Scope
This Privacy Policy describes how Strikepad collects, uses, and protects the personal information of its users and of people who request beta access. The Service is offered exclusively to U.S. residents who are at least 18 years old; this policy describes their rights under California law, including the California Consumer Privacy Act ("CCPA").
Information We Collect
When you create an account: your email address, an optional display name you choose, and a bcrypt hash of the password you set (the plaintext password is never stored).
When you use the Service: the IP address and user-agent string sent by your browser (used for security and abuse mitigation), an audit log of consent events and sensitive account actions, and any trade data you import — including options-trade executions, reconstructed positions and position events, brokerage account identifiers (account numbers and the four-character account-type metadata your broker provides). Strikepad does not store the OAuth tokens used to connect to brokers — those are held by SnapTrade (see § Third-Party Service Providers).
Cookies: a strictly-necessary session cookie (and its CSRF companion) used to keep you signed in. The Service uses no analytics, tracking, or advertising cookies.
For historical money-back guarantee requests: a keyed cryptographic hash (HMAC) of the payment-method fingerprint of the refunded charge and of the stable identifiers of the brokerage accounts linked at that moment. These existing hashes support retained refund records and the once-per-person limit under previously accepted terms; the underlying card and account numbers themselves are not part of the record.
When you submit the beta access-request form on the marketing site (strikepad.io/contact-us): the name, email address, broker names, trading-style description, and any notes you enter, together with the submitting IP address and its country. These details are delivered to Strikepad as an email (see § Third-Party Service Providers) and are used solely to evaluate and send beta invites.
How We Use Your Information
Strikepad uses your information solely to operate the Service for you: to authenticate you, to render the analytics and journals you import, to reconstruct positions from your fills, to fetch market quotes for the option contracts you hold, to honor your privacy requests, and — when you submit the beta access-request form — to evaluate and send beta invites. Strikepad sends transactional email only: account verification, password reset and security notices, and billing and legal notices — subscription confirmations, receipts, renewal reminders, refund confirmations, and notices of price or Terms changes. It is never used for marketing or third-party promotion.
Strikepad does not sell or rent your personal information to anyone, does not profile users for advertising, and does not share your information with third parties except as described in § Third-Party Service Providers.
Third-Party Service Providers
Strikepad uses the following named service providers ("processors"). Each receives only the information needed to perform its role:
SnapTrade — a brokerage-aggregation service that connects to your broker on your behalf. SnapTrade receives an opaque per-user identifier, the OAuth tokens issued by your broker (held by SnapTrade, never visible to Strikepad), and your brokerage activity history. SnapTrade's own privacy policy at https://snaptrade.com/privacy-policy describes its practices.
Cloudflare — operates the edge network in front of the Service, the Tunnel that reaches the application server, the Access gate used during private beta, and the Turnstile bot-mitigation widget on the registration and login forms and on the marketing site's beta access-request form. All traffic to the Service passes through Cloudflare's edge, where TLS terminates, so Cloudflare processes requests — including their contents — in transit as part of operating the network. The beta access-request form goes further: it is handled entirely at the Cloudflare edge, which delivers that form's contents to Strikepad by email.
Tradier — supplies market quotes for the option contracts you hold. Tradier receives only the option-contract symbols Strikepad asks it to price; it does not receive your identity or trade history.
Stripe, Inc. — processes subscription payments. Stripe receives your name, email address, billing address, and payment-card details (which Strikepad never sees), and returns to Strikepad only the subscription status, the last four digits and brand of the card, and, for historical guarantee requests, a hashed card fingerprint retained with the refund record. Stripe's privacy policy at https://stripe.com/privacy describes its practices.
Resend — delivers the transactional email described above; it receives your email address and the content of each message.
Better Stack — receives the Service's server logs, which can include your IP address and the paths you requested, for operational monitoring; logs are retained for approximately ninety (90) days.
Hetzner Online GmbH — provides the virtual-private-server infrastructure on which the Service runs.
Coolify — the self-hosted deployment platform that orchestrates the Service on the Hetzner host.
Google (Gmail) — the mailbox provider where Strikepad receives support email and beta access requests. The contents of emails you send to support@strikepad.io, and of beta access-request form submissions (which are delivered as email), are stored in that mailbox. Google's privacy policy at https://policies.google.com/privacy describes its practices.
Retention
Strikepad retains your account information, trade data, and audit-log rows for the life of your account. Server-side application logs are retained for approximately ninety (90) days.
On deletion of your account, Strikepad deletes your user record and the broker-account, execution, position, and session rows that cascade from it, and asks SnapTrade to delete the corresponding end-user data on its side. Audit-log rows recording consent events are retained with a nulled user reference for compliance and evidence purposes.
The hashed payment-method and brokerage-account identifiers recorded for historical money-back refund requests are kept for five years after the refund is issued (or, if the request is not completed, for five years after the request) and then deleted. They are retained after account deletion, together with the refund record they belong to, under the fraud-prevention exception to deletion rights, solely for the historical refund and fraud-prevention purposes for which they were collected.
Beta access requests (form submissions and direct emails to the support address) are retained in the support mailbox for the duration of the beta program and are deleted on request.
Your California Privacy Rights
If you are a California resident, the CCPA gives you the following rights with respect to your personal information held by Strikepad:
Right to know — you may request a description of the personal information Strikepad has collected about you, the sources from which it was collected, the business purpose for collecting it, and the categories of third parties (if any) with whom it has been shared.
Right to delete — you may request deletion of the personal information Strikepad has collected from you, subject to the exceptions allowed by the CCPA (for example, where retention is necessary to comply with a legal obligation).
Right of non-discrimination — Strikepad will not deny you service, charge a different price, or provide a different level of service because you exercised your privacy rights.
Right to opt out of sale or sharing of personal information — Strikepad does not sell or share your personal information for cross-context behavioral advertising; there is no opt-out to exercise, but you may submit a confirmation request and we will respond.
Strikepad will respond to verifiable requests within forty-five (45) days as required by the CCPA. See § Contact and How to Exercise Your Rights below for how to submit a request.
Security
Strikepad applies the following technical safeguards: bcrypt password hashing (cost factor 12), AES-256-GCM encryption at rest for third-party-integration secrets, TLS in transit, HTTP security headers (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), per-IP rate limiting on authentication endpoints, and Cloudflare Turnstile bot mitigation on the registration and login forms.
No system is perfectly secure. You should use a unique, strong password and not reuse passwords across services. If you suspect a security incident on your account, contact support@strikepad.io.
Children
The Service is not directed to, and may not be used by, anyone under 18 years of age. Strikepad does not knowingly collect personal information from children. If you believe a child has provided personal information to Strikepad, contact support@strikepad.io and the information will be deleted.
Changes to This Policy
Strikepad may revise this Privacy Policy from time to time. Material changes will be reflected by updating the effective date at the top of this document. Continued use of the Service after the effective date of a revised policy constitutes acceptance of that policy.
Contact and How to Exercise Your Rights
To submit a privacy request — to know, to delete, or for any other CCPA right — or to ask a question about this policy, email support@strikepad.io. Strikepad will respond within forty-five (45) days as required by the CCPA. You can also delete your account and all associated data yourself at any time from Settings → Account; emailed deletion requests are handled within the same response window.
Effective date: October 4, 2026 (version 2026-10-04).