Enigma Journal — Privacy Notice

Last updated: 13 September 2026 Version: 1.5

1. Introduction

1.1 This Privacy Notice explains how Cole Blaney, a sole trader whose registered/trading address is Unit 171901, PO Box 7169, Poole, BH15 9EL ("we", "us", "our", "the Provider"), collects, uses, stores, shares, and protects personal data in connection with the Enigma Journal desktop application, any related websites (including enigma-journal.com), and associated services (together, the "Software" or the "Service").

1.2 We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 ("DPA 2018"), the Privacy and Electronic Communications Regulations 2003 ("PECR"), and all other applicable data protection laws.

1.3 This Privacy Notice should be read alongside our Terms of Service. Capitalised terms not defined here have the meaning given in the Terms of Service.

1.4 By using the Software, you acknowledge that you have read and understood this Privacy Notice. Where we rely on your consent, we will ask for it separately and you may withdraw it at any time.

2. Data Controller and Contact Details

2.1 For the purposes of the UK GDPR, the data controller responsible for your personal data is Cole Blaney.

2.2 If you have any questions about this Privacy Notice, wish to exercise your rights, or want to make a complaint, you can contact us:

• By email: support@enigma-journal.com
• By post: Unit 171901, PO Box 7169, Poole, BH15 9EL

2.3 We are not required to appoint a statutory Data Protection Officer under Article 37 UK GDPR, because our core activities do not consist of large-scale processing of special category data or large-scale, regular, and systematic monitoring of individuals. Responsibility for data protection matters rests with Cole Blaney, who can be contacted at support@enigma-journal.com. We keep this position under review and will appoint a DPO if our processing changes such that one becomes legally required.

3. The Personal Data We Collect

3.1 Account and profile data. When you register for an Account, we collect your email address, username, password (stored in hashed and salted form by our authentication provider, Supabase), and any profile details you choose to provide, such as an avatar image or display name.

3.2 Subscription and payment data. If you purchase a Subscription, we collect your subscription status, plan type, and transaction records. Card and payment details are collected and processed directly by our payment provider, Stripe (see Section 8); we do not store your full card number.

3.3 User Content. The Software allows you to record trade journal entries, notes, daily summaries, theses, ratings, emotions, screenshots, and other material ("User Content"). This content is stored locally on your device and is not uploaded to our servers (see Section 7).

3.4 Technical and usage data. The Software and our servers may process limited technical information such as your device operating system and version, the application version, and basic error or diagnostic information necessary to operate, secure, and update the Software. Error or diagnostic logs generated by the desktop application are primarily held locally on your device. On our website, optional Vercel Web Analytics and the Google Ads tag load only after you accept optional tracking; see Sections 3.6 and 11. Essential hosting and security logs are separate from this optional tracking.

3.5 Communications data. If you contact us for support or otherwise, we collect the content of your messages and our correspondence with you.

3.6 Website data. With your consent, Vercel Web Analytics measures page views and site usage, and Google Ads processes information such as pages visited, referring sites, advertising identifiers, ad interactions, cookie identifiers, IP address and browser/device information for advertising measurement and personalisation. We do not deliberately send account credentials, form contents or locally stored trading journals to these tools. See Section 11 for controls and provider information.

3.7 Financial, trading, and free-text journal data. The Software is designed for you to record and review your own trading activity. To be transparent about the different kinds of information involved:

• Trading and financial information you voluntarily enter — such as profit and loss figures, position sizes, instruments, strategies, ratings, and screenshots. This is stored locally on your device and is not transmitted to us (see Section 7).
• Account and payment information — such as your email, username, profile, and subscription status, which is held server-side by us and our processors (see Sections 3.1, 3.2, and 8).
• Automatically processed technical information — as described in Section 3.4.
• Free-text entries — notes, theses, daily summaries, and similar fields may contain whatever you choose to type. You should not enter special category data (as defined in Article 9 UK GDPR, such as health, political, or religious information) or other individuals' personal data into these fields. Because this content stays on your device, we do not see it, but you remain responsible for what you record.

We do not intentionally collect special category data.

3.8 Children's data. The Software is not intended for anyone under 18, and we do not knowingly collect personal data relating to children.

3.9 Affiliate programme data. If you opt in to our affiliate/referral programme, we process your chosen referral code, records of the referrals and conversions attributed to you, your commission balances and history, your payout requests, and the payout details you provide so we can pay you (for example a PayPal or Wise email address or account identifier). Where you refer another person, we process the fact that their purchase was attributed to your code; we do not share their identity or personal data with you.

4. How We Collect Your Data

4.1 Directly from you — when you create an Account, complete your profile, enter User Content, purchase a Subscription, or contact us.

4.2 Automatically — limited technical and diagnostic data generated through your use of the Software, and, on our website, cookies and similar technologies plus cookieless website analytics (see Section 11). We do not use third-party analytics to track your behaviour within the desktop Software.

4.3 From third parties — such as Supabase and Stripe, who supply us with authentication, account status, and payment/subscription confirmation data necessary to provide the Service.

5. How We Use Your Data and Our Lawful Bases

5.1 We only process your personal data where we have a lawful basis to do so under Article 6 UK GDPR. The table below summarises our main processing activities and the lawful basis for each.

5.2 Where we rely on legitimate interests, our interests are operating, securing, and improving a reliable software product. We have considered your rights and freedoms and will not process your data where they override our interests. You may object to this processing (see Section 10).

5.3 Where we rely on consent (for example, certain marketing or non-essential cookies), you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Marketing Communications

6.1 We will only send you marketing communications where you have consented, or where otherwise permitted by law.

6.2 You can opt out of marketing at any time by using the unsubscribe link in any marketing email or by contacting us at support@enigma-journal.com.

6.3 Opting out of marketing does not stop us sending you essential service, security, or administrative messages relating to your Account or Subscription.

7. Data Storage and Local Processing

7.1 Your journal stays on your device. Your User Content — including your trade journal entries, notes, theses, daily summaries, ratings, emotions, and screenshots — is stored locally on your own device. It is not uploaded to, synchronised with, or stored on our servers, and we and our processors cannot access it. You are responsible for the security of your device and for maintaining your own backups of this locally stored data.

7.2 What leaves your device. Account information transmitted to and stored on our servers includes your email address, username, profile details (such as an avatar), and subscription status. This is stored by our infrastructure provider, Supabase (see Section 8). Because this data is inherent to having an Account, it is not an optional sync that can be switched off while keeping an Account; if you do not wish this data to be processed, you should not create an Account. Website technical data and optional, consent-based website tracking are separate from your local journal and are described in Sections 3.4, 3.6 and 11.

7.3 Encryption. Personal data transmitted between the Software and our servers is encrypted in transit using industry-standard TLS/HTTPS, and account data held server-side is encrypted at rest by our hosting and database provider. Locally stored data relies on the security of your own device and operating system.

7.4 Staff access. Because your journal content never leaves your device, our staff and processors cannot read your trade entries, notes, or screenshots. Server-side, authorised personnel may access the limited Account data described in Section 7.2 only where necessary to provide support, maintain security, or comply with the law.

7.5 Uninstalling and deletion. If you uninstall the Software, locally stored data may remain on your device until you delete it, and deleting the application may not automatically delete all associated local files. Deleting your Account (see Section 12) removes your server-side Account data but does not delete data stored locally on your device.

8. Third-Party Service Providers and Data Sharing

8.1 We use the following third-party providers ("processors", except where they act as independent controllers) who process personal data in connection with the Service:

• Supabase (authentication, database, and email) — stores your Account and profile data and subscription status, authenticates your logins, and sends transactional emails such as sign-up confirmations and password resets. Supabase does not receive your locally stored journal content.
• Stripe (payments) — processes your Subscription payments and manages billing. Stripe collects and processes your payment details directly and acts as an independent controller for certain purposes; we do not receive or store your full card number.
• GitHub (software distribution) — hosts application downloads and updates. When the Software checks for or downloads updates, your device's IP address and basic request data may be processed by GitHub.
• PayPal and Wise (affiliate payouts) — if you take part in our affiliate programme and request a payout, we share the payout amount and the payment details you provide with the payout provider you choose (currently PayPal or Wise) so it can send your commission. These providers process that data as independent controllers under their own terms and privacy policies.
• Vercel (hosting and website analytics) — hosts our website and provides optional, cookieless Web Analytics after consent (see Section 11). Hosting request/security logs remain necessary to deliver the website. We do not send Account credentials or locally stored journal content as analytics events.
• Google (Google Ads, tag ID AW-18369166424) — after consent, provides advertising measurement and personalised advertising using website and advertising data. Google may process data as a processor or independent controller, depending on the service and purpose. See Google's Privacy Policy and how Google uses information from sites that use its services.

Optional website advertising and analytics are not embedded in the desktop journal. We do not use third-party product analytics to track your behaviour within the desktop Software.

8.2 We enter into data processing agreements with our processors requiring them to keep your data secure and to process it only as instructed.

8.3 We do not sell your personal data.

8.4 We may disclose your personal data:

• where required by law, court order, or a competent regulatory authority;
• to establish, exercise, or defend our legal rights;
• to prevent or detect fraud, security threats, or abuse of the Software; and
• to a successor entity in connection with a merger, acquisition, or sale of assets, subject to this Privacy Notice.

9. International Transfers

9.1 Some of our processors may store or process personal data outside the United Kingdom.

9.2 Where personal data is transferred outside the UK, we ensure an appropriate safeguard is in place, such as:

• transfer to a country the UK Government has determined provides an adequate level of protection ("adequacy regulations"); or
• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or
• another lawful transfer mechanism recognised under the UK GDPR.

9.3 You may contact us for more information about the safeguards applied to a specific transfer.

10. Your Rights

10.1 Under the UK GDPR and DPA 2018, you have the following rights in relation to your personal data:

• The right to be informed about how we use your data (this Privacy Notice).
• The right of access to a copy of the personal data we hold about you.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure ("the right to be forgotten") in certain circumstances.
• The right to restrict processing in certain circumstances.
• The right to data portability — to receive certain data in a structured, commonly used, machine-readable format.
• The right to object to processing based on legitimate interests or to direct marketing.
• Rights in relation to automated decision-making and profiling — we do not carry out solely automated decision-making that produces legal or similarly significant effects on you.

10.2 Much of your User Content is stored locally and remains under your direct control; you can view, edit, export, or delete it within the Software at any time.

10.3 To exercise any of your rights, contact us at support@enigma-journal.com. We may need to verify your identity before responding.

10.4 We will respond to a valid request within one month. This period may be extended by up to two further months for complex or numerous requests, in which case we will inform you.

10.5 Exercising your rights is normally free of charge. We may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive.

11. Cookies and Similar Technologies

11.1 Desktop Software. Our desktop Software does not use advertising cookies. It may store limited local data (such as settings and session tokens) on your device that is necessary for the Software to function.

11.2 Website cookies — overview. We use essential cookies for sign-in, security and checkout, and local storage to remember your cookie choice. These necessary technologies are separate from optional tracking. Neither Vercel Web Analytics nor the Google Ads tag loads until you choose Accept optional. Rejecting optional tracking does not prevent you from using the website or purchasing a Subscription. Continuing to browse, creating an Account, or accepting our Terms does not constitute consent to tracking.

11.3 Optional website analytics. Vercel Web Analytics measures page views and usage, such as referring sites, browser/device category and approximate country. It is designed to work without analytics cookies. We nevertheless gate it behind your optional-tracking consent and rely on consent for this measurement. Vercel Speed Insights is not currently installed. See Vercel's analytics privacy information.

11.4 Optional Google Ads tracking. After acceptance, the Google tag (AW-18369166424) may set or read advertising cookies, attribute visits to ads, measure advertising activity and support personalised advertising, including remarketing, depending on our Google Ads configuration and your Google/browser settings. Google may associate this information with other information it holds. We use a basic opt-in implementation: the Google script is not loaded, and no Google tag consent-mode pings are sent by our implementation, before acceptance. This tag installation does not itself define a purchase-conversion event. Google's processing may involve international transfers as described in Section 9 and Google's linked policies.

11.5 Cookies we use on the website.

Google may use additional or renamed cookies depending on configuration, region and browser settings. See Google's cookie information for current provider details. The lifetimes above describe browser storage, not a guarantee that provider-side data is deleted at the same time.

11.6 Managing your choice. Choose Accept optional or Reject optional in the banner. Use Cookie settings in the footer to reopen it and change your choice, including withdrawing consent by choosing Reject optional. On withdrawal we stop loading optional tools, clear recognised Google tracking cookies accessible on our domain, and reload the page to stop already-loaded scripts. We cannot directly delete cookies on Google's domains or data already received by a provider; use your browser's cookie controls and Google My Ad Center for additional controls. Withdrawal does not affect processing that lawfully occurred before withdrawal. Blocking essential cookies may prevent sign-in or checkout from working. ICO guidance: https://ico.org.uk/for-the-public/online/cookies/.

11.7 Renewal and unavailable storage. We ask again after 180 days, if your saved choice is missing or invalid, or when a material tracking change requires renewed consent. Choices made under the earlier informational banner do not authorise Google Ads and are not reused. If browser storage is unavailable, optional tracking remains off until you accept for the current page; we may ask again on a later visit. If we add or materially change optional tracking, we will update this notice and seek consent as required.

12. Data Retention

12.1 We retain personal data only for as long as necessary for the purposes described in this Privacy Notice, including to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

12.2 Our retention periods are:

• Account data — for as long as your Account is active, and for up to 30 days after you delete or close your Account, after which it is deleted or anonymised (except where we must keep certain records for the periods below).
• Subscription and payment records — retained for 6 years to comply with UK tax and accounting law.
• Affiliate and payout records — records of commissions, payout requests, and payout details are retained for 6 years to comply with UK tax and accounting law.
• Locally stored User Content — retained on your device until you delete it or uninstall the Software; we hold no server-side copy.
• Support communications — retained for up to 24 months after your query is resolved.
• Technical and diagnostic logs — where held on our servers, retained for up to 90 days.

12.3 When personal data is no longer required, we will securely delete or anonymise it.

13. Data Security

13.1 We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These include encryption in transit using TLS/HTTPS, encryption at rest of server-side account data by our hosting and database provider, access controls and authentication, and the fact that your journal content is stored only on your own device rather than on our servers.

13.2 No method of transmission or storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security, and any transmission is at your own risk.

13.3 You are responsible for keeping your login credentials confidential and for securing the device on which locally stored data is held.

13.4 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office ("ICO") within 72 hours where required, and will inform affected individuals where the breach is likely to result in a high risk to them.

14. Your Responsibilities

14.1 You are responsible for the accuracy of the data you provide and for the content you choose to store in the Software.

14.2 You must not enter into the Software any personal data relating to other individuals unless you have a lawful basis to do so, and you must not upload unlawful, infringing, or highly sensitive third-party data.

14.3 You are responsible for maintaining your own backups of locally stored data.

15. Complaints

15.1 If you have a concern about how we handle your personal data, please contact us first at support@enigma-journal.com so we can try to resolve it.

15.2 You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

• Website: https://ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

15.3 We would, however, appreciate the chance to address your concerns before you approach the ICO.

16. Changes to This Privacy Notice

16.1 We may update this Privacy Notice from time to time to reflect changes in our practices, technology, or legal requirements.

16.2 When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you through the Software or by email.

16.3 This Privacy Notice is provided to inform you about how we process personal data; it is not a contract and does not require your acceptance. Where the law requires your consent for a particular processing activity, we will ask for it separately. We encourage you to review this notice from time to time. Where we make changes, the updated notice will apply to our processing of your personal data from the date it takes effect.

17. Contact Us

If you have any questions, requests, or complaints regarding this Privacy Notice or our handling of your personal data, please contact:

Cole Blaney Unit 171901, PO Box 7169, Poole, BH15 9EL Email: support@enigma-journal.com