Privacy policy
This policy explains what personal data Pivotwright collects when you visit pivotwright.com, buy our products and use Pivotwright Journal at app.pivotwright.com, why we collect it, who helps us process it, and what rights you have. We collect as little as we can: the website has no cookies, no analytics and no advertising trackers, and we never sell your data.
1. Who is responsible
The controller of your personal data is Matej Krajačić, Croatia, trading under the name Pivotwright ("we", "us").
Contact for anything about privacy: support@pivotwright.com. We have not appointed a data protection officer because the law does not require one for a business of our size.
2. What we collect and why
2.1 Visiting pivotwright.com
The site is a set of static pages. It sets no cookies and runs no analytics. Like every website, the server that delivers the pages (Cloudflare) receives your IP address, the page requested, the time, and your browser's user agent. Cloudflare uses this data to deliver the site and protect it against attacks. We do not use it to identify you.
Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
2.2 Buying a product
All purchases are made through Gumroad, which acts as the seller of record ("merchant of record"). Gumroad collects your payment details, name, email address, country and any sales tax information, processes the payment, charges VAT where it applies, and sends you the download or licence key. Gumroad is responsible for that data under its own privacy policy. We never see your card details.
Gumroad shares with us the information about your purchase: your email address, the name you entered, the product, the price, the date, your country and the licence key (for the journal). We use it to deliver what you bought, to answer support requests, to handle refunds, and to keep the business and tax records the law requires.
Legal basis: performing our contract with you (Art. 6(1)(b)) and our legal obligations for accounting and tax (Art. 6(1)(c)).
2.3 Using Pivotwright Journal without an account
Without signing in, everything you enter in the journal (trades, notes, screenshots, settings) is saved only in your browser's storage on your device. It is never sent to us, and we cannot see it. Clearing your browser data or using "Delete everything" removes it.
2.4 Using Pivotwright Journal with an account
When you sign in to sync the journal between devices, we process:
- Your email address, to create your account and send you a one-time sign-in code.
- Sign-in and security records: the time of each sign-in, your IP address and browser details, kept by our database provider to protect your account against misuse.
- Your journal content: trades, day notes, screenshots and settings, so they can be synced to your other devices.
- Licence data: your licence key, the Gumroad product and sale it belongs to, the purchase email and whether the licence is active. To check a key, we send it to Gumroad's licence verification service, at activation and then about once a day, so that refunded or charged-back keys stop working.
Your journal content is private to your account. Access is limited at the database level so that only your signed-in account can read or change it. We do not read your journal, except when you ask us for help and give us permission, or where the law requires it.
Please do not upload screenshots that show other people's personal data or your full account numbers.
Legal basis: performing our contract with you (Art. 6(1)(b)); security records on our legitimate interest in keeping accounts safe and preventing licence misuse (Art. 6(1)(f)).
2.5 Emailing us
If you write to support@pivotwright.com, we receive your email address and whatever you write, and use it to answer you. Legal basis: our legitimate interest in answering you, or steps for a contract you asked for (Art. 6(1)(f) and (b)).
3. Browser storage and cookies
pivotwright.com sets no cookies. Pivotwright Journal uses your browser's local storage and IndexedDB to keep your journal on your device and, when you sign in, to remember your session so you do not have to sign in every time. This storage is strictly necessary for the service you asked for, so it does not need consent. Neither the site nor the app uses advertising, analytics or tracking cookies.
4. Who processes data for us
We use a small number of service providers. They process data only on our instructions, under data processing agreements.
| Provider | What for | Where |
|---|---|---|
| Supabase Inc. | Accounts, sign-in, database and file storage for the journal | Data stored in the EU (Ireland) |
| Cloudflare Inc. | Hosting and delivering pivotwright.com and app.pivotwright.com, security, email forwarding for support@pivotwright.com | Global network, USA |
| Resend | Sending sign-in code emails | USA |
| Google LLC (Gmail) | Our support mailbox | USA / EU |
Gumroad Inc. (USA) processes your purchase as an independent controller, as described in 2.2.
Some of these providers are based in the USA or can access data from there. Where data leaves the European Economic Area, the transfer is protected by the EU-U.S. Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.
5. How long we keep data
- Account and journal data: for as long as your account exists. When you use "Delete everything" while signed in, your trades, notes, screenshots and settings are deleted from your account; a small marker without content stays for each deleted item so that your other devices also delete it. If you ask us to delete your account, we delete it and everything in it within 30 days.
- Licence data: for as long as your account exists, and the purchase record as long as tax and accounting law requires.
- Purchase and invoice records: as long as Croatian accounting and tax law requires (generally up to 11 years).
- Sign-in and security records: kept by our providers for a limited time, normally no more than 90 days.
- Support emails: up to 3 years after the conversation ends, unless we need them longer to handle a claim.
6. Your rights
Under the GDPR you have the right to:
- get a copy of your personal data (access);
- have incorrect data corrected;
- have your data deleted;
- restrict how we use it, or object to processing based on our legitimate interest;
- receive your data in a portable format. The journal's Settings already let you download everything as a CSV file or a full backup.
To use any of these rights, email support@pivotwright.com from the address on your account. We answer within one month. It is free.
You also have the right to complain to a data protection authority. In Croatia this is the Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, azop.hr); you can also complain to the authority in the EU country where you live or work.
7. Security
All connections use encryption (HTTPS). Journal data is protected by account-based access rules in the database, screenshots are kept in private storage, and sign-in uses one-time codes instead of passwords. No system is perfectly secure, so keep your own backups too.
8. Children
Our products are about trading and are meant for adults. They are not intended for anyone under 18, and we do not knowingly collect data from children.
9. No automated decisions, no selling
We do not make decisions about you by automated means that have legal or similar effects, we do not profile you for advertising, and we do not sell or rent your personal data.
10. Changes
If we change this policy, we will publish the new version here with a new date. If a change matters for account holders, we will also tell them by email before it takes effect.