1. Who is responsible for your data
The data controller for the J.L.JÖRMUNGANDR application (the "App") is Ivan Vorobei, an individual developer based in Podgorica, Montenegro. For any question about your data, write to gandr.trade@gmail.com.
This policy covers the J.L.JÖRMUNGANDR desktop application, its web version and the related servers on the gandr.site domain.
The App is a tool for keeping a trading journal and analysing your own data. It does not give financial or investment advice, does not manage your funds and does not place trades on your behalf.
2. What data we collect
We collect only what is needed to run your account, your license and the shared features (forum, events). The App uses no behavioural analytics and no advertising trackers.
| Data | What exactly | When |
|---|---|---|
| Account | email, name, avatar (from your Google profile if you sign in with Google), user ID | on sign-up and sign-in |
| Profile | statuses and titles, achievements, notifications | while you use the App |
| Forum | threads, replies, likes, bookmarks; trades you share (result, direction, risk/reward) | when you post or react |
| License | type and term of access, key activation history, Patreon subscription status | on activation, trial or purchase |
| Crypto payments | order and payment IDs, amount, coin and status of each payment; no wallet keys | when you pay with crypto |
| Events | LONG/SHORT forecasts, points, board position, purchased items | when you take part |
| Achievement verification | signed records of closed trades from a connected broker, time zone | when the App claims a new achievement |
| Feedback | the text and images of your message | when you send it |
| Technical data | IP address, app integrity token (Firebase App Check) | on requests to our servers |
Not sent to us and kept only on your device: exchange and broker API keys, your trade journal and notes (see section 4).
3. Why we use data
Data is used only to run the App; we do not sell it or share it with advertisers.
| Purpose | Data | Legal basis |
|---|---|---|
| Sign-in and running your account | account, profile | performance of our agreement with you |
| Checking your license and feature access | license, Patreon | performance of the agreement |
| Accepting crypto payments, the payment history and payment support | crypto payments | performance of the agreement |
| Emails to verify your address and reset your password | performance of the agreement | |
| Forum, events, achievements | forum, events, signed trades | performance of the agreement |
| Abuse protection (rate limits, blocking, key guessing) | IP, App Check, activation attempts | legitimate interest |
| Answering your requests | feedback, email | legitimate interest |
The App does not send marketing emails.
4. What stays only on your device
Trading data is stored locally, in the App's data folder (JLJData), and is not sent to our servers:
- exchange and broker API keys and secrets (Binance, Bybit, Kraken, Interactive Brokers, MetaTrader 5);
- your trade journal, strategies, notes and reports;
- App settings.
In the desktop app, secret keys, passwords and tokens are stored not in files but in the system credential store (macOS Keychain, Windows Credential Manager). Keys are used only for requests from your device directly to the exchange. We recommend read-only keys with no trading or withdrawal rights.
Only what is listed in section 2 reaches our servers: trades you choose to share on the forum and signed records of closed trades for achievement checks. Local files are protected by your operating-system account; if you delete the App and the JLJData folder, this data is gone for good — we have no copy.
5. Third-party services
The App runs on the services below; each receives only the data it needs. Their servers may be outside your country, including in the United States.
| Service | Purpose | Data it receives |
|---|---|---|
| Google Firebase (Authentication, Firestore, App Check) | accounts, data storage, protection against fake clients | account, profile, forum, license, events |
| Google Sign-In | signing in with Google | name, email, avatar |
| Cloudflare | license, achievement and event servers | requests, IP address |
| Resend | sending service emails | |
| Patreon | full-version subscription | account link and subscription status; payment details stay with Patreon |
| NOWPayments | crypto payments | order ID and amount; what you enter on its payment page, your wallet address and the transaction stay with NOWPayments |
| Cloudinary | image storage | images you upload to the forum and to feedback |
| Exchanges and brokers (Binance, Bybit, Kraken, Interactive Brokers, MetaTrader 5) | importing your trades | requests from your device with your keys, directly to the exchange |
| Market data providers (Yahoo Finance, Twelve Data, CoinGecko, exchange rates), TradingView news widget | quotes, asset lists, news | technical request data only (IP address), no account data |
The App contains no analytics systems (Google Analytics, Sentry and the like) and no advertising networks.
6. What other users can see
Some data is public by the nature of the features. Your email, license, keys and trade journal are not shown to other users.
| What | Visible to |
|---|---|
| Forum threads and replies, author name and avatar, shared trades and images | everyone, including people without an account |
| Name, avatar, statuses and titles, achievements | signed-in users |
| Participation in events and tournaments: forecasts, points, leaderboard place, purchased items | signed-in users |
What you post on the forum can be copied by others; deleting a post removes it from the App but not from other people's copies.
A crypto payment is recorded on a public blockchain: the transaction, its amount and the wallet addresses can be seen by anyone, and neither we nor NOWPayments can delete them. The blockchain does not show your account.
7. How long we keep data
Account data is kept while the account exists and is deleted immediately when you delete the account in your profile (or within 30 days of a request by email).
| Data | Retention |
|---|---|
| Account, profile, achievements, event participation | while the account exists |
| Event day history | all days of participation, while the account exists |
| License, key activation history and crypto payments | while the account exists (needed to prove paid access) |
| Forum posts | until you delete them; when you delete your account they stay without the author's name |
| Feedback | until you ask us to delete it (text and images) at gandr.trade@gmail.com; the text is also deleted with your account |
| Server logs (Cloudflare) | for Cloudflare's log retention period, no longer than 7 days; logs contain only server service messages, without IP addresses or request headers |
| Local data (JLJData) | on your device, until you delete it |
After an account is deleted we may keep the minimum records required by law (for example, about payments).
8. Your rights and deleting your account
To exercise any of the rights below, write to gandr.trade@gmail.com from the address linked to your account. We reply within 30 days.
- Access: find out what data we hold about you and get a copy.
- Correction: correct inaccurate data; you can change your name and avatar in your profile.
- Deletion: the "Delete account" button in your profile (or an email to the address above). This deletes your account, profile, notifications, license, achievements, event and tournament participation, feedback texts and shared trades; images from feedback are deleted on a separate request. Forum threads and replies stay for the people who answered them, but without the author's name. Payment records (key activations, Patreon, crypto payments) are kept without a link to the account. An active license ends; cancel a Patreon subscription separately in Patreon.
- Restriction and objection: ask us to stop processing based on legitimate interest.
- Portability: get your data in a machine-readable format (JSON).
- Complaint: contact the Agency for Personal Data Protection and Free Access to Information of Montenegro (AZLP) or the data protection authority of the country where you live.
You delete local data (section 4) yourself: remove the App and the JLJData folder.
The App is intended for people aged 18 and over. If we learn that an account belongs to a minor, we will delete it.
9. Changes and contact
We will announce material changes to this policy in the App or by email at least 14 days before they take effect. The date of the latest version is shown at the top of the document.
Contact: Ivan Vorobei, Podgorica, Montenegro · gandr.trade@gmail.com