Privacy Policy

1. Introduction

PropStax ("we," "us," "our," or the "Company") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our prop-firm balance and analytics platform at https://app.propstax.com and https://propstax.com (the "Service").

By using the Service, you consent to the data practices described in this Privacy Policy. If you do not agree with this policy, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

Account Information:

• Email address
• Password (stored in encrypted form by AWS Cognito)
• Display name

Prop-Firm Tracking Data:

• Account identifiers from your broker / prop firm
• Account specifications (size, drawdown limits, profit targets, account type)
• Daily balance, equity, and drawdown snapshots
• Trade aggregates (counts, win/loss totals, daily P&L)
• Costs paid (evaluation fees, monthly subscriptions, resets)
• Payouts received from prop firms
• User-applied tags and notes on accounts

Payment Information:

• Billing address (held by Stripe; we do not see card numbers)
• Payment method details processed and stored by Stripe

Communications:

• Support requests and correspondence
• Feedback and survey responses

2.2 Information Collected Automatically

Technical Data:

• IP address (captured when you authorize a broker connection, as part of the consent audit trail)
• Browser type, version, and user-agent string
• Device type and operating system
• Pages visited and features used
• Date and time of access

Cookies and Local Storage:

• Authentication tokens (managed by AWS Cognito / Amplify)
• Preference values such as theme + UI layout

2.3 Information from Third Parties

Broker / Data-Feed Connections:

When you connect a brokerage or prop-firm account, we receive:

• Account identifiers, balances, and risk parameters
• Day-level aggregates of trades + P&L
• Historical balance / drawdown snapshots

This data is provided through broker APIs (including Tradovate, Rithmic, and DxFeed-fronted firms such as MyFundedFutures, The Trading Pit, Taurus Arena, and others) based on the permissions you grant. We access this data in read-only mode: we do not place trades, transfer funds, or have any trading authority over your accounts.

2.4 AI App Connections (Optional)

If you connect an AI app, such as Claude or ChatGPT, to the Service (see Section 4.6), we also process:

• A sign-in record, kept for us by our sign-in provider, Stytch: your PropStax user ID, your email address, and the AI apps you have approved, with what each may read.
• A request log: one line for each request an AI app makes, with the time, the app's client ID, your user ID, the kind of data it asked for, and whether it was answered. The log never holds the app's access token or the data sent back, and it is deleted after 30 days.

3. How We Use Your Information

We use the information we collect to:

Provide and Improve the Service:

• Create and manage your PropStax account
• Import, store, and display your prop-firm account data
• Calculate balance, drawdown, drawdown left, and ROI statistics across your portfolio
• Track payouts received vs. costs paid per prop firm
• Enable user-applied tags + notes for personal organization

Communicate with You:

• Send service-related notifications (account confirmation, payment events, sync issues)
• Respond to support requests
• Notify you of material changes to our policies

Security and Compliance:

• Detect and prevent fraud or unauthorized access
• Comply with legal obligations
• Enforce our Terms of Service

Analytics and Improvements:

• Understand how users interact with the Service
• Identify and fix technical issues
• Develop new features and improvements

4. Data Sharing and Disclosure

4.1 We Do Not Sell Your Data

4.2 Service Providers

We share information with trusted third-party service providers who help operate the Service:

These providers are bound by contractual obligations to protect your data and use it only for the purposes we specify.

4.3 Legal Requirements

We may disclose your information if required by law or in response to valid requests by public authorities, such as:

• Court orders or subpoenas
• Government agency requests
• To protect our rights, safety, or property

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

4.5 Aggregated Data

We may share aggregated, anonymized data that cannot reasonably be used to identify you for research or product analytics.

4.6 AI Apps You Connect

If you connect an AI app to the Service, it receives the data you allow, each time it asks:

• Always: your accounts and their rules, trades, daily P&L, and balances
• Only if you turn them on when you approve the app: your payouts, costs, and personal cash, and your journal

We never give an AI app your email address or your password. The connection is read-only: an AI app cannot change your data, connect or sync a broker, place trades, or move money.

The AI app's provider (for example, Anthropic for Claude or OpenAI for ChatGPT) handles that data under its own terms and privacy policy, not ours. Data an AI app has already received stays with its provider: disconnecting the app or deleting your PropStax account does not remove it from there.

You can disconnect an AI app at any time in Settings → AI apps. It then cannot renew its access, and the access it already holds ends when its current access token expires, at most eight hours later.

5. Data Storage and Security

5.1 Where We Store Your Data

Your data is stored on secure servers provided by Amazon Web Services (AWS) located in the United States (region us-east-1).

5.2 Security Measures

• Encryption in transit: all data transmitted to and from the Service is encrypted using TLS 1.2 or higher.
• Encryption at rest: the databases and file storage holding Service data use provider-managed encryption (AES-256).
• Broker credentials: OAuth refresh tokens (Tradovate) are encrypted with AWS KMS before storage. Username/password credentials (Rithmic, DxFeed) are sent through the broker API for the duration of one sync and are not persisted on our servers.
• Access controls: production AWS access is restricted to the operator account and logged via CloudTrail.
• Authentication: passwords are hashed and salted by AWS Cognito and cannot be decrypted.
• AI app connections: an AI app reaches your data only with an access token from our sign-in provider that names you and what you approved, and only through read-only routes that answer for you alone. We never store these tokens.

5.3 Security Limitations

While we strive to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as:

• Your account is active
• Necessary to provide the Service
• Required by law or for legitimate business purposes

6.1 Account Deletion

You can delete your account at any time from Settings → Profile → Delete Account. On deletion:

• Your tracking data (accounts, snapshots, costs, payouts, tags, journal entries and the pictures on them) is removed from our primary stores immediately.
• Your Cognito identity is deleted.
• Your AI app connections end, and your sign-in record with our sign-in provider, Stytch, is deleted.
• Backups and audit logs may retain copies for up to 90 days before automatic expiration.
• Data required for legal or financial-compliance retention (e.g. invoice records) may persist for the period required by law.

6.2 Raw Broker-Response Storage (Opt-Out Available)

When you authorize a broker sync, we may store the raw API responses from the broker for up to 30 days. We use these for: (a) debugging sync issues when you report them; (b) restoring your data if our canonical pipeline misderives a value; (c) backfilling new fields when we extend the schema.

You can opt out at any time from Settings → Data & Privacy. When opted out, no raw responses are persisted — only the canonical / derived account data is stored. Opting out doesn't delete data already stored under prior consent; that data ages out on the normal 30-day schedule.

7. Your Rights and Choices

7.1 Account Settings

You can access and update your account at any time through Settings, including profile, preferences, connected brokers, AI apps, billing, and data & privacy.

7.2 Data Access and Portability

You may request:

• A copy of the personal data we hold about you
• Export of your account data in a machine-readable format

7.3 Data Correction

You may correct inaccurate personal information directly in Settings, or contact us at support@propstax.com.

7.4 Data Deletion

You may delete your account and associated data through Settings → Profile → Delete Account, or by contacting us.

7.5 Communication Preferences

Service-related communications (security alerts, billing notifications, sync errors) cannot be opted out of while your account is active. Promotional communications, if any, will include an unsubscribe link.

7.6 Cookie Preferences

Most browsers allow you to control cookies through their settings. Disabling authentication cookies will sign you out of the Service.

8. International Data Transfers

If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where our servers are located. By using the Service, you consent to this transfer.

9. Rights for Specific Jurisdictions

9.1 European Economic Area (EEA) / UK Residents

If you are located in the EEA or UK, you have additional rights under the GDPR / UK GDPR:

• Right to access: request information about the data we process
• Right to rectification: request correction of inaccurate data
• Right to erasure: request deletion ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing based on legitimate interests
• Right to withdraw consent at any time

Legal bases we rely on: contract performance, legitimate interests (security + product improvement), consent (raw-response storage, AI app connections + marketing), and legal obligations.

To exercise these rights, contact support@propstax.com.

9.2 California Residents

Under the CCPA / CPRA you have rights to:

• Know the categories and specific pieces of personal information collected
• Delete personal information
• Opt out of sale or sharing (we do not sell or share for cross-context behavioral advertising)
• Non-discrimination for exercising your rights

10. Children's Privacy

The Service is not intended for users under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a person under 18, we will delete it promptly.

11. Third-Party Links

The Service may contain links to third-party websites or services, including connected brokers, our billing pages (hosted at billing.propstax.com and powered by Stripe), and prop-firm portals. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

12. Cookies and Tracking Technologies

12.1 Cookies We Use

• Essential: authentication, security, site functionality. Required.
• Preferences: theme, layout, and UI choices. Persistent.

12.2 Counting Visits to propstax.com

Our own script on https://propstax.com (not in the app) counts visits, so we can see which posts and ads bring people to the site. For each page you open, it sends us the page you opened, the site that linked you there (the site alone, never the page on it; for a link in an Android app, the app's package name), any campaign tags in the link, and whether you clicked to sign up or sign in or sent the notify-me form (never the email address you type). It sets no cookies and stores nothing in your browser.

Our server reads your IP address and your browser's user-agent string to count each visitor once a day without a cookie, and stores neither. Nothing else stores them either: access logging is off where the script sends its counts, and we keep it off. To keep a script from flooding the counter, the server also holds, in its memory alone, a one-way code of your address made with a random key of its own (two for an IPv6 address: one from its first 64 bits and one from its first 48), and never writes it down. The server may run as several copies, and the copy holding the code drops it at the first request of any kind that copy receives after the minute ends (or, once one of the day's limits has turned your address away, after the day ends), or when that copy stops, whichever comes first. Days run midnight to midnight, Pacific time. This is everything it keeps:

• A visitor code: a one-way code made from your IP address, your user-agent string and a random key that changes every day. With it we keep where your visit came from (the linking site or app, or the campaign tags), the pages you opened that day, and your number among that day's visitors. It expires 26 hours after the day ends.
• An address code: a one-way code made from your IP address and the same daily key (for an IPv6 address, from its first 64 bits, with a second code from its first 48), with how many times your address reached the counter that day and how many new sources or campaign tags it added, so that a script cannot flood it. It expires 26 hours after the day ends.
• The day's key, which expires when the day ends. Once the next day is a minute old, the counter deletes it by the first visit it counts or the next run of our own check, even if that comes days later; if that deletion fails, our database deletes it on its own, as below.
• The day's new sources and campaign tags: the campaign tags in links and the linking sites and apps first seen that day, at most 100 of each kind, with no code. Well-known sites we count by name, such as search engines, social networks and webmail, are not listed. They expire 26 hours after the day ends.
• A list of recent events: each page view, click and form sent, with its page, source, campaign tags and time, and the visitor's number for that day, which ties one browser's events that day to each other. It holds no code and no address, and each entry expires three days after it happened.
• Totals: page views, visitors, clicks and forms sent, by day and hour, source, campaign, post and page, with no code and no address. These are kept with no end date.

When something expires, our database deletes it on its own, usually within a few days. Once a day's codes and key are deleted, that day's visits can no longer be linked to an IP address or a browser. That holds because this data is kept out of our database backups and point-in-time recovery is off for it, and we keep it that way. Our admin console, which only we use, shows the totals and the list of recent events. None of it is shared with anyone.

12.3 Third-Party Analytics

We currently do not deploy third-party analytics (Google Analytics, Mixpanel, etc.) on the Service. If that changes, we will update this policy and disclose the providers above.

12.4 Do Not Track

Our Service does not currently respond to "Do Not Track" browser signals.

13. Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated by:

• Posting the updated policy on this page
• Updating the "Last Updated" date above
• Sending an email notification for material changes (when we have your verified email)

Continued use of the Service after a change is posted constitutes acceptance of the revised policy.

14. Contact Us

Questions, concerns, or requests:

PropStax
Email: support@propstax.com
Website: https://propstax.com

15. Summary of Key Points