Privacy policy

Who we are and how to reach us

“Algora”, “we” and “us” mean Algora Trade. Send any privacy question, access or correction request, deletion request or complaint to support@algora.trade, marked “Privacy”.

What we collect

We collect information from you directly, from services you connect, and automatically when you use the sites:

• Account details. Your email address and password. Passwords are stored only as a one-way bcrypt hash. We also keep sign-up, verification, login and password-change dates, and any account restriction we apply. If you complete a workspace profile we keep the organisation and role you enter.
• Access codes and invitations. A signed session that keeps you signed in. Invitation codes are stored only as hashes.
• Your trading records. What you add to the journal and desk: trades, prices, fees, dividends, portfolios, holdings, notes, tags, mood and conviction ratings, goals, playbooks, trade plans, watchlists, saved searches, alert rules and screenshots you attach. For alerts we also keep your alert preferences, delivery records and whether you have marked an alert as read. When you import a CSV or spreadsheet, it is usually read in your browser and we keep the records extracted from it, not the original file.
• AI features. The questions you ask and the results we generate, which may be kept to show you again.
• Broker connections (optional). If you connect Interactive Brokers or IG we store the token, API key or login details you provide, plus the account identifiers and records we fetch.
• Gmail broker sync (optional, when available). Google gives us read-only access to your mailbox. We search it for broker confirmations, contract notes, statements and dividend notices, read the matching messages and attachments to extract trade and dividend details, and keep those details. We do not keep the emails or attachments. We do keep your connected Gmail address, the access tokens (encrypted), the IDs of messages we processed and the sync status. Connected mailboxes are checked automatically about once an hour.
• Billing. Card details go to Stripe, not to us. We keep your name and email as held by Stripe, your Stripe customer and subscription references, plan and price, trial and billing-period dates, and subscription and cancellation status.
• Emails and support. Records of the emails we send you and any messages you send us.
• Technical information. Your IP address (used to limit repeated login and sign-up attempts, and kept in our hosting providers' logs), browser and device details, error reports and analytics as described below. Server logs can also contain your email address and billing events.

Some features keep data in your own browser instead of on our servers, such as an on-device journal, display settings, and any Twelve Data or NewsAPI keys you enter. Those keys are used for requests from your browser to those providers, and the instrument analysis feature also submits your Twelve Data key to Algora. Clearing your browser's site data removes what is stored there.

How we use it

• To create and secure your account, keep you signed in and verify your email.
• To provide the service: store and show your journal, run the analytics and reports you ask for, and import records from brokers or Gmail when you connect them.
• To run AI features when you use them.
• To take payments and manage your subscription.
• To send service emails, such as verification, password reset, billing links, onboarding tips and the alerts that come with your plan.
• To keep the service working and secure: preventing abuse, investigating errors and understanding which pages are used.

We do not sell personal information and we do not use it for advertising.

Cookies

We only use cookies needed for the sites to work. They are first-party and cannot be read by page scripts:

• Account sessions: tj_session and algora_session, up to 30 days.
• Access-code session: algora_access, up to 30 days.
• Shared passwords for parts of app.algora.trade: algora_journal_auth (journal) and algora_backtest_auth (backtests), up to 30 days.
• Operator access: apex_auth, up to 30 days.
• Preferences and preview: algora_edition (Retail or Institutional, 30 days) and algora_gate (preview gate, 7 days).

Error reports and analytics

Error reports (Sentry). When something breaks, we send a report so we can fix it. Before it is sent we remove cookies, request bodies and most headers, cut web addresses down to the site and page path, and redact recognised email addresses, passwords, tokens and keys. Automated filtering may not catch every sensitive value written in an unusual form.

Analytics (PostHog), when switched on. We record page views and when you leave a page: the page path, referrer and campaign tags, how long you stayed and how far you scrolled, your browser, device, language and time zone, and random identifiers. Identifiers are kept in browser memory only, so no cookies or local storage are used and a new identifier is created each time a page fully reloads. We do not record clicks, keystrokes, form contents or screen recordings. As with any web request, PostHog can see your IP address.

Who we share it with

We share personal information with service providers that help us run Algora, limited to what each needs:

This means your information is stored and processed outside Australia, mainly in the United States, Singapore and Japan, and wherever the providers above process data. We use established providers with their own security and privacy commitments, but overseas laws may differ from Australian law.

We may also disclose information where the law requires it, or to protect the rights and safety of our users or the service.

Shared workspaces

Some desk workspaces are opened with a shared access code. Records saved in a shared-code workspace, such as notes, plans and alerts, can be seen by everyone who uses that code, even where a panel describes a note as private. Individual invitations and account journals are kept separate for each holder.

How we protect it

All traffic to our sites is encrypted in transit (HTTPS) and passwords are hashed with bcrypt. We add a further layer of encryption (AES-256-GCM) to selected stored data, including broker credentials, Gmail access tokens, journal trades, dividends and portfolios, trade plans and institutional desk records. Other records, such as notebook entries, goals, playbooks, imported broker records, scanner workspaces, AI results and account and billing details, are stored in access-controlled databases without that extra layer. Some older journal records may remain without it until they are next saved. No system is perfectly secure.

How long we keep it

We keep your account and journal while your account is open. Alert history is kept for up to 90 days. If you unsubscribe from an email type, we keep that choice so we can keep honouring it; it is stored against an identifier derived from your email address, not the address itself. When you disconnect Gmail, the stored Gmail tokens and connected Gmail address are deleted straight away; the trades and dividends already imported, the IDs of messages we processed and the sync history stay with your journal. Copies may remain for a time in our hosting and database providers' logs and backups. We keep billing records for as long as tax law requires.

Your choices and rights

• Access and correction. Ask us for the personal information we hold about you, or to correct it. We aim to respond within 30 days and will tell you if we need longer and why. In the product you can export your trade ledger, browser-stored data or account portfolio, depending on where you work; these exports do not cover everything we hold.
• Deletion. You can delete individual trades, notebook days, playbook setups and portfolios yourself, and delete all journal trades at once from the journal's Settings tab. Removing a broker connection deletes the stored credentials, not the records already imported. To close your account and delete its data, email us from your account address. We will confirm what will be deleted, anything we must keep, and when it will be done.
• Gmail. You can disconnect Gmail yourself with Disconnect Gmail in the journal's Settings tab (also shown under Sync brokers while connected). It asks Google to revoke Algora's access and deletes the stored Gmail tokens; records already imported are kept. You can also revoke access at any time in your Google account's security settings.
• Emails. Scanner email alerts on algora.trade can be switched off in alert settings. Onboarding emails and high-priority ASX announcement alerts from app.algora.trade include an unsubscribe link that works without signing in, and mail apps that support one-click unsubscribe may also show their own unsubscribe button. If you have a journal account you can also choose these emails in the journal's Settings tab. The daily market briefing is shown on your dashboard and is not emailed. Essential account emails, such as password resets you request, are still sent.
• Analytics. Browser settings and extensions that block tracking scripts also block our analytics; the service works without it.

Age

Algora is intended for adults aged 18 and over and is not directed at children.

Complaints

If you have a concern about how we handle your personal information, email support@algora.trade with the details. We will acknowledge it, look into it, and tell you the outcome and any steps we are taking, aiming to do so within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes to this policy

We will update this page when our practices change and show the date of the latest version at the top.