Privacy policy for the Trading Journal

1. Controller

The controller is Lukas Köppl, Kiawak, Kolpingstraße 24, 84030 Ergolding, Germany, e-mail contact@kiawak.com. No data protection officer is appointed because the legal requirements are not met.

2. Principles

The Trading Journal has no advertising, no analytics and no tracking and sets only one cookie: the login cookie (section 5). Your trades, notes and pictures are visible only to your account. Kiawak does not sell data and uses it neither for advertising nor for training AI models. Only the data needed for the respective function is processed.

3. Hosting and server logs

The Trading Journal runs at Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA): program (Cloudflare Workers), database (Cloudflare D1), picture storage (Cloudflare R2), e-mail delivery and delivery of the pages. When you open a page, Cloudflare processes technically necessary data such as IP address, time, address and browser details to deliver the page securely and quickly (Art. 6 (1) (f) GDPR). A data processing agreement with Cloudflare is in place; Cloudflare is certified under the EU-US Data Privacy Framework, the EU standard contractual clauses apply in addition. Fonts are loaded from the own server. Kiawak itself keeps no access logs; Cloudflare retains technical logs only briefly. Error messages of the program contain no content of your journal.

4. Storage in your browser

Your browser's local storage only keeps whether you chose the light or the dark view of the Trading Journal (key tj-theme). This value does not leave your browser. This storage is strictly necessary for the function you requested (§ 25 (2) no. 2 TDDDG). The demo runs entirely in your browser with invented example data and sends nothing to Kiawak.

5. Customer account

For an account Kiawak stores your e-mail address, your password only as a salted hash (PBKDF2-SHA256, not reversible), the language, the times of registration, e-mail confirmation and last use, your consent to the terms (version and time) as well as plan and payment status.

Signing in sets the cookie __Host-tj_s (HttpOnly, Secure, 30 days, deleted on sign-out); Kiawak keeps only a hash of it. It is technically necessary (§ 25 (2) no. 2 TDDDG). The legal basis for the account is Art. 6 (1) (b) GDPR. The data is kept until you delete the account, which you can do at any time under “Account”. Accounts whose e-mail address is not confirmed after 30 days and that hold no trades are deleted automatically.

6. E-mails

The Trading Journal only sends e-mails that belong to its use: confirming the e-mail address, a new password, contract and cancellation confirmations, notes on payments. They are sent via Cloudflare Email Service (Cloudflare, Inc.) from contact@kiawak.com. There is no newsletter and no tracking pixels. Legal basis: Art. 6 (1) (b) and (c) GDPR (confirmation duties under §§ 312f and 312k BGB).

7. Your journal: trades, notes and pictures

For your journal Kiawak stores in the database (Cloudflare D1) your trades with the details you or the image recognition enter (e.g. symbol, direction, prices, quantity, risk, profit or loss, fees, times, setup, grade, tags, mistakes, mood, notes, lessons and the course of the trade), your settings (currency, starting balance, risk per trade, own lists) and counters for the use of the image recognition. Pictures you upload (e.g. chart screenshots) are kept with a small preview in the picture storage (Cloudflare R2); your browser shrinks them before the upload.

All content is visible only to your account: pictures are delivered only while you are signed in. Kiawak does not look at your content unless you expressly ask for it (e.g. when looking for an error) or a law requires it. Please do not upload pictures with data of other people.

CSV and PowerPoint files are read in your browser during the import; Kiawak only receives the trades created from them and the pictures of the slides you select for processing. These pictures are uploaded while the slides are processed and, if you use the image recognition, analysed together with the slide text (section 8); pictures of slides you do not take over in the end are deleted afterwards, at the latest after 48 hours. You can export at any time (CSV, JSON).

Legal basis: Art. 6 (1) (b) GDPR. The data is kept until you delete it: one by one, with “Delete all data” in the settings or together with the account. Pictures that belong to no trade are deleted after 48 hours. Deleted entries remain in the database backups for up to 30 days; deleted pictures are removed at once.

8. AI image recognition

The image recognition runs only when you start it yourself (e.g. “Analyse with AI”, “Update from screenshot” or the PowerPoint import with AI), and only with a confirmed e-mail address. Then the AI service receives: the selected pictures (four at most), for an update the current details of the trade, related text (e.g. the text of a PowerPoint slide), your own setup names and settings such as the currency. Your e-mail address and your name are not transmitted. The result (recognised values, a short summary, hints) is shown to you for checking and only taken over when you confirm it; the summary is stored with the picture. There is no automated decision within the meaning of Art. 22 GDPR.

Service: Currently an image model of Cloudflare Workers AI reads the pictures; it runs in the network of Cloudflare, Inc. (see section 3, processor), and Cloudflare does not use the inputs to train models. Kiawak may use Claude by Anthropic, PBC (San Francisco, USA) instead; this policy will be updated before.

Legal basis: Art. 6 (1) (b) GDPR (the analysis you asked for).

9. Paid plans and payment processing

Once paid plans are offered and you book one, payment is processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). Kiawak passes on your e-mail address and the chosen plan; you enter your payment details directly at Stripe. Kiawak receives customer and subscription numbers, status and period of the subscription and invoice data, but no full card or account numbers. Stripe processes the data for payment and fraud prevention under its own responsibility (Stripe privacy policy); data may be transferred to Stripe, Inc. in the USA (EU-US Data Privacy Framework, standard contractual clauses). Legal basis: Art. 6 (1) (b) and (c) GDPR.

10. Contract records

Kiawak stores orders, your consents (e.g. to the terms and to the immediate start of the service) and cancellations with time, content and the IP address from which the declaration was made, to be able to prove conclusion and cancellation of the contract (Art. 6 (1) (b), (c) and (f) GDPR). These records are kept after the account is deleted until the limitation period has passed: the consent to the terms three years after the end of the year in which the account was deleted, orders and cancellations ten years; invoices and accounting records eight years (§ 147 AO, § 257 HGB).

11. Cancellation page

On the page “Cancel contracts here” you enter name, e-mail address, type and date of the cancellation. Kiawak uses these details to carry out and immediately confirm the cancellation (Art. 6 (1) (b) and (c) GDPR, § 312k BGB) and keeps them as described in section 10.

12. Protection against misuse

To protect against misuse (e.g. many sign-in attempts) your IP address is stored with a counter for no more than four hours, counters for an e-mail address (sign-in, registration, new password, cancellation) for no more than three days (Art. 6 (1) (f) GDPR).

13. Recipients and third countries

Recipients are Cloudflare (operation, database, picture storage, e-mail delivery, image recognition), for paid plans Stripe (payments) and Apple (iCloud, Apple Distribution International Ltd., Ireland) as provider of the mailbox that holds messages sent to Kiawak. Transfers to the USA are based on the EU-US Data Privacy Framework and/or the EU standard contractual clauses. Data is not passed on for advertising.

14. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability. You can download a copy of your data (account and journal) under “Account”, your journal also as CSV. You can also complain to a supervisory authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Right to object (Art. 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on Art. 6 (1) (f) GDPR (sections 3, 10 and 12). An e-mail to contact@kiawak.com is enough.

15. Obligation to provide data

An account needs an e-mail address and a password; without an account only the demo can be used. Every detail in the journal is voluntary.