ThetaStreak

Privacy Policy

Last updated: August 2, 2026 · Effective: August 2, 2026

The short version: we collect your email, the trades you log, and — only if you connect a broker — read-only position data. Your trades are private by default: nothing is visible to anyone else unless you switch sharing on yourself. We never see your broker password, never store your card number, and never sell your data.

1. Who we are

ThetaStreak ("we," "us," "our") operates thetastreak.com (the "Service"). This policy explains what personal data we collect, why, and the choices you have. The fastest way to reach us about privacy is support@thetastreak.com — we respond to every request there, including formal data-rights requests.

2. Data we collect

Account data. Email address, username, and avatar when you sign up. Authentication is handled by our infrastructure provider (Supabase).

Trading data you enter. Positions, trades, notes, tags, and goals you log in the app. This is your data; we process it only to run the Service.

Broker data (optional). If you connect a brokerage through SnapTrade, we receive read-only account holdings, balances, and transaction data — enough to keep your positions in sync, never enough to trade or move money. We never receive or store your brokerage username or password; that connection is made directly between you and SnapTrade, and your account number is masked before it reaches our servers. We store only an encrypted session token so the sync can keep running. You can disconnect your whole brokerage at any time from the Brokerage page — SnapTrade access is revoked immediately, and you can optionally remove linked portfolio(s) and their trades or keep imported history. See Data & Permissions (linked from Brokerage) for the full breakdown.

Payment data. Subscriptions are processed by Stripe. We store your subscription status and Stripe customer ID — never your card number.

Usage data. Standard logs (IP address, browser type, pages viewed) used for security and to improve the Service.

Support messages. If you contact us through the in-app form, we receive your message, the email address you give us, and any screenshot you choose to attach — so please avoid attaching anything you don't want us to see. We also store a one-way hash of your IP address for abuse prevention; the hash cannot be reversed back into your IP.

3. How we use it

To provide and improve the Service: displaying your positions and analytics, syncing broker activity, processing subscriptions, sending service emails (we don't send marketing email without consent), preventing abuse, and complying with law. We do not sell or rent your personal data, and we do not use your trading data for advertising.

Our legal grounds (UK/EU users). We process your account and trading data to perform our contract with you; billing data to perform that contract and meet legal obligations; security and abuse-prevention logs under our legitimate interest in keeping the Service safe; and optional extras — connecting a broker, publishing a profile, joining the leaderboard, Discord alerts — on the basis of your consent, which you can withdraw at any time by turning the feature off.

4. What's public and what's private

Private by default. Every position you log is private to your account. Other users cannot query it: separation is enforced in the database itself through row-level security, not merely hidden in the interface. Public sharing is off unless you deliberately switch it on.

If you join the Leaderboard. Your username and performance statistics — such as realised P/L, return on capital, win rate and number of closed trades — become publicly visible and are attributed to you by name. It is a ranking, so it is not anonymous by design.

If you publish a public profile. Your username, avatar and bio become visible at a public URL. Two further switches control how much detail goes with it: one publishes your closed trades, and one reveals the amounts attached to them. Open positions are never published. Each switch is separate and off by default, so you can share a profile without sharing trades, or trades without amounts.

Turning it off. Switching any of these off removes the data from public view going forward. Search engines and anyone who already saw or copied a public page may retain their own copy — that is outside our control, so treat anything you publish as public permanently.

5. Who we share it with

Service providers. We share data only with providers who process it on our behalf under contract, each limited to what their job requires: Vercel (application hosting), Supabase (database, authentication and file storage), Stripe (payments), SnapTrade (broker connectivity), Resend (transactional email), and Cloudflare (bot protection on our sign-in forms, and routing for mail sent to our support address). We do not sell or rent your data to anyone, and no advertiser or data broker receives it.

Features you switch on. Some data leaves only because you direct it: Discord alerts post the trade details you choose to a webhook you supply, and the Leaderboard and public profiles publish what section 4 describes. Turning the feature off stops the flow.

Our own access. We are a small team and we do not read accounts for curiosity or interest. A limited number of authorised people can access stored data where it is genuinely necessary — to investigate a support request you have raised, to fix a fault, or to comply with the law. We would rather state this plainly than claim a technical impossibility that is not true.

Legal and business transfers. We may disclose data where the law requires it. If ThetaStreak is ever acquired or merged, your data may transfer with the business — this policy, or one at least as protective, would continue to apply, and we would tell you.

6. Cookies & tracking

We use only the cookies needed to run the Service: keeping you signed in, remembering your preferences, and security. No ad networks, no cross-site trackers, and no sale of browsing data — ever. We run no third-party analytics or advertising tooling; the performance timings we collect stay within our own systems and are not sent to any outside service. Because there is no accepted standard, we do not respond to browser Do-Not-Track signals — but since we don't track you across sites, there is nothing to opt out of.

Knowing which link brought you here. We set one first-party cookie, named ts_attr, that lasts 90 days and records where you arrived from — the campaign tag on the link you clicked, or the site that linked to us. We use it for one thing: when someone signs up, we can tell which channel introduced them, so we know where to spend our limited time. It holds no personal details, is never shared with third parties, and is never used for advertising or to follow you around the web. We don't set it at all for visitors in the EU, EEA or UK — those signups simply record as "direct". You can delete it any time by clearing cookies for thetastreak.com in your browser, and nothing about the Service stops working if you do.

7. Where your data is stored

Our infrastructure and the providers listed in section 5 are based in the United States, so your data is stored and processed there. If you are in the UK, EU or another region with data-transfer rules, using the Service involves transferring your data abroad; our providers offer contractual safeguards, such as Standard Contractual Clauses, for those transfers. If you would prefer your data not to leave your region, please do not create an account.

8. Retention & deletion

We keep your data while your account is active. You can export your data (CSV/JSON) at any time from Settings, and you can delete your account from Settings or by emailing support@thetastreak.com — deletion removes your personal data within 30 days, except records we must keep for legal or accounting reasons.

9. Your rights

Depending on where you live (e.g. GDPR in the EU/UK, CCPA/CPRA in California), you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to opt out of "sale" or "sharing" (we do neither). Exercise them via support@thetastreak.com; we respond within the legally required window and won't discriminate against you for asking. You never have to email us to see your own data — export and account deletion are both self-service in Settings. If you are in the UK or EU and think we've handled your data badly, you also have the right to complain to your local data protection authority, though we'd appreciate the chance to put it right first.

10. Security, children & changes

Data is encrypted in transit and at rest, and one account cannot reach another's data — that separation is enforced by the database, not just the interface. Access on our side is limited to what section 5 describes. No system is perfectly secure, and we won't pretend otherwise: if a breach affects you, we'll notify you as required by law. The Service is for adults 18+; we don't knowingly collect data from children. If we change this policy materially, we'll notify you by email or in-app before the change takes effect, and update the "last updated" date above.