Privacy Policy

Effective date: May 20, 2026

This Privacy Policy explains how Brookstone Digital Services LLC ("Brookstone Digital Services," "we," "us," or "our") collects, uses, stores, and shares information about you when you use Tradelink, our trading journal and analytics service, available on the web at trytradelink.com and as an iOS application (together, the "Service"). Brookstone Digital Services LLC is the operator of Tradelink. This policy applies to all users of the Service.

If you have questions about this policy, contact us at privacy@trytradelink.com.

1. Information We Collect

We collect only the information we need to operate the Service, bill correctly, and keep accounts secure. The seven sub-sections below correspond one-to-one with the data type categories we declare on Apple's App Store privacy questionnaire, so you can see exactly what each App Store category means inside Tradelink. For every one of these categories, the data is linked to your identity, the only purpose is App Functionality, and it is never used for tracking or advertising. We do not load third-party analytics SDKs, and we do not record taps, screen views, or session-level behavior.

Contact Info: Email Address

We collect your email address when you create an account with email and password, or when you sign in with Apple. If you use Apple's "Hide My Email" feature, we only ever see Apple's private relay address, not your real Apple ID email. We use your email address to authenticate you, send login codes and password resets, deliver App Store subscription receipts, and notify you of important account or security events.

If you sign up with a password, it is stored only as a salted hash. We never store or see your plain-text password.

Contact Info: Name

Name is optional. We collect it if you enter one during the account-creation step of onboarding, or if you choose to share your Apple ID name through Sign in with Apple. We use it only to address you by name inside the app and on the transactional emails we send you. We never sell it, share it, or use it for advertising.

Identifiers: User ID

Two identifiers are stored on your account so the Service can function:

• An internal user ID (a UUID) generated by our database provider, Supabase. It links your journal entries and settings to your account and is used only inside our own systems.
• For active iOS subscribers, the opaque Apple transaction identifier (the "original transaction ID") that Apple supplies so we can confirm and maintain your subscription status.

If you use Sign in with Apple, Apple also gives us an opaque user identifier that is unique to your Apple ID and to Tradelink, which we use to recognize your account on later sign-ins (see section 5). None of these identifiers are shared with advertising networks or analytics vendors.

Purchases: Purchase History

On iOS, all subscription payments are processed by Apple through In-App Purchase. We never see your card number, CVV, or billing address. Apple sends us cryptographically signed receipts and webhook events that confirm whether your subscription is active, renewed, cancelled, refunded, or revoked. We store this subscription state, along with the Apple transaction identifier, so we can grant and revoke access to paid features correctly. See section 6 for more on payments.

User Content: Other User Content

This category covers the free-form content you choose to create inside the app. None of it is required to use the Service; it exists only because you entered it.

• Journal entries. The text fields you fill in on the Log-a-Trade screen: strategy, market bias, entry confluence, exit emotion, post-trade analysis, lessons learned, and future corrections.
• Onboarding profile. The answers you give during onboarding so the app can set sensible defaults in your journal: what you trade, how you fund your trading, your primary broker and prop firm, your self-reported trading experience and primary challenge, your weekly profit goal, and your preferred display currency.

All of this content belongs to you. We store it so we can render it back to you in your journal and analytics views. We do not use it to train models, we do not share it with anyone outside Tradelink, and we do not use it for advertising.

Financial Info: Other Financial Info

This category refers only to the trade values you voluntarily type into your journal on the Log-a-Trade screen, for example: symbol, side (long or short), risk amount, entry price, exit price, realized profit or loss, R-multiple, and trade result (win, loss, or breakeven). This is your own trading bookkeeping, recorded by you, not information about your finances at large.

We do not connect to your brokerage, we do not read your account balances, and we do not collect bank-account, credit-card, or routing information. Subscription payments are handled entirely by Apple (see section 6).

Location: Coarse Location

When you sign up or sign in, our servers record your IP address and the country we derive from it, alongside a timestamp of your most recent sign-in. We use this only for fraud prevention, rate limiting, and applying the correct regional consumer-rights workflow (for example, GDPR in Europe versus CCPA in California). We do not collect precise or GPS-level location, and we do not use this information for advertising or behavioral profiling.

Other information we collect

Two further items fall outside the App Store privacy categories above:

• Affiliate referral code. If you arrive through an affiliate link, we record the affiliate's referral code on your account so the affiliate can be credited if you subscribe. This is the affiliate's own identifier, a short string, not information about you. It is set once at signup and never updated.
• Optional support-call scheduling. From time to time we may offer you the option to book a private support call with a Tradelink team member. If you choose to book one, the scheduling provider we use (currently Calendly, Inc.) collects your name, email, and the time slot you select so it can place the meeting on the calendar and send reminders. Booking a call is always optional; if you never book one, we never send your information to the scheduling provider.

2. How We Store Your Information

Your account data and journal entries are stored in a managed PostgreSQL database provided by Supabase, Inc. The database is encrypted at rest, and all data is transmitted between your device and our servers over TLS (HTTPS). Access to production systems is restricted to a small number of authorized engineers and is logged.

Our application servers run on Vercel, Inc. Vercel processes requests but does not retain a copy of your journal data beyond what is needed to serve the request.

3. How We Use Your Information

We use the information described above to:

• Provide the journaling service, including saving, editing, and displaying your trades and notes.
• Generate analytics from your own journal data and render them back to you in the app.
• Authenticate you, keep your account secure, and detect abuse, fraud, and automated attacks.
• Send transactional and security emails (for example, login codes, password resets, receipts, important account notices, and material changes to this policy).
• Process subscriptions and comply with Apple's and Google's subscription accounting requirements, including handling renewals, cancellations, refunds, and revocations.
• Respond to your support requests and, if you choose to book one, schedule a private support call.
• Comply with applicable legal obligations.

We do not use your information for advertising, behavioral targeting, or third-party marketing.

4. How We Share Your Information

We do not sell personal data

We do not sell, rent, or trade your personal information or your journal data to anyone, for any purpose.

Subprocessors

We share information only with the service providers ("subprocessors") that we need to run Tradelink. Each subprocessor is bound by a written agreement that requires it to use the data only to perform the service we engaged it for, to keep the data confidential, and to protect it with safeguards at least equivalent to those described in this policy. We do not authorize any subprocessor to use your data for its own purposes.

• Supabase, Inc. Hosts the PostgreSQL database where your account and journal data are stored.
• Vercel, Inc. Hosts our application servers and serves web and API traffic.
• Apple Inc. Processes in-app purchases on iOS, manages subscription billing, and (if you use Sign in with Apple) provides the authentication identifier described in section 5.
• Google LLC. Processes in-app purchases on Android if and when we offer Tradelink on Android, and (if you use Sign in with Google on the web) provides the authentication identifier and basic profile information you authorize.
• Resend, Inc. Sends our transactional emails (login codes, password resets, receipts, and account notices) on our behalf.
• Calendly, Inc. Provides the scheduling interface if you choose to book a private support call. We only share data with Calendly when you actively schedule a call.

This is the complete list of third parties that receive your data. We do not share your information with any other company, and we will update this policy before adding a new subprocessor.

Artificial intelligence

Tradelink does not use any third-party artificial intelligence service. Your journal entries, trades, notes, and onboarding answers are never sent to an external AI model, large language model, or machine-learning provider, and they are never used to train any model. The analytics you see in the app are calculated by our own servers directly from the data you entered. If we ever add an AI-powered feature, we will update this policy first, disclose exactly what data is involved and which provider receives it, and ask for your explicit consent inside the app before any data is sent.

Legal requirements

We may disclose information if we are required to do so by law, court order, subpoena, or other valid legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud.

Business transfers

If Brookstone Digital Services LLC is involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you by email before your information becomes subject to a different privacy policy.

5. Sign in with Apple

When you sign in to Tradelink using Sign in with Apple, Apple sends us:

• An opaque user identifier that is unique to your Apple ID and to Tradelink. We use it only to recognize your account.
• On your first sign-in, the name you choose to share, if any. You can edit or omit this in the Apple system prompt.
• An email address, which may be your real Apple ID email or a private relay address generated by Apple's "Hide My Email" feature. We do not receive your real Apple ID email unless you opt in to share it. If you choose Hide My Email, all messages we send route through Apple's relay and you can disable forwarding at any time in your Apple ID settings.

6. Payments

Subscription payments inside the iOS app are handled exclusively by Apple through In-App Purchase. We never see your card number, CVV, or full billing address. We receive only Apple's signed receipt, the subscription product identifier, and renewal or cancellation events.

Refunds for iOS purchases are administered by Apple under Apple's policy. For purchases made on the web, refunds are administered by us under the terms described in our Terms of Use.

7. Account Deletion

You can delete your account at any time, directly inside the iOS app, with no need to contact us and no website visit. Open Settings (the gear icon in the top-right corner of the app), scroll to the bottom of the screen, and tap "Delete Account." After a confirmation prompt, the deletion completes entirely within the app. You may also request deletion by emailing privacy@trytradelink.com from the address tied to your account, but this is an optional alternative, not a requirement. When you delete your account:

• Your authentication record, your user profile row, and all of your journal entries are removed from our active database within 30 seconds.
• Encrypted database backups that include your data are rotated out on our normal backup schedule, typically within 30 days.
• Apple In-App Purchase webhook events and transaction records that we are required to keep for tax, accounting, and chargeback purposes are retained for the period required by applicable law (typically seven years) and are de-identified, meaning they are no longer linked to your email or name.

Deleting your Tradelink account does not cancel your Apple or Google subscription. To stop being billed by Apple, cancel the subscription in Settings then your Apple ID then Subscriptions on your device.

8. Data Retention

We retain account and journal data for as long as your account is active. When you delete your account, we purge your data as described in section 7. Backups containing your data are rotated out on our normal schedule. Webhook and transaction records required for tax and accounting are retained de-identified for the period required by law.

9. Your Rights

Depending on where you live, you may have legal rights over your personal data. We honor these rights regardless of jurisdiction. To exercise any of them, email privacy@trytradelink.com from the address on your account. We will respond within 30 days.

If you are in the European Economic Area, the United Kingdom, or Switzerland (GDPR and UK GDPR)

• Access. Request a copy of the personal data we hold about you.
• Correction. Ask us to correct inaccurate or incomplete data.
• Deletion. Ask us to delete your data (the "right to be forgotten").
• Portability. Receive your data in a structured, commonly used, machine-readable format.
• Restriction. Ask us to restrict how we process your data.
• Objection. Object to processing based on our legitimate interests.
• Withdraw consent. Withdraw consent at any time where processing is based on consent.
• Complaint. Lodge a complaint with your local data protection authority.

Our lawful bases for processing under the GDPR are: contract (to provide the Service you requested), legitimate interests (security, fraud prevention, and improving the Service), consent (where you have given it), and legal obligation.

If you are a California resident (CCPA and CPRA)

• Right to know. Request the categories and specific pieces of personal information we have collected about you, the sources, the purposes for collecting it, and the categories of third parties we share it with.
• Right to delete. Request that we delete personal information we have collected from you.
• Right to correct. Request that we correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell personal information and we do not share personal information for cross-context behavioral advertising, so there is nothing to opt out of. We will not sell or share your data in the future without first giving you the ability to opt out.
• Right to non-discrimination. We will not discriminate against you for exercising any of these rights.

10. Cookies and Similar Technologies

The Tradelink web app uses only essential cookies. We do not use advertising cookies and we do not load third-party analytics scripts on our app pages.

• access_token and refresh_token. HttpOnly session cookies that keep you signed in. Without them, you would have to log in on every page load.
• tl_aff. A first-party cookie set for 30 days when you arrive through an affiliate link, so we can credit the referrer if you later subscribe.

The iOS application does not use web cookies. It stores an authentication token in the iOS Keychain.

11. International Transfers

Brookstone Digital Services LLC operates Tradelink from the United States. If you access the Service from outside the United States, your data will be transferred to, stored, and processed in the United States. Where required by law, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses) to protect your data in transit.

12. Children

Tradelink is not directed at children. We do not knowingly collect personal information from anyone under the age of 13 in the United States or under the age of 16 in the European Economic Area. If you believe a child has provided us with personal information, email privacy@trytradelink.com and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will notify you by email at the address on your account, at least 30 days before the change takes effect. The "Effective date" at the top of this page always reflects the current version. Continued use of the Service after a change takes effect means you accept the updated policy.

14. Contact

For questions about this Privacy Policy, to exercise any of your rights, or to report a privacy concern, contact us at:

Email: privacy@trytradelink.com
General support: support@trytradelink.com

Mailing address: Brookstone Digital Services LLC. The current mailing address is available on request at the email above.