pages hosted by Stripe). We are not responsible for the privacy practices of those sites. Review their policies before providing information.

Killzonda is a journaling and analytics tool. It is not a broker or investment adviser, and nothing in the Service is financial or trading advice. Please also read our Terms of Service and risk disclaimer.

14. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will post the updated Policy here with a new “Last updated” date and, where appropriate, notify you by email or in the app before the changes take effect. Your continued use of the Service after an update means you accept the revised Policy.

15. How to contact us

Questions, requests, or complaints about this Policy or your information:
Email: support@killzonda.com
Operator: Killzonda LLC
Postal address: Available on request by email.