Privacy policy
Slate, a trading journal · Last changed: 18 October 2026
Slate is a trading journal for your phone and your computer. You keep your trades in it, and it shows you what they say. This page explains, in plain words, what we keep about you, why, where, for how long, and what you can do about it.
Who we are
Slate is run by Michael Wright, Stanmer Court, Brighton BN1 9PU, United Kingdom (“we”). Write to us at [email protected] or through Settings → Help and feedback in the app. We are responsible for your data under the UK GDPR and the Data Protection Act 2018, and for people in Switzerland, under the Swiss Federal Act on Data Protection (FADP).
Slate isn’t offered in the European Union, Iceland, Liechtenstein or Norway yet, and accounts can’t be made from there. Before that changes, we’ll appoint a representative in the EU, as the GDPR requires, and name them here.
What we keep, and why
| What | Why |
|---|---|
| Your email address and password (the password only as a scrambled hash we can’t read) | Your account: so you can sign in on any device. |
| The country you chose when you signed up | Slate isn’t open everywhere yet (see above), and to know where our customers are. |
| Your journal: trades (tickers, dates and times, prices, amounts, fees, setups, ratings, habit tags, notes), account values, and the rows of your imports (trades, deposits, withdrawals, dividends, fees) as your broker wrote them | The service itself. We don’t look at your journal, except when you ask us to help with it. |
| Your settings: currency, trading style, your broker, setups, look, and your answers about rows we couldn’t sort | So the app fits how you trade, on every device, and to know which brokers to support best. |
| Your plan: when you signed up, your free trial, whether you subscribed and paid | To know whether you can use the app, and to run the business (how many people subscribe). |
| Messages you send us, including import reports you choose to send (“Doesn’t look right? Tell us”: your broker, how the import was read, the file’s column names and counts, never your trades or amounts) | To answer you, and to fix imports. |
| Crash reports: an error message, the page, your browser’s name, and your account if signed in | To find and fix problems. Never the contents of your journal. |
| Your email address and country, if you join the waitlist on our website | To email you once, when Slate opens, and, if you make an account with the same address, to give it the founding price and any longer free trial from a friend’s link. Nothing else, and never shared or sold. |
| Your personal link’s code, and the code of the friend whose link brought you, if one did | To give you and that friend what the invitation offers (a longer free trial; a free month when you first pay). The friend sees only how many people joined and paid through their link, never your name or email. |
The legal bases, where the GDPR applies: the contract with you (your account, journal and plan), our legitimate interest in a working, secure service (crash reports) and in knowing where our customers are (your country), and your consent (the waitlist), which you can withdraw at any time by writing to us.
What stays on your device
- Broker keys. If you connect a broker with a key and tick “Remember on this device”, the key is kept only in your browser. When you fetch your history, it passes through our relay to your broker and is forgotten: the relay keeps nothing and writes nothing down. Keys from brokers can only read your history; they can’t trade or move money.
- Broker files you choose are read on your device. What you add is saved to your account: the trades, and each row of the history as your broker wrote it, so deposits and dividends are never counted as profit and an import can be checked and corrected without uploading the file again. Undoing an import or deleting your account deletes them.
- Small notes in your browser’s storage: that you’re signed in, your look, exchange rates already fetched, and a few choices on screen. There are no advertising or tracking cookies, and the app has no analytics.
Brokers you log in to through SnapTrade
If you choose “Log in to your broker”, you log in on SnapTrade’s own page, shown inside the app: we never see your broker password. SnapTrade keeps the connection to your broker and collects your history from it once a day. Our server asks SnapTrade for that history and passes it to your account, where it’s saved like any import. To do that, our server keeps a code SnapTrade gives us for your account; only our server can read it, and it can only read your history: it can’t trade or move money. SnapTrade knows your account by a number that doesn’t name you. Disconnecting in Settings removes the connection at SnapTrade; deleting your account deletes you at SnapTrade too.
tastytrade, connected by logging in
If you connect tastytrade, you log in on tastytrade’s own page: we never see your tastytrade password. You approve read-only access, and tastytrade gives our server a code for your account. Our server keeps that code encrypted; only our server can read it, and it can only read your history and balance: it can’t trade or move money. When you open the app, our server uses it to ask tastytrade for your history and passes it to your account, where it’s saved like any import. Disconnecting in Settings deletes the code, and so does deleting your account.
Who else is involved
| Service | What for | What they see |
|---|---|---|
| Supabase (database and sign-in), servers in Zurich, Switzerland | Keeping your account and journal | Everything listed above, stored for us |
| Cloudflare (hosting the website) | Delivering the app to your browser, counting visits to the landing page (Cloudflare Web Analytics, which sets no cookies and doesn’t identify you), and checking that the part of your email address after the @ can receive email when you sign up or join the waitlist (Cloudflare’s public DNS) | Your IP address and browser, as any website does, and that part of your address (for example “gmail.com”), never the whole address |
| Resend (sending our emails), servers in the EU | Emails you ask for: confirming your address, and a link when you forget your password; and passing the messages you send us on to our inbox | Your email address and the email itself |
| Cloudflare Email Routing, and Google (Gmail, our inbox) | Emails you write to [email protected]: Cloudflare passes them on to our Gmail inbox, where we read and answer them, as we do the messages from the app | Your email address and the email itself |
| Paddle (payments, as “merchant of record”) | Selling you the subscription: Paddle is the seller, handles the payment and VAT, and sends receipts | What you give Paddle at checkout (name, email, card, country). We never see your card. Paddle’s own privacy policy applies to it. |
| Frankfurter (the European Central Bank’s exchange rates) | Converting amounts into your account’s currency | A request for a rate and your IP address; nothing about you or your trades |
| Interactive Brokers, only if you connect it with a key | Fetching your history | Your key, through our relay |
| tastytrade, only if you log in to it from the app | Fetching your history | Your tastytrade login, on tastytrade’s own page (never ours), and our server’s requests for your history |
| SnapTrade (Passiv Inc., Canada), only if you log in to your broker through it | Connecting your broker, and collecting your history from it once a day | Your broker login, on SnapTrade’s own page (never ours), and your broker history. SnapTrade’s own terms and privacy policy apply to the login. |
Some of these may process data outside the UK, Switzerland and the EU. Where they do, they are bound by the safeguards the law requires (such as standard contractual clauses). We never sell your data, your trades included, and we don’t share it with anyone else. Each of these services handles it under its standard data processing agreement with us.
How long we keep it
- Your account and journal: until you delete your account.
- When you delete your account, your trades, account values and settings are deleted at once. We keep only an anonymous record that an account signed up on a date and whether it paid, so the business figures stay right; it says nothing about who you were. Paddle keeps payment records for as long as tax law requires.
- A broker connected through SnapTrade: until you disconnect it in Settings or delete your account.
- Messages: until they’re answered, then at most 2 years.
- Crash reports: until the problem is fixed, at most 12 months.
- The waitlist: until 30 days after we’ve emailed you that Slate is open (time to make your account with the founding price), or until you ask us to remove you.
Your rights
- See and take your data: Settings → Your data downloads everything, as a spreadsheet or in full.
- Correct it: edit any trade or value in the app.
- Delete it: Settings → Delete my account deletes everything, at once.
- You can also ask us, by message or email, about anything on this page, and object to any use of your data.
- If you think we’re handling your data wrongly, you can complain to the UK Information Commissioner’s Office (ICO); in the EU, to your country’s data protection authority; in Switzerland, to the Federal Data Protection and Information Commissioner (FDPIC).
Security
Everything travels encrypted (HTTPS). Each account can reach only its own rows: the database itself enforces this, not just the app. Your password is never stored readable. The app holds no secret keys; those stay on our servers.
Children
Slate is for adults (18 and over).
Changes
If we change this policy, the date at the top changes, and for anything important we tell you in the app or by email first.