Privacy policy

Last updated: 14 October 2026

1. Controller

The controller responsible for processing your data is Dejan Aleksić, Gaswerkstraße 5/51, 1210 Wien, Austria, email: office@crypdeks.com.

This policy describes which data CRYPDEKS processes, for what purpose and on which legal basis under the General Data Protection Regulation (GDPR).

2. Visiting the website

When you open a page, the hosting provider processes technically necessary data: IP address, time, page requested, browser and operating system. This is needed to deliver the page and to defend against attacks. Legal basis: Art. 6 (1) (f) GDPR.

CRYPDEKS serves its fonts, images and scripts itself. No analytics, advertising or tracking services are used.

3. Cookies and local storage

CRYPDEKS uses only technically necessary cookies:

sign-in cookies so you stay logged in
a cookie for the chosen language
where needed, a cookie for previewing the free version

Your browser also stores individual settings locally, for example the account last selected in the journal or that you dismissed a notice. No consent is required for this. Legal basis: Art. 6 (1) (b) and (f) GDPR.

4. Account and use of the app

When you create an account we process:

email address, name and an encrypted password
if you switch on two-factor sign-in: the secret key your authenticator app uses to generate the codes
your cockpit settings (time zone, language, windows, panel layout, lot calculator, your own rules)
your daily bias entries
journal data: accounts with starting balance and limits, trades with instrument, times, prices, result, notes and uploaded screenshots
the status of your trial and subscription
MetaTrader plugin: If you connect the “CRYPDEKS Lot Calculator” plugin to your account, it queries the status of your news windows, your rule guard and your Pro access from us and reports its version and the MetaTrader account it runs in (account number, broker, server, currency, balance and first deposit). The rule guard then works with exactly this account; if your journal has no account for it yet, we create one. It uses a personal key that you can delete or renew on the account page at any time. We store when the plugin last reported in and with which version, and show you this on the account page. From version 1.64 the plugin sends your closed trades (position number, symbol, direction, lot size, prices, stop loss, take profit, times, result, commission, swap, risk at the stop) to your journal shortly after they close, the first time for the last 7 days, so the rule guard works with current figures. You can switch this off in the plugin inputs (“InpSendTrades”). Versions 1.60 to 1.63 send no trades, older ones only if you switched the transfer on. For the rule guard we also store, once a day per account, the balance at the start of the day. Login details for your broker are never transferred. Legal basis: performance of the contract (Art. 6 (1) (b) GDPR).

We need this data to provide the app. Legal basis: Art. 6 (1) (b) GDPR. Your journal data is visible only to you. We do not analyse it for our own purposes and do not pass it on.

5. AI features: prop firm rules and economic events

CRYPDEKS regularly has Anthropic, PBC (USA) search the web for the rules of well-known prop firms (profit target, loss limits and the like) and stores them. Only the firm’s name and the account type are transmitted, no data of yours. When you enter a firm on an account, we show you the stored rules.

CRYPDEKS also has Anthropic, PBC (USA) compile the economic events from public sources. No data about you is sent. There is no feature in the journal or the cockpit that sends your data or images to an AI.

6. Payment

Payments are handled by Stripe Payments Europe, Ltd. (Ireland). Stripe receives your email address and the payment details you enter there. We do not store card or bank details ourselves, only Stripe’s customer and subscription numbers and the status of your subscription. Legal basis: Art. 6 (1) (b) GDPR. We keep invoice data for as long as tax law requires (currently seven years). Legal basis: Art. 6 (1) (c) GDPR.

If you cancel a subscription, our payment service Stripe asks for the reason. Answering is voluntary. We store your choice and comment together with plan and end date in order to improve the service. Legal basis: Art. 6 (1) (f) GDPR.

7. Notifications

If you switch on notifications, we store the technical address of your device at your browser’s push service (Apple, Google or Mozilla) and the times you chose. Messages are delivered through that service. You can switch notifications off in the settings at any time. Legal basis: Art. 6 (1) (a) GDPR.

8. Waitlist

If you join the waitlist, we store your email address, the chosen language and the time. We use it only to confirm your sign-up once by email and to tell you about the launch; we send these emails via Resend (see 8a). Legal basis: Art. 6 (1) (a) GDPR. You can ask for deletion by email at any time.

8a. Feedback and error log

If you write to us via the “Feedback” button, we store your message, the type of message, the page you were on, your language, whether you use Free or Pro, and your browser, device and screen size. We use this to handle your request and fix bugs. Legal basis: Art. 6 (1) (b) and (f) GDPR.

If part of the page crashes for a signed-in user, the app stores the technical error message together with page, language, browser and device. Inputs and trades are not transmitted. We use the log only to find and fix errors. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a working application).

So that we can respond quickly, each report is also delivered to us by email. For this we use the delivery service Resend (Resend, Inc., USA) as a processor. The email contains your message or the error message, your email address, and page, language, browser and device. The transfer to the USA is based on standard contractual clauses.

9. Emails

We send you emails that are necessary for the account (address confirmation, password reset, subscription notices). If you write to us, we process your message in order to answer it. Legal basis: Art. 6 (1) (b) and (f) GDPR.

10. Recipients and processors

We use the following service providers, which process data on our behalf:

Supabase, Inc. (USA): database, sign-in and file storage. The data is stored on servers in Frankfurt (EU).
Vercel Inc. (USA): hosting of the website
Stripe Payments Europe, Ltd. (Ireland): payment processing
Push services of Apple, Google and Mozilla: delivery of notifications

Where data is transferred to the USA, this is based on the EU Commission’s adequacy decision (EU-U.S. Data Privacy Framework) if the provider is certified, otherwise on the EU Commission’s standard contractual clauses (Art. 46 (2) (c) GDPR).

Beyond that we only pass on data where we are legally obliged to.

11. Storage period

We store your data for as long as your account exists. If you delete your account, we delete the account, settings, journal data and screenshots. Data we must keep for legal reasons (in particular invoice data) remains stored until the period ends.

You delete your account yourself on the account page under “Security”. If a subscription is still running, it is ended in the process. You can also request deletion by email to office@crypdeks.com.

You can download your stored data as a file at any time on the account page under “Security”.

12. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw consent at any time with effect for the future. Please write to the address above.

If you believe the processing of your data infringes data protection law, you can lodge a complaint with the supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria, www.dsb.gv.at.

13. Obligation to provide data, automated decisions

Without an email address and password you cannot create an account. All other information is voluntary. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

14. Users outside the European Union

We handle the data of all users according to the rules of the GDPR, whichever country you live in. Your data is stored in the EU; if you use CRYPDEKS from outside, it is therefore transferred to and processed in the EU.

The rights listed in section 12 are available to you everywhere. If the data protection law of your country of residence gives you further rights, for example UK data protection law, the Swiss Data Protection Act, the Brazilian LGPD or the laws of individual US states, you can exercise them by writing to the email address above. We do not sell personal data and do not share it for advertising purposes.

15. Changes

We update this policy when the app or the law changes. The version published here applies.