Privacy Policy

Last updated: August 2026

1Who We Are

Strader is a mindful trade journal for Indian equity traders. It is operated by Stradera Global OPC Private Limited, India. For privacy concerns, contact us at support@straderglobal.com.

This policy applies to the Strader mobile application and any related services.

2What Data We Collect

We collect only what is necessary to provide the service:

• Account data — name, email address, optional mobile number, password hash (managed by Firebase Authentication)
• Trading records — symbols, quantities, prices, entry/exit times, and any personal notes or tags you add
• Journal entries — diary-style text entries you write in the app
• Mindful session data — mood scores, emotion tags, breathing session completions, and AI reflections
• Subscription records — your plan tier, subscription status, and transaction identifiers (no payment card data — handled by Apple and Razorpay)
• Broker connection data — only if you connect a broker (see Section 8): your own API key, API secret, and access token
• Device data — device identifier (for biometric sign-in shortcut and push notifications), crash reports, and — only if you opt in — anonymous usage analytics

We do not sell your data. We do not use your trading records or journal entries for advertising. We do not track you across other companies' apps or websites.

3How We Use Your Data

• To provide the journalling, reporting, and AI-assist features you use
• To manage your subscription and verify purchases
• To sync your data across your devices (paid tiers only)
• To send transactional email — verification codes, password-reset codes, and a short welcome series — to the address you signed up with
• To send optional reminder notifications you configure

4Where Your Data Is Stored

• Free (Sapling) plan — all data stays on your device only. Nothing is sent to our servers.
• Paid plans (Grove / Forest) — encrypted data is stored in Google Firebase (asia-south1 region, India). Financial Decimal columns (prices, P&L) are stored as plaintext strings; all personal text fields (notes, journal entries, mood records) are stored as AES-256 ciphertext.
• Broker credentials — stored in your device's secure Keychain, with an encrypted copy in your cloud account for cross-device sync (see Section 8).

Firebase encrypts all data at rest using Google-managed KMS keys. Strader adds an additional application-layer AES-256-CBC encryption layer for all personal text content.

5How Long We Keep Your Data

• While your account is active
• Free Sapling users: data lives only on your device. If you uninstall the app or delete your account, it is gone.
• Paid users who downgrade to Sapling: cloud-stored data is permanently deleted within 30 days of the tier change.
• If you delete your account: your data (local and cloud) and your sign-in identity are deleted immediately when you confirm; any residual copies in encrypted backups are purged within 30 days.

6Your Rights (DPDP Act 2023 & GDPR)

Under the Digital Personal Data Protection Act 2023 (India) and GDPR (EU), you have the right to:

• Access — view the data we hold about you
• Correction — fix inaccurate data
• Erasure — delete your account and all associated data at any time (More → Delete account)
• Data portability — download a machine-readable copy of your data (JSON and CSV) via More → Download my data; PDF reports are also available from the Reports tab
• Withdraw consent — downgrade to Sapling at any time to stop cloud sync, or switch off analytics at any time (More → Privacy)

For grievances under the DPDP Act, contact our Grievance Officer at support@straderglobal.com. We will respond within 30 days.

EU users: you may lodge a complaint with your local supervisory authority.

7Third-Party Processors

• Google Firebase (Authentication, Firestore, Realtime Database, Cloud Functions, Cloud Storage, Cloud Messaging, Crashlytics, Performance Monitoring, App Check, and — only if you opt in — Analytics) — Google LLC, USA; primary data processed in asia-south1 (India)
• Apple Inc. — in-app purchase processing and verification (iOS)
• Razorpay Software Pvt Ltd — payment processing on Android and web
• Anthropic Inc. (USA) — AI journal features on the Grove and Forest plans; the relevant journal or trade text is sent for analysis only when you use an AI feature, and is not used to train AI models
• Twilio SendGrid (USA) — delivers our transactional email (verification codes, password-reset codes, welcome emails) to your email address
• Zerodha Broking Ltd (Kite Connect) — only if you connect your Zerodha account (Section 8)

8Broker Sync (Optional)

If you choose to connect your Zerodha account, Strader uses your own Kite Connect API key and secret — you create them in your Zerodha developer console and they remain yours.

• Credentials (API key, API secret, access token) are stored in your device's secure Keychain, with an encrypted copy in your cloud account so your own devices can sync.
• Access is read-only: Strader imports your executed trades. It cannot place, modify, or cancel orders, and cannot move funds.
• We never see or store your Zerodha login password or 2FA.
• Disconnecting the broker (More → Connections) deletes the stored credentials; deleting your account deletes them as well.

9Analytics, Crash Reports, and Tracking

The Strader app does not use cookies and does not track you across other apps or websites (no advertising SDKs, no device ad identifiers).

• Usage analytics are opt-in and off by default. You choose at the consent screen, and you can change your mind at any time in More → Privacy. When off, no usage analytics leave your device.
• Crash reports (Firebase Crashlytics) are collected to help us fix bugs; they are not linked to your identity.

10Children's Privacy

Strader is intended for adults (18+) engaged in equity trading. We do not knowingly collect data from anyone under 18.

11Changes to This Policy

We will notify you within the app if we make material changes. Continued use after the notification period constitutes acceptance.

12Contact