PastPips← Back to PastPips

Privacy policy

Last updated: 7 November 2026

This policy explains which personal data PastPips collects, why, for how long, who receives it, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

Ali Al-Fadhil, PastPips, Beethovenstraße 8
29664 Walsrode
Germany. Email: pastpips@gmail.com. More in the Imprint.

2. What we collect and why

Visiting the website

When you open a page our server and our network provider Cloudflare process your IP address, the time, the address requested and your browser's user agent, to deliver the page and to protect the service against attacks (Art. 6(1)(f) GDPR, our legitimate interest in a secure service). We count daily visitors without cookies: a one-way hash of the IP address and browser, salted per day, is kept in memory only for that day; only the daily total is stored. For a map of where visitors come from, Cloudflare tells us the approximate city and country of each visit; we store only the city, country and rounded coordinates (about 10 km) with a daily count, never the IP address.

Your account

Name, email address and a password (stored only as a salted hash). With Google sign-in we receive your name, email and profile picture from Google. Purpose: to provide your account (Art. 6(1)(b) GDPR, the contract). When you sign in we store the time, IP address and browser of the session to keep your account secure and to show suspicious sign-ins (Art. 6(1)(f) GDPR), together with the approximate city and country Cloudflare gives for the IP address; sessions end after 30 days. An account can be signed in on one device at a time: signing in on a new device ends the session on the other one, and we keep a record of that to spot shared accounts (Art. 6(1)(b) and (f) GDPR).

Profile picture

If you add a profile picture, your browser first crops it to a square and shrinks it to 256 × 256 pixels; only that small copy is sent to and stored on our server, and it is shown to you in the app (Art. 6(1)(b) GDPR). The file you pick may be at most 2 MB. You can change or remove it at any time in Account settings → Profile; removing it deletes it from our server. It is part of your account and is deleted with it.

Your work in the app

Strategies, trades, notes, live tests, replays and reports you create are stored on our server so you can use them on any device (Art. 6(1)(b) GDPR). Trades you delete go to a trash in the app and are erased for good when you empty it or after 14 days. On the Team plan, the leader can see the work of the team's profiles, and the Team workspace shows every member of the team the backtest results (strategies and trades, without email addresses) of all the team's profiles (Art. 6(1)(b) GDPR). If you share a view-only password, whoever has it can see your work.

Payments

Payments are handled by Stripe (Stripe Payments Europe Ltd., Ireland). Card details go straight to Stripe and never reach our server. We receive and keep your subscription, invoices and payment status (Art. 6(1)(b) GDPR) and keep invoices as long as tax law requires (usually 10 years, Art. 6(1)(c) GDPR).

Emails we send

We send you emails that the service needs: sign-in codes, codes to confirm a password reset, deactivating or deleting your account or bringing a deleted account back, confirmations of your subscription, cancellation or withdrawal, and a note if someone tries to register with your address. They also include a copy of a support chat when it ends. They are sent through Resend, Inc. (USA) as our processor (Art. 6(1)(b) GDPR). We do not send newsletters or advertising.

Confirming new devices

When you create an account or sign in on a new device or browser, we email you a 6-digit code. After you enter it, we remember that device for up to 180 days with the cookie pp_device and a list of your trusted devices (time, browser), so you are not asked again. This protects your account and stops accounts being shared (Art. 6(1)(b) and (f) GDPR).

Keeping the service safe

To stop abuse we may suspend an account or block an IP address for a time, with a short reason that only our admins see, and we keep counters of failed attempts for up to 15 minutes (Art. 6(1)(f) GDPR). Changes made in our admin panel are logged for up to 90 days.

Who is online

While the app is open in your browser it keeps a live connection to our server, so your data stays in step across your devices. Through it our admins can see which accounts are online right now and which page they are on, to support you and keep the service running (Art. 6(1)(b) and (f) GDPR). This is not stored with your name: every 2 minutes we save only how many people are online in total and per plan, kept for up to 800 days for our statistics.

Cancellation and withdrawal

If you cancel or withdraw through the form at /cancel, we store your name, email, the type of request, an optional reason, the time and your IP address, and send you a confirmation. We keep these records for 3 years as evidence (Art. 6(1)(c) and (f) GDPR).

Support chat

When you open a support chat we store your name, email, the topic you choose, your messages and, if you are signed in, a link to your account, to answer you (Art. 6(1)(b) or (f) GDPR). Your browser keeps a random key so only you can see the chat. Our support team reads and answers chats in a private, staff-only channel on Discord, so these details are passed to Discord Inc. (USA). When a chat ends we email you a copy of it. A chat closes after 3 days without messages; closed chats are deleted 12 months after they close, and at once if you delete your account.

Our Discord server

If you join the PastPips Discord server, Discord Inc. (USA) is responsible for the Discord platform under its own privacy policy. On our server, our bot welcomes new members, gives the roles you pick yourself, and protects the server: it removes spam, unsafe links and insults, and records a warning with your Discord user ID, the reason and the time; repeated warnings can lead to a timeout, kick or ban. Moderators' actions are logged in a staff-only channel. We do this to keep the community safe (Art. 6(1)(f) GDPR). Warnings are deleted after 90 days. Tickets you open on Discord are handled like support chats.

Coupons and invite links

If you use a coupon or come through an invite link, we record that the purchase used it, so its owner can be paid a commission (Art. 6(1)(f) GDPR). An invite link is remembered in a cookie for 30 days only if you accept it in the cookie banner; otherwise only until you close the browser.

Live market prices (optional)

With your consent, the home page shows a price ticker from TradingView Inc. (USA). Your browser then connects to TradingView, which receives your IP address and may set its own cookies (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw consent at any time under "Cookie settings".

3. Who receives data

We have data processing agreements with our processors where the law requires them. Transfers to the USA rely on the EU–US Data Privacy Framework or on the EU Standard Contractual Clauses.

4. How long we keep it

Account data and your work: until you delete your account (Settings → Delete account). A deleted account first goes to a trash for 30 days, so it can be brought back if you ask (signing in with your password sends you a code to restore it); after 30 days it is erased for good, except what the law requires us to keep (invoices). Encrypted backups are kept for up to 90 days and then deleted, so a deleted account disappears from them within 90 days. Security and sign-in logs: up to 90 days. Trusted devices: up to 180 days after last use. Cancellation and withdrawal records: 3 years. Support chats: 12 months after they close. Warnings on our Discord server: 90 days. Daily visitor totals contain no personal data.

Do you have to give us your data?

To use an account you have to give a name, an email address and a password (or use Google sign-in); without them we cannot provide the service. Everything else is optional.

5. Cookies and storage on your device

We use only what is needed to run the service: the sign-in cookie, cookies for a team sign-in or a view-only password you used, and your settings and work kept in your browser's storage (§ 25(2) TDDDG). Optional: the TradingView ticker and a 30-day invite cookie, only with consent. Details: Cookies.

6. Your rights

You can ask for access to your data (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18) and a copy in a common format (Art. 20; also Settings → Download my data). You can withdraw a consent at any time with effect for the future. Write to pastpips@gmail.com.

Your right to object (Art. 21 GDPR). Where we process your data based on our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. We then stop, unless we can show compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims. Write to pastpips@gmail.com.

You can also complain to a data protection supervisory authority, for example the one where you live, or ours: the State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hannover, Germany.

7. Age

PastPips is for people aged 18 or older. We do not knowingly collect data from children. If you believe a child has an account, tell us and we will delete it.

8. Security

Connections are encrypted (HTTPS). Passwords are stored only as salted hashes. Access to the server and the database is restricted. You can report a security issue to pastpips@gmail.com (see security.txt).

9. Changes

We update this policy when the service changes. The date at the top shows the latest version.