← Back
Privacy Policy
Last updated: June 16, 2026
Plain English: We collect only what's needed to run the app. We don't sell your data. You can export or delete everything at any time. No third-party ad networks. No data brokers.
Who we are
TradeFlow Quantum is owned and operated by Crosspoint Capital Inc., a Pennsylvania corporation (S-corp tax election). For purposes of GDPR, CCPA, and other applicable privacy laws, Crosspoint Capital Inc. is the data controller for personal data processed through this service. Contact: support@tradeflowquantum.com.
What we collect
You provide: Email (via Clerk auth), trade data, settings, optional broker OAuth tokens (encrypted at rest), optional Polygon API key (encrypted at rest).
Auto-collected: Page views (PostHog, opt-in, no PII), server request logs (30 day retention via Vercel), and — once you’re signed in — how much time your account spends actively using the app, accumulated per day. That last one is first-party (it never leaves our database, goes to no third party, and sets no cookie); we use it to see which features earn their keep. It counts only while the tab is actually open in front of you.
NOT collected: Passwords (Clerk handles), broker account numbers, SSN, geolocation, browsing history, marketing identifiers.
Auto-collected: Page views (PostHog, opt-in, no PII), server request logs (30 day retention via Vercel), and — once you’re signed in — how much time your account spends actively using the app, accumulated per day. That last one is first-party (it never leaves our database, goes to no third party, and sets no cookie); we use it to see which features earn their keep. It counts only while the tab is actually open in front of you.
NOT collected: Passwords (Clerk handles), broker account numbers, SSN, geolocation, browsing history, marketing identifiers.
How we use it
Email → authentication + the weekly digest. Trade data → analytics + reports you can see. Broker tokens → auto-syncing your fills (encrypted at rest). Anonymized page views → product improvement. We share nothing with advertisers.
Third-party services we use to run the app
We don’t sell your data. We do process some of it through these services because we can’t run the product without them. Each one is named, its role, what data it sees, and where it’s hosted. The full canonical list lives at /subprocessors (mirrored here for easy reading; the canonical page is the one our DPAs reference).
| Provider | Role | What it sees | Region |
|---|---|---|---|
| Clerk | Authentication | Email, password (hashed), IP at sign-in, optional 2FA factors | US |
| Supabase | Database + storage | All app data: trades, settings, audit log, broker connections | US (configurable) |
| Vercel | Hosting, request logs | IP + URL + user-agent for every request, 30-day retention | US/EU edge |
| Polygon.io | Price feed (calendar quotes + bar replay) | Symbols you've traded — fetched only when you visit pages that need bars (calendar, trade-detail replay). No PII, no account info. | US |
| SnapTrade | Brokerage aggregator — connect Robinhood, Webull, Fidelity, Vanguard, IBKR, eToro, M1, SoFi, etc. | Your brokerage login (handled by SnapTrade — we never see it), trade and position history from the connected accounts, and a per-user identifier issued by SnapTrade. Used only when you opt in to connect a broker via SnapTrade. | US/CA |
| Resend | Weekly digest email | Your email address + digest body content | US/EU |
| PostHog | Anonymized analytics (opt-in) | Page-view URL + timestamp. We do not capture form values, clicks on PII, or session replay. | US/EU |
| Ad conversion measurement (opt-in) | Page visit and signup events plus the pixel’s own identifier, so we can tell which Reddit ads bring people who sign up. No email, no trade data, no form values. | US |
The optional providers (PostHog and the Reddit conversion pixel) are gated behind your cookie-consent choice — see the Cookies section below. Decline and neither one loads.
Broker connections
We read your trade history at the broker and nothing else — TradeFlow Quantum has no order-placement code and never places a trade on your behalf. On some brokers the grant itself is read-only; on others (Alpaca, Tradier, Tradovate, Coinbase, and the paste-token flows) it is not, and the limit is enforced by our code. Each broker page under /supported-brokers states which. Tokens are encrypted at rest with AES-256-GCM. Disconnect anytime from the Brokers page — tokens are deleted immediately and your trade history stays.
Your rights
Export: Settings → Full data backup (JSON). Includes trades, settings, audit chain, broker connection history. Encrypted columns stripped.
Clear trades: Settings → Danger zone → Clear all trades. Wipes trade history but keeps your account. Type the confirmation phrase to proceed.
Delete account: Settings → Danger zone → Delete account. One-shot full wipe. Cannot be undone. Removes every Supabase row + your Clerk sign-in.
Disconnect brokers: Brokers page. Tokens deleted immediately on disconnect.
Unsubscribe digest: Settings → Preferences → uncheck weekly digest. Or click unsubscribe link in any email footer.
Withdraw analytics consent: Use the cookie-consent banner on first visit, or clear localStorage to re-prompt. PostHog and the Reddit conversion pixel both stop on decline — neither script is loaded at all.
EU users: GDPR rights apply (access, rectification, erasure, portability — all self-serve via the buttons above). California users: we don't sell personal information.
Clear trades: Settings → Danger zone → Clear all trades. Wipes trade history but keeps your account. Type the confirmation phrase to proceed.
Delete account: Settings → Danger zone → Delete account. One-shot full wipe. Cannot be undone. Removes every Supabase row + your Clerk sign-in.
Disconnect brokers: Brokers page. Tokens deleted immediately on disconnect.
Unsubscribe digest: Settings → Preferences → uncheck weekly digest. Or click unsubscribe link in any email footer.
Withdraw analytics consent: Use the cookie-consent banner on first visit, or clear localStorage to re-prompt. PostHog and the Reddit conversion pixel both stop on decline — neither script is loaded at all.
EU users: GDPR rights apply (access, rectification, erasure, portability — all self-serve via the buttons above). California users: we don't sell personal information.
Cookies
Essential (always set, no consent required, GDPR Art. 6(1)(b) — necessary to perform the service):
• __session (Clerk) — your sign-in session.
• sb-* (Supabase) — database session bridge for your authenticated requests.
Optional (only set when you accept the consent banner; declined by default):
• ph_* (PostHog) — anonymized analytics. Stored in localStorage, not as cookies.
• _rdt_uuid (Reddit) — advertising conversion measurement. Lets us see which Reddit ad brought someone who signed up. Set only if you accept.
One advertising cookie, and only with your consent: _rdt_uuid, described above. No fingerprinting, and we never send Reddit your email, your trades, or anything you type into a form. You can decline optional cookies and the app works fully — only the anonymized analytics, browser-side error reporting, and ad measurement are disabled.
• __session (Clerk) — your sign-in session.
• sb-* (Supabase) — database session bridge for your authenticated requests.
Optional (only set when you accept the consent banner; declined by default):
• ph_* (PostHog) — anonymized analytics. Stored in localStorage, not as cookies.
• _rdt_uuid (Reddit) — advertising conversion measurement. Lets us see which Reddit ad brought someone who signed up. Set only if you accept.
One advertising cookie, and only with your consent: _rdt_uuid, described above. No fingerprinting, and we never send Reddit your email, your trades, or anything you type into a form. You can decline optional cookies and the app works fully — only the anonymized analytics, browser-side error reporting, and ad measurement are disabled.
Security
Database encrypted at rest. Broker tokens AES-256-GCM. HTTPS everywhere with HSTS preload + strict CSP. Every query scoped to your user id before it reaches Postgres (row-level security policies are enabled too, but the JWT bridge that would make them the enforcing layer is not yet configured — /security has the detail). Hash-chained audit log for tamper detection. Clerk auth with optional 2FA. See Terms for the full security posture.
Contact
Crosspoint Capital Inc.
Email: support@tradeflowquantum.com
Email: support@tradeflowquantum.com
Questions about this policy? Email support@tradeflowquantum.com and a human will reply within one business day.