Privacy Policy

TradeLog NZ (“we”, “us”, “our”) is committed to protecting your personal information. This policy explains what information we collect, how we use it, and your rights under the Privacy Act 2020 (New Zealand).

By using TradeLog NZ, you agree to the collection and use of information as described in this policy.

1. Who we are

TradeLog NZ is a New Zealand-based software service that provides trading journal and tax calculation tools for New Zealand active traders. We are not a financial adviser, tax agent, or registered financial service provider. Our service is a calculation and record-keeping tool only.

Questions about this policy can be sent to [email protected].

2. Information we collect

We collect the following categories of information:

• Account information — name, email address, and password (stored securely via Supabase Auth; we never see your plain-text password).
• Onboarding preferences — instruments traded, primary broker, estimated other income, whether trading is your primary income source. This is used solely to pre-configure your tax calculations.
• Trade records— instrument, direction, dates, prices, P&L, and exchange rates that you enter or import. This data is stored on your account and never shared with third parties.
• Expense records — business expense categories and amounts you enter for tax deduction purposes.
• Usage data — pages visited, features used, and errors encountered, collected via PostHog analytics. This data is anonymised where possible and used only to improve the product.
• Payment information — subscription and billing details are handled entirely by Stripe. We do not store your credit card number or bank account details. See Stripe’s Privacy Policy.

3. How we use your information

We use your information to:

• Provide the TradeLog NZ service and calculate your NZ tax estimates.
• Send transactional emails (e.g. subscription receipts, payment failure notifications) via Resend.
• Respond to support requests and feedback you submit.
• Improve product features and fix bugs using anonymised analytics.
• Comply with legal obligations.

We do not sell your personal data to third parties. We do not use your trade data for advertising or share it with any financial institution.

4. Does TradeLog NZ share your data with IRD?

No. TradeLog NZ has no connection to Inland Revenue. We do not report your trades, profits or account data to IRD, and we have no automated link to IRD systems of any kind.

Your data flows one way. TradeLog calculates your tax figures and gives them to you — in the app, in your PDF report, or via a share link you choose to send to your accountant. You then file your own IR3 through myIR. Our tax report is a calculation summary, not a return, and cannot be submitted to IRD.

We are not a reporting entity under the OECD Crypto-Asset Reporting Framework (CARF). CARF obligations fall on crypto-asset service providers that execute transactions or hold assets for customers. TradeLog NZ does neither — it is a record-keeping and calculation tool.

The one exception, which applies to every New Zealand business including your accountant: if we receive a lawful, binding legal demand (for example under Inland Revenue's information-gathering powers in the Tax Administration Act 1994), we are legally required to comply. We have never received such a demand. Absent that, your trading data stays yours.

5. Broker account connections (optional)

TradeLog NZ lets you optionally connect a broker account (currently cTrader brokers — such as BlackBull, Pepperstone and IC Markets — and OANDA) so your closed trades import automatically instead of by CSV. This is entirely optional. If you never connect a broker, none of the following applies to you.

• What we store — the access credential your broker issues for the connection (an OAuth token for cTrader; the personal API token you paste for OANDA). Credentials are encrypted at rest (AES-256-GCM) and are never displayed back to you or shared with anyone.
• cTrader— you authorise TradeLog through cTrader’s own login screen, granting the read-only “accounts” (view-only) permission. You are never asked for your cTrader password, and the permission granted cannot place trades.
• OANDA — you generate a personal API token in your OANDA account and paste it in. Note that OANDA issues one type of token that technically carries full account access — TradeLog only ever uses it to read your trade history and never calls any trade or funds endpoint. You can revoke the token at any time from your OANDA account, which immediately and permanently cuts our access.
• Disconnecting — you can remove a broker connection at any time in Settings. Removing it deletes the stored credential from our systems. Trades already imported stay in your journal (they are your records) until you delete them.

Broker credentials are never sold, never used for advertising, and never shared with any third party or financial institution. They are used only to import your trades into your own account.

6. Data storage and security

Your data is stored in Supabase (hosted on AWS in the ap-southeast-2 Sydney region). All data is encrypted at rest and in transit (TLS 1.2+). Row-level security policies in our database ensure each user can only access their own data.

We use industry-standard security practices, including access controls, audit logging, and regular security reviews. However, no system is perfectly secure. If you believe your account has been compromised, contact us immediately at [email protected].

7. Data retention

We retain your personal data for as long as your account is active. If you delete your account, we will permanently delete all your trade records, tax calculations, and profile data within 30 days, except where we are required by law to retain it longer.

Anonymised, aggregated usage analytics may be retained indefinitely as they cannot be linked back to you.

8. Your rights under the Privacy Act 2020

Under the Privacy Act 2020 (NZ), you have the right to:

• Access your personal information — request a copy of all data we hold about you.
• Correct your personal information — request we correct any inaccurate data.
• Delete your account and data — via Account Settings or by emailing us.
• Complain — if you believe we have breached the Privacy Act, you may complain to the Office of the Privacy Commissioner.

To exercise any of these rights, email [email protected]. We will respond within 20 working days as required by the Act.

9. Cookies

We use cookies and similar technologies to maintain your login session (via Supabase Auth), to process payments (Stripe), and — optionally — to collect anonymised analytics (PostHog and Google Analytics). We do not use advertising or cross-site tracking cookies.

Our Cookie Policy names every cookie we set, what it does and how long it lasts, and lets you change your analytics choice at any time. You can also disable cookies in your browser, but this will prevent you from logging in.

10. Third-party services

We use the following third-party services to operate TradeLog NZ:

• Supabase — database, authentication, file storage
• Stripe — payment processing and subscription management
• Resend — transactional email delivery
• PostHog — anonymised product analytics
• Railway — website hosting and deployment
• RBNZ — publicly available exchange rate data (no personal data shared)
• cTrader (Spotware) — read-only broker connection, only if you connect a cTrader account
• OANDA — read-only broker connection, only if you connect an OANDA account

Each provider is bound by their own privacy policy and data processing agreements. We select providers that meet adequate data protection standards.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified via the in-app announcement banner or by email at least 7 days before taking effect. Continued use of the service after the effective date constitutes acceptance of the updated policy.

12. Contact

For any privacy questions or data requests, contact us at [email protected].