Pursuant to GDPR (EU) 2016/679 — version: 28 July 2026. Convenience translation; the German version prevails.
Astrid Jaeger
Laubenweg 22, 9020 Klagenfurt am Wörthersee, Austria
E-mail: support@thedrawdowndiary.com
We collect the following personal data:
Registration: e-mail address, encrypted password
Usage data: trades entered, psychology logs, weekly reviews and optionally uploaded chart screenshots (entered or uploaded exclusively by the user; screenshots are stored in a private storage bucket and are accessible only to the respective user)
Payment data: processed exclusively by Stripe — we do not store credit-card data
Contract records: at purchase we document the time and wording of your express request for immediate provision of the service (plan, checkout reference, e-mail address)
Cancellation requests: details submitted via the public cancellation page (e-mail address, plan, type of cancellation, time)
Withdrawal declarations: details submitted via the public withdrawal page (name, e-mail address, order or invoice number, plan, an optional note, and the date and time of receipt). Name, contract identification and e-mail address are mandatory items of the withdrawal function prescribed by § 13a of the Austrian FAGG
Referral program: the record of which referral link an account was registered through
Commission records: where a referral leads to a paid purchase, a settlement record is created (table affiliate_commissions). We store the referral code of the referring person, the user identifier of the referred account, the plan purchased, the purchase amount, the commission calculated from it and its payout status — no name and no e-mail address
Lifetime reservations: when you purchase Lifetime access we reserve one of the ten Early Bird slots for you. We store your user identifier, the Stripe checkout reference, the status of the reservation and the associated timestamps — no name and no e-mail address
Technical data: IP address, browser type (via Vercel hosting)
Anonymous page views: we store only the visited path, any referrer and the time — without a user identifier, without a cookie and without your IP address. However, to prevent abuse, your IP address is transmitted to our rate-limiting provider Upstash (USA) when this endpoint is called and retained there for the duration of the time window; it is not linked to the stored page views (legal basis: Art. 6(1)(f) GDPR; transfer to the USA based on Standard Contractual Clauses)
— Providing the trading-journal functionality — legal basis: Art. 6(1)(b) GDPR (performance of contract)
— Processing payments and subscriptions — legal basis: Art. 6(1)(b) GDPR (performance of contract)
— Authentication and account security — legal basis: Art. 6(1)(b) GDPR (performance of contract)
— Documenting legally required confirmations (Austrian FAGG) and handling cancellations — legal basis: Art. 6(1)(c) GDPR (legal obligation) and (f) (interest in evidence)
— Technical operation of the platform (server logs) — legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation)
— Bot and abuse protection (captcha, rate limiting) — legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation)
— Affiliate/referral tracking (ddd_ref cookie) — legal basis: Art. 6(1)(a) GDPR (consent)
— Embedding the TradingView price ticker — legal basis: Art. 6(1)(a) GDPR (consent)
— Reserving and evidencing the ten Early Bird Lifetime slots — legal basis: Art. 6(1)(b) GDPR (performance of contract) and (f) (legitimate interest in a correct scarcity claim, Annex item 7 of the Austrian UWG)
— Settling and paying out commissions under the referral programme — legal basis: Art. 6(1)(b) GDPR (performance of the contract with the referring person) and (c) (accounting and retention obligation, § 132 of the Austrian Federal Fiscal Code)
Obligation to provide data (Art. 13(2)(e) GDPR): your e-mail address and a password are required to conclude the contract — without them we cannot create an account or provide the service; all other details (trades, psychology logs, screenshots, name) are voluntary, and not providing them has no disadvantage other than the loss of the respective feature.
Automated decision-making (Art. 13(2)(f) GDPR): no automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.
We do not use advertising or analytics cookies. Specifically:
— Login/session cookies (Supabase Auth): technically necessary, no consent required
— ddd_consent: stores your decision on the referral cookie (12 months), technically necessary
— ddd_consent_tv: stores your decision on the TradingView price ticker (12 months), technically necessary
— ddd_ref: referral tracking (30 days) — only set after your consent via the cookie banner
Separate consent per purpose: You decide on the two purposes that require consent — the referral cookie and the TradingView price ticker — independently of one another in the cookie banner. You may accept one and decline the other; "Decline all" is just as easy to reach as "Accept all".
Reach measurement without storing anything on your device: To count anonymous page views we store nothing on your device — no cookie, no localStorage, no sessionStorage. Until 28 July 2026 a sessionStorage entry ("pv_tracked") was used for this; it has been removed without replacement. Counting now happens once per page load, and the lock required for it lives solely in the volatile memory of the loaded page. § 165(3) of the Austrian Telecommunications Act 2021 is therefore not engaged.
The TradingView price ticker is loaded only after your consent; without consent you see a placeholder in its place which you may unlock once for the current session — that click sets no cookie and does not change your stored decision.
You can revoke your consent at any time with effect for the future — with a single click on "Cookie settings" in the footer of every page. This immediately deletes ddd_consent, ddd_consent_tv and ddd_ref, the cookie banner reappears and the TradingView ticker is removed; the withdrawal takes effect for both purposes at once. Withdrawal is thus as easy as giving consent (Art. 7(3) GDPR). The lawfulness of processing carried out before the revocation remains unaffected.
Supabase (Supabase Inc., Frankfurt/Germany data centre) — database hosting and authentication; data is stored within the EU (processing on our behalf pursuant to Art. 28 GDPR; where support access from the USA occurs, on the basis of Standard Contractual Clauses)
Vercel (Vercel Inc., USA) — web hosting; processing on our behalf pursuant to Art. 28 GDPR, transfer to the USA based on certification under the EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses
Stripe — payment processing. The contracting entity for customers in the EEA is Stripe Payments Europe Ltd., Ireland; any transfer to Stripe, Inc. (USA) is based on certification under the EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses. For payment processing itself Stripe acts as a processor on our behalf (Art. 28 GDPR), while for fraud prevention and anti-money-laundering and regulatory obligations it acts as an independent controller; in that respect Stripe's own privacy policy applies
Resend (Resend, Inc., sending region eu-west-1/Ireland) — delivery of transactional e-mails (contract confirmation pursuant to § 7(3) Austrian FAGG, guarantee declaration pursuant to § 9b Austrian KSchG, confirmation of receipt of a cancellation). Processed are your e-mail address, name or form of address where available, and the contract details contained in the message (plan, price, purchase date, reference). Technical delivery takes place via Amazon SES in the eu-west-1 region (Ireland); the data remains within the EU (legal basis: Art. 6(1)(b) GDPR, performance of contract, and (c), legal obligation, as the confirmation is required by law; processing on our behalf pursuant to Art. 28 GDPR)
Zoho (Zoho Corporation B.V., EU data centre) — hosting of our mailboxes support@thedrawdowndiary.com and mikko@thedrawdowndiary.com, i.e. receipt and handling of customer enquiries, withdrawal and guarantee declarations. Processed are all contents you send us by e-mail as well as your sender address and the message metadata. Data is held within the EU (mx.zoho.eu) (legal basis: Art. 6(1)(b) GDPR, performance of contract, and (f), legitimate interest in handling enquiries; processing on our behalf pursuant to Art. 28 GDPR)
Cloudflare Turnstile (Cloudflare, Inc., USA) — captcha protecting registration and login against bots; your IP address is transmitted to Cloudflare (legal basis: Art. 6(1)(f) GDPR, legitimate interest in secure operation; data transfer based on the EU-US Data Privacy Framework or Standard Contractual Clauses)
Upstash (USA) — rate limiting to protect against abuse; your IP address is processed briefly for this purpose (legal basis: Art. 6(1)(f) GDPR, legitimate interest in secure operation; data transfer based on Standard Contractual Clauses)
TradingView(TradingView Inc., USA) — embedded price-ticker widget in the logged-in area. The widget is loaded only after your consent; when it loads, your IP address is transmitted to TradingView and the widget may write entries to your terminal-equipment storage. TradingView's privacy policy applies in addition (legal basis: Art. 6(1)(a) GDPR, consent, in conjunction with § 165(3) of the Austrian Telecommunications Act 2021; transfer to the USA based on Standard Contractual Clauses or the EU-US Data Privacy Framework)
Data is stored for as long as an active account exists. Upon account deletion, your personal data is irrevocably deleted within 30 days — in backup copies (backups held by our database provider) until they are overwritten in the regular cycle, at the latest after 30 days. The only exceptions are those expressly listed below; the list is exhaustive.
Delivery records of our transactional e-mails (table mail_outbox: recipient address and the full message text, kept as evidence of the legally required notification) are deleted 90 days after successful dispatch. Where a message could not be delivered, the entry is kept beyond those 90 days until we have dealt with the failure: it documents that a legally required notification did not reach its recipient and is the only basis for sending it again (Art. 6(1)(c) GDPR, Art. 17(3)(b)). If you delete your account, all entries relating to your address are removed immediately — including undelivered ones.
Internal processing notes (table ops_tasks) arise whenever a case cannot be completed automatically and requires a decision by us. These are not only payment events: a referral that could not be attributed to any referrer, or the expiry of Pro credit from the referral programme, also creates such a note. We store only what is needed to handle the case — user identifier or e-mail address and, where applicable, amounts and a payment reference. Open items are retained until they are resolved (Art. 6(1)(c) GDPR in conjunction with § 14 Austrian FAGG, Art. 17(3)(e) GDPR); they are deleted 90 days after resolution. On account deletion we remove resolved notes relating to your account immediately; an item still open remains until it has been resolved.
Cancellation requests (table cancellation_requests) are retained as evidence of timely handling until the statutory limitation periods expire (Art. 17(3)(e) GDPR); they are deleted together with your account.
Withdrawal declarations (table withdrawal_declarations) are treated according to their outcome. Where we accepted the withdrawal and reversed the transaction in whole or in part, the declaration is the record of a payment flow and is kept for the duration of the statutory tax retention period (§ 132 of the Austrian Federal Fiscal Code, 7 years; Art. 17(3)(b) and (e) GDPR) — including beyond deletion of your account. A withdrawal not yet decided remains until it has been decided, because the repayment period under § 14 Austrian FAGG runs regardless of whether the account still exists. Where we rejected the withdrawal, we delete the declaration together with the related correspondence at the latest when your account is deleted.
Lifetime reservations (table lifetime_reservations) record which of the ten advertised Early Bird slots have been taken. A redeemed slot is stored permanently — including after account deletion and after a refund — because the publicly displayed counter "X of 10 left" would otherwise run backwards and become an incorrect scarcity claim (Art. 6(1)(f) GDPR, Annex item 7 of the Austrian UWG; Art. 17(3)(e) GDPR). The only data held is your user identifier, the Stripe checkout reference, the status and the timestamps — no name, no e-mail address. Reservations that were not redeemed, i.e. expired or released again, are removed immediately on account deletion.
Commission records (table affiliate_commissions) are accounting records of the operator and are subject to the statutory tax retention obligation (§ 132 of the Austrian Federal Fiscal Code, 7 years; Art. 6(1)(c), Art. 17(3)(b) GDPR). If you delete your account, we remove the link to your user identifier from the record; what remains is the plan, the amount, the commission and the status, and it can no longer be attributed to you.
Anonymous page views (table page_views: path, any referrer, time) contain no user identifier, no IP address and no cookie. They cannot be attributed to a person and are therefore not subject to a retention limit; we evaluate them on an ongoing basis for reach measurement.
Otherwise: invoice and payment data is subject to the statutory retention obligation (§ 132 of the Austrian Federal Fiscal Code, 7 years). Contract records (table withdrawal_waivers, e.g. the documented express request for immediate provision) are retained for the establishment or defence of legal claims until the statutory limitation periods expire (Art. 17(3)(e) GDPR); records of abandoned checkouts, which evidence no contract, are already deleted after 90 days.
Under the GDPR you have the right to:
— access to stored data (Art. 15)
— rectification of inaccurate data (Art. 16)
— erasure of your data (Art. 17) — directly via Settings → Delete account
— restriction of processing (Art. 18)
— data portability (Art. 20) — at any time yourself via Settings → Your data → "Export all my data", and in addition still free of charge on request by e-mail
— objection to processing (Art. 21)
— revocation of consent with effect for the future (Art. 7(3))
Data export (Art. 15 and 20 GDPR, § 5c(2) Austrian VGG): In your settings you can download a complete copy of your data as a JSON file yourself at any time and free of charge — on every plan, including the Free plan and including after a paid contract has ended. It contains: your account master data and preferences, all trades, tags, psychology logs, weekly reviews, journal entries, achievements, contract and subscription data, contract records, cancellation and withdrawal declarations, in-app notifications, your reservations of one of the ten Lifetime slots including abandoned purchase attempts (data.lifetime_reservations), commission records relating to your purchases, operational cases concerning your account that had to be reviewed manually (data.operations_backlog), the log of transactional e-mails sent to you, and time-limited download links to your screenshots (the image files themselves are not embedded, for size reasons). Not included are payment and credit-card data — held exclusively by Stripe — and identifiers of other people from the referral program, in particular the referral code of the referring person (Art. 15(4) GDPR); from the operational cases we additionally remove the internal instruction to the operator and the raw technical error text, since neither is information about you.
Self-check before delivery: Before the file is produced, the export reconciles itself against independent counters — among them the trade counter in your profile record. If it contradicts itself, or if a query reported an error, we deliberately deliver nothing: an access response that falsely presents itself as a complete copy would be worse than none at all, because you would consider the matter settled. You receive a notice instead, the case is reported automatically for us to handle, and your right of access is unaffected — the one-month period under Art. 12(3) GDPR continues to run from your request, not from the fix.
Requests to: support@thedrawdowndiary.com
You have the right to lodge a complaint with the Austrian Data Protection Authority:
Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Wien, Austria
www.dsb.gv.at