NeoTLog ("we", "us") is operated by NeoTradeLog AB (org. nr 559596-8115, VAT nr SE559596811501), Hörnbovägen 5B, 756 55 Uppsala, Sweden. For any privacy question or request, contact support@neotlog.com. For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller of the personal data described below.
This explains what personal data NeoTLog collects, why, how we store and protect it, who we share it with, and the rights you have. It applies to the NeoTLog website (neotlog.com) and web application.
Account data. When you create an account we collect your email address and a password. Your password is never stored in plain text — it is stored hashed by our authentication provider (see Section 5). If you choose Continue with Google instead, Google confirms your identity and shares your name, email address and profile picture with us; no password is created, and we never receive your Google password or access to your Google account beyond that basic profile. If you turn on two-factor sign-in, our authentication provider also stores the secret key your authenticator app uses to make its codes. If you fill them in under Settings → Account, we also store your name, a username and the markets you trade — all optional.
Trading data you create or import. The trades you import or enter (such as symbols, quantities, prices, profit/loss, dates and times), plus anything you add: notes, tags, strategies and trading rules, your accounts (their names and any starting balance, deposits, withdrawals and prop-firm rules you enter), journal entries, reviews and missed trades, fee settings and display settings (currency, time format, week start and time zone; the time zone starts as your device's own and can be changed in Settings). You provide this data; we store it so the app can display and analyze it for you. Trading data may constitute personal data when it can be linked to your NeoTLog account or otherwise identify you. We use this information only to provide the journal and analytics features you request.
Local data on your device. The app keeps a copy of your data in your browser's local storage so it loads quickly and works offline. This stays on your device and is cleared if you clear your browser data.
AI report data (Pro). If you generate an AI performance report, the app sends summary statistics only for the period you selected — totals such as win rate, profit factor, expectancy, maximum drawdown and streaks, P&L per hour/day/session/strategy, per-symbol P&L totals for your five most-traded symbols, the P&L sequence of your last 10 trades, and — where you have recorded the relevant data — aggregate risk statistics (R-multiples such as average and median R and win/loss R), aggregate excursion statistics (MAE/MFE and exit-efficiency averages), and aggregate economic-news-day statistics (performance on days with a tracked economic release versus quiet days). All of these are aggregates for the period, sent with your journal's time zone so the hour and weekday breakdowns read correctly. Your full trade records, individual prices, order details, notes, account names, and email are never included, and no screenshot is ever sent with a report — the separate screenshot SL/TP reader is described below. The generated report is stored with your account data so you can re-read it.
Billing data. If you subscribe to a paid plan, your purchase is handled by Stripe and Link (see Section 5). We receive and store your subscription status (plan, status, renewal date, and whether it is set to end) and the Stripe customer and subscription IDs that link it to your account, so the app can unlock your tier; your billing cycle and payment details are not stored by us — Link and Stripe keep them. Your card number never reaches our servers — it is entered on and processed by Stripe. If you start the free trial of Pro, we store when it started and when it ends, so that it can be used once and the trades you add during it are left out of the Basic plan's yearly count.
Partner codes. If you enter a partner's code at checkout (for example a creator's or a trading community's), Stripe records that your purchase used it. So that we can pay the partner their commission and check the terms of their partnership, we keep a list of the customers each code brought in: the code, your Stripe customer ID, the date of your first payment, and whether a payment was refunded or disputed — never your name or email address. The partner receives the dates and amounts of the payments their commission is based on, never who you are.
Usage analytics. To understand which features are used and where people get stuck, we collect pseudonymous usage events (for example "opened the reports tab", "imported a file from Tradovate", "a file could not be imported", "started checkout"). We store them ourselves, in our own analytics database hosted by Cloudflare in the EU. This is cookieless: no analytics identifier is stored on your device. With each event we record the page, your plan and the app theme you use, the website that referred you, your approximate country (worked out from your IP address — the address itself is not stored), your type of device, browser and operating system, and the campaign tag of the link you arrived by, if it has one. To count visitors without placing anything on your device, a visitor code is calculated from your IP address and browser together with a secret value that changes every day and is then deleted, so visits cannot be linked from one day to the next. For signed-in users, events are linked to a random account identifier (never your name or email) so we can see feature usage across visits. That identifier is why we call these events pseudonymous rather than anonymous: they carry nothing that names you, but we can tell that the same account did two things. Each time you open the app, and again when your journal changes, we also record a few counts about your journal, so we can see what kinds of traders use NeoTLog: how many trades it holds of each type of instrument (futures, stocks, options, forex, CFDs, crypto), how many trading accounts you have, and which markets you ticked in your profile. These are counts only. Your trades themselves, symbols, prices, P&L values, notes, journal entries, screenshots, and the contents or names of files you import are never sent to analytics. On our public pages (not inside the app) we also record which links and buttons are clicked. When something breaks in the app or on the website, an error report (the technical error message and where in the code it happened) is sent the same way so we can fix it; sign-in links, codes and email addresses are removed before it is stored. You can turn analytics and error reports off at any time in Settings → Account → Privacy. Your choice is saved with your account, so it applies on every device where you are signed in, and we count how many accounts have analytics turned off — only that number; nothing else about those accounts is recorded in our analytics. Errors in our own server (for example, a payment notification we could not process) are recorded in the same database, without your account identifier or anything else that identifies you.
Screenshots. Images you attach to trades are stored with your account, so they are there on every device you sign in on. They are held in private per-account storage at Supabase, in the EU (Ireland) — the same processor that holds the rest of your journal — and can only be retrieved by your own signed-in account; there is no public or shareable link to them, unless you put one in a share picture or let a mentor see your screenshots (see Sharing below). A copy is also kept in your browser so they load instantly and still open when you are offline. Screenshots are never included in your AI reports, and are not used for any purpose other than showing them back to you. As with everything else you store with us, our staff can reach them in the course of running and supporting the Service, but we do not look at them unless you ask us to while helping with a problem. Deleting a screenshot deletes the stored copy; deleting your account deletes all of them. The one automated exception is the screenshot reader described next, which only ever runs when you press its button.
Until 20 September 2026 screenshots were kept only in the browser they were added in. If you attached images before that date, they are moved into your account automatically the next time you sign in on that same browser while on a plan that includes screenshots. Images added in a browser you no longer use, or that has since been cleared, cannot be recovered — there was never a second copy.
Screenshot SL/TP reader (Pro). If you use the screenshot reader on a trade, the app sends a downscaled copy of that one image — together with an enlarged crop of its price axis, and the trade's direction and entry price to check the read — to our server, which passes it straight on to Anthropic's Claude to read the stop-loss and take-profit levels printed on it. Only the prices it read come back to you, as a suggestion you confirm or discard. The image is not stored: our server holds it only for the moment it takes to handle the request and keeps no copy, nothing is written to your account, and under Anthropic's commercial API terms it is not used to train their models. Each read uses 1 of your AI credits.
AI assistant (Pro). If you ask the AI assistant a question, the question goes to our server, which passes it on to Anthropic's Claude. Claude doesn't receive your journal: it asks the app for the figures it needs (statistics, a breakdown, a list of trades), the app works them out in your browser, and only those results are sent on. They can include individual trades: dates and times, symbols, sides, sizes, prices, P&L, strategy and tag names, the first 200 characters of a trade's notes, your account names and balances, the text of your automatic trading rules and which trades broke them, your prop-firm rule figures, and your journal's time zone and week start. With a follow-up question, the last two questions and answers are sent again so it makes sense. If you choose Ask about this report, the text of that saved AI report goes along with each question until you clear it. Nothing of the question, the figures or the answer is stored on our server, and under Anthropic's commercial API terms none of it is used to train their models. The chat itself is kept only in your browser tab, until you reload the page. Each question uses 2 of your AI credits.
AI connections (optional, Pro). If you add NeoTLog as a connector in an AI app of your own, such as Claude or ChatGPT, you sign in and approve that app in NeoTLog. From then on it can read from your journal through our server, when you use it: your account names and types; your trades (dates and times, symbols, sides, sizes, prices, stops, P&L, strategy and tag names, the first 200 characters of a trade's notes); statistics worked out from them; your journal entries and reviews with their emotions, goals and ratings (up to 1,500 characters a box); and your currency, time zone and week start. It never gets your screenshots, and it can only read: it cannot add, change or delete anything. What it reads goes to that app, which handles it under its own terms and privacy policy and your plan with it, not ours. We keep the app's name, the address it returns to, when you connected and last used it, a daily count of its reads, and scrambled fingerprints of its sign-in tokens (never the tokens themselves). We do not store what it asks or what it reads. To work out figures in your currency, our server fetches exchange rates from Frankfurter, sending only currency codes and dates. You can disconnect an app at any time in Settings → AI connections, which ends its access at once.
Broker auto-sync (optional, Pro). If you switch on Broker auto-sync under Settings → Early access and connect a trading account, you authorize us to read that account's completed trades on your behalf. You do that by creating a read-only API key (or, at Lighter, Paradex and PropReports, a read-only token) at the provider and giving it to us — or, for an exchange whose trade history is public on its blockchain (Hyperliquid, dYdX, GMX), by giving us your wallet address, which can only be read — or, for MetaTrader 4 and 5, by running our NeoTLog Sync expert in your own MetaTrader with a sync token we give you: it reads that account's trade history there and sends it to us with the account's number, server and currency, and it never places, changes or closes an order. We only ever ask for permission to read: where a provider lets us check what a credential can do, we check it before accepting and refuse anything that can place orders, withdraw or transfer funds. Where a broker offers a sign-in connection instead, you sign in on the broker's own website — your login details are never shared with us — and allow NeoTLog read access there; the broker then gives us an access token for that account (with some brokers also a refresh token, which renews it), and we treat those tokens exactly like a key. What you give us is stored encrypted, with the encryption key held only by our server, so our database never holds it in readable form (of a MetaTrader sync token we keep only a fingerprint, which can't be turned back into the token). It is used for nothing but pulling your own completed trades while you are on the Pro plan — plus, if you connect without naming the instruments yourself, a single read of what your account currently holds, so we can work out which instruments to sync. At Crypto.com only, one check when you connect asks it to cancel an order that doesn't exist (a made-up number, so nothing can be cancelled): that is the only way to tell whether a key can trade, and a key that can is refused. It is never shown back to you or to anyone else, and is deleted — together with the raw fills we pulled — when you disconnect the account, 30 days after your Pro plan ends (syncing pauses in the meantime and resumes if you are back on Pro by then), or when you delete your NeoTLog account. Trades already imported into your journal stay there, exactly as they would after a file import, and you can delete them yourself. You can also revoke our access at the provider at any time, which stops the sync immediately (a public wallet address can't be revoked: disconnecting it here stops that sync; for MetaTrader, removing NeoTLog Sync from your charts stops it, and disconnecting or making a new token here makes the old token useless). The feature is off unless you turn it on, and the app shows which brokers and exchanges are currently supported (at present, Binance, Bybit, OKX, Kraken, Bitget, KuCoin, MEXC, Coinbase, Gemini, Deribit, Crypto.com, BingX, BloFin, Hyperliquid, dYdX, Lighter, Paradex, GMX, Interactive Brokers and MetaTrader 4 and 5).
Suggestion board. If you post a suggestion, the text you write is shown publicly on the Updates page once it is approved, under an anonymous handle worked out from your account ID (for example "whinchat-a890") — never your name or email address. A masked form of your email address (for example "is***") is kept with the post so we can moderate it. How you vote is not shown to anyone — only the total. Your suggestions and votes are removed if you delete your account.
Sharing (optional). Share pictures of a trade, a day, a month, a review or your equity curve are made in your browser and stay on your device unless you post them yourself. If you choose Create link, that picture and a short caption made from what it shows are stored with your account at Supabase, in the EU (Ireland), and shown to anyone who opens the link (neotlog.com/s/…); search engines are asked not to list it, and we count how many times it was opened without storing anything about who opened it. If you invite a mentor, we store the email address you enter and send that person one invitation email through Resend, which shows your email address. Once they accept, signed in with an account under that address, they can view the accounts you chose, read-only, with your notes, journal, reviews and screenshots only if you allowed them (journal entries and reviews aren't tied to an account, so they are shared only when every account is chosen); our server checks their access every time, and screenshots reach them through links that stop working after an hour. Comments you and a mentor write on your trades are stored with both accounts. You can delete links, change or end a mentor's access, and delete your own comments at any time in Sharing, and a mentor can leave; deleting your account deletes your links, invitations and the comments on your trades. Please only invite someone whose email address you may give us.
What we do not collect. We do not see or store your card details. We do not sell your data, and we do not use it for advertising. NeoTLog does not sell personal information and does not share personal information for cross-context behavioral advertising. NeoTLog never receives your broker or exchange login credentials — your username, password or two-factor codes — and never places orders, executes trades, or acts on your behalf with any broker or trading platform. The optional Broker auto-sync feature described above works only with a read-only API key or token that you create and can revoke — or, for Hyperliquid, dYdX and GMX, your public wallet address, or for MetaTrader, our NeoTLog Sync expert, which only reads the trade history in your own MetaTrader — which can read your completed trades and nothing more. Where a broker offers a sign-in connection instead, you allow that read access on the broker's own website, where you can also revoke it. You remain solely responsible for your brokerage accounts and trading activity.
| Purpose | GDPR legal basis |
|---|---|
| Create and operate your account; provide the journal features | Performance of a contract |
| Authenticate you and keep your account secure | Contract / legitimate interests |
| Maintain, debug, and protect the service from abuse | Legitimate interests |
| Understand feature usage and improve the product (pseudonymous, cookieless analytics with an opt-out) | Legitimate interests |
| Read stop-loss and take-profit levels from a screenshot you submit, and sync trades from an exchange you connect (both optional, both started by you) | Performance of a contract |
| Let an AI app you connect read your journal (optional, started by you) | Performance of a contract |
| Show share links you create, and give the mentors you invite read-only access (both optional, both started by you) | Performance of a contract; for the invited person's email address and their invitation email, legitimate interests (delivering the invitation you asked us to send) |
| Pay partners commission on purchases made with their code, and check their partnership terms | Legitimate interests |
| Comply with legal obligations | Legal obligation |
We use the third-party services below, and they fall into two groups. Supabase, Cloudflare, Anthropic and Resend act as our processors: they handle personal data on our behalf, only on our instructions, under a data processing agreement. Stripe and Link, Google, the brokers, exchanges and market-data providers, and any AI app you connect yourself are independent of us — Link sells the subscription to you in its own name, and each of the others decides for itself how it handles what it receives, under its own terms and privacy policy.
Your account and trading data are stored within the European Union (Ireland) and are not transferred outside the European Economic Area for storage. However, some service providers used to operate and protect the Service (for example, payment, email, network protection, and the AI features) may process data outside the European Economic Area: limited technical or account information, and, for the AI features, what you choose to send them (Section 3). An AI app you connect yourself may do the same with what it reads, under its own terms. Where required under GDPR, appropriate safeguards such as the European Commission's Standard Contractual Clauses are used to protect that data.
We keep your account and trading data for as long as your account is active. Trades and journal entries you delete stay in the trash for 7 days, where you can restore them, and are then removed for good, sooner if the trash is full or you empty it. If you delete your account, or ask us to delete your data, we remove it from our live systems within 30 days, except where we must retain certain records to comply with the law. In particular, invoices and payment records are kept for as long as Swedish accounting law requires (currently seven years) even after your account is deleted. If you used a partner's code, its record (Section 3) is kept while that partner can still earn commission on your payments; records of what we paid out are kept as accounting law requires.
Share links, mentor invitations and comments are kept until they are deleted in Sharing (a comment by the person who wrote it), the mentor's access ends, or the account is deleted.
An AI connection is kept until you disconnect it, until it has gone 90 days without signing in again, or until the account is deleted. What the app has already read stays with that app, under its own terms.
Usage events and error reports in our own analytics database are deleted automatically after about 13 months, and deleting your account deletes the usage events linked to it straight away. The daily visitor code described in Section 3 cannot be recalculated once its day has passed, because the secret value it depends on is deleted. Until 13 October 2026 the same events were also sent to PostHog (hosted in the EU), which we used while moving usage analytics to our own database; we stopped on that date and deleted our PostHog project, with every event it had received.
Under GDPR you have the right to access, correct, delete, restrict, or object to the processing of your data, to receive it in a portable format, and to withdraw consent where processing is based on consent.
You also have the right to complain to your supervisory authority. In Sweden this is the Integritetsskyddsmyndigheten (IMY), imy.se.
Data is transmitted over encrypted connections (HTTPS). Access is restricted at the database level so you can only access your own records, and those someone has chosen to share with you as their mentor (row-level security), and passwords are stored hashed. No system is perfectly secure, but we take reasonable measures to protect your information.
If you discover a security vulnerability, or suspect your account has been accessed without your permission, please report it to security@neotlog.com so we can respond quickly.
NeoTLog uses essential browser storage and login session mechanisms to keep you signed in, maintain security, cache your data for performance, and provide core application functionality. We do not use advertising cookies or third-party tracking cookies. Our usage analytics (Section 3) is deliberately cookieless: it stores no cookie and no identifier of any kind on your device, which is why no cookie consent banner is shown. The only analytics-related value ever written to your browser is your own opt-out preference if you turn analytics off. If you subscribe, Stripe's hosted checkout and billing pages set their own cookies for payment security and fraud prevention — these are governed by Stripe's cookie policy.
NeoTLog is not intended for anyone under 18, and trading-related tools are not appropriate for minors. We do not knowingly collect data from children. If we become aware that we have collected such data, we will take reasonable steps to delete it.
We may update this policy from time to time. We will post the new version here and update the "Last updated" date.
NeoTradeLog AB (org. nr 559596-8115, VAT nr SE559596811501), Hörnbovägen 5B, 756 55 Uppsala, Sweden
General inquiries: info@neotlog.com
Support & privacy requests: support@neotlog.com
Security problems and suspected account misuse: security@neotlog.com
Risk Disclosure: Futures and forex trading contains substantial risk and is not for every investor. An investor could potentially lose all or more than the initial investment. Risk capital is money that can be lost without jeopardizing ones’ financial security or lifestyle. Only risk capital should be used for trading and only those with sufficient risk capital should consider trading. Past performance is not necessarily indicative of future results. The same applies to trading stocks, options and cryptocurrencies; the CFTC's customer advisories explain more about the risks of trading virtual currencies. NeoTLog is a trade-tracking and analytics tool, not a broker or adviser, and does not provide financial, investment or trading advice.
Hypothetical Performance Disclosure: Hypothetical performance results have many inherent limitations, some of which are described below. No representation is being made that any account will or is likely to achieve profits or losses similar to those shown; in fact, there are frequently sharp differences between hypothetical performance results and the actual results subsequently achieved by any particular trading program. One of the limitations of hypothetical performance results is that they are generally prepared with the benefit of hindsight. In addition, hypothetical trading does not involve financial risk, and no hypothetical trading record can completely account for the impact of financial risk of actual trading. for example, the ability to withstand losses or to adhere to a particular trading program in spite of trading losses are material points which can also adversely affect actual trading results. There are numerous other factors related to the markets in general or to the implementation of any specific trading program which cannot be fully accounted for in the preparation of hypothetical performance results and all which can adversely affect trading results.
Live Trade Room Disclosure: This presentation is for educational purposes only and the opinions expressed are those of the presenter only. All trades presented should be considered hypothetical and should not be expected to be replicated in a live trading account.
Testimonial Disclosure: Testimonials appearing on this website may not be representative of other clients or customers and is not a guarantee of future performance or success.
