Privacy Notice
Version 1.0.0. Effective from [EFFECTIVE DATE].
This notice explains how your personal data is handled when you use Backtest, the historical trading simulator at https://backtest.trading (the "Service"). It is given under Articles 13 and 14 of the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR").
1. Who is responsible for your data
1.1. The controller of your personal data is [OPERATOR NAME], [OPERATOR ADDRESS], [REGISTRATION DETAILS] ("we", "us", "our").
1.2. For anything about your personal data, including exercising your rights, write to office@backtest.trading. We have not appointed a data protection officer, because the law does not require one for the Service.
2. Summary
- We use your data to sign you in, keep your account secure, and save and analyse the practice sessions you create.
- Your sessions are private. Other users cannot see them.
- We do not sell your data, show advertising or use advertising trackers.
- Optional uses, such as product analytics, happen only if you allow them, and you can change your choice at any time in Settings → Privacy. At the date of this notice we do not collect data for any optional use, even if you allow it.
3. What we process, why, on what basis and for how long
3.1. Your account and signing in
Data: your email address; if you sign in with Google, the identifier, email address, name and profile picture that Google shares with us; if you add a passkey, its public key, its name and when it was added; the date and time of each sign-in; and the IP address and browser details recorded with sign-in activity.
Purpose and basis: to create your account, sign you in and provide the Service under our agreement with you (Article 6(1)(b) GDPR), and to keep accounts secure and detect misuse, which is our legitimate interest (Article 6(1)(f) GDPR).
Retention: for as long as your account exists. When it is deleted, this data is deleted, apart from the records described in sections 3.5 and 3.6.
We do not display or use your name or profile picture. Google sends them as part of its sign-in, and our authentication provider stores them with your account.
3.2. Sign-in codes and bot protection
Data: the email address you ask a code for, the code, and when it was sent. When you ask for a code, Cloudflare's Turnstile service checks that the request comes from a person and not an automated program. To do this it processes your IP address and technical information about your browser and device.
Purpose and basis: to send you the code you asked for, under our agreement with you (Article 6(1)(b) GDPR), and to protect the Service and its users from automated abuse, which is our legitimate interest (Article 6(1)(f) GDPR).
Retention: a code expires shortly after it is sent. We do not keep the information Turnstile uses; we receive only the result of the check.
3.3. Your practice sessions and results
Data: the names you give your sessions, the market and start date you choose, your starting balance, the orders you place, the simulated fills and positions that follow, your place in the replay, your chart settings, the results of the runs you complete, and the statistics calculated from them.
Purpose and basis: to save your sessions and show you your results and statistics, which is the Service you ask us for (Article 6(1)(b) GDPR).
Retention: until you delete a session forever, or until your account is deleted. A session in Trash that holds no completed run is deleted automatically 30 days after it was moved there.
3.4. Running and securing the Service
Data: technical records of requests to the Service, such as IP address, date and time, the address requested, browser details and error information.
Purpose and basis: to deliver the Service, find and fix faults, and keep the Service secure, which is our legitimate interest (Article 6(1)(f) GDPR).
Retention: these records are kept by our hosting providers for short periods set by them, at the date of this notice no longer than [LOG RETENTION, e.g. 7 days], and are then deleted automatically.
3.5. Your acceptance of the Terms and your privacy choices
Data: which version of the Terms of Service you accepted and of this notice you acknowledged, and when; and each choice you make about optional uses, with its version and time.
Purpose and basis: to show that you accepted the Terms and to establish or defend legal claims, which is our legitimate interest (Article 6(1)(f) GDPR); and to be able to demonstrate your choices about optional uses, which the GDPR requires of us (Article 6(1)(c) together with Article 7(1) GDPR).
Retention: for as long as your account exists and, after it is deleted, until claims relating to it become time-barred, which under Polish law is generally up to six years. After deletion we keep only these records, and only we can access them.
3.6. Messages you send us
Data: your email address, the content of your message and our reply.
Purpose and basis: to answer you, to handle complaints and requests about your rights, and to keep a record of how we handled them. We do this to perform our agreement with you (Article 6(1)(b) GDPR), to comply with our obligations under the GDPR (Article 6(1)(c) GDPR), and in our legitimate interest in establishing or defending legal claims (Article 6(1)(f) GDPR).
Retention: for as long as needed to deal with your message, and where it concerns a complaint, a request about your rights or a legal claim, until claims relating to it become time-barred.
3.7. Optional uses (consent policy version 1.0.0)
When you first sign in, and at any time in Settings → Privacy, you can allow or refuse each of the uses below. Each is off unless you turn it on. Refusing them does not affect your use of the Service.
At the date of this notice we do not collect data for any of these uses, even if you allow them. Before we start, we will update this notice and tell you.
| Optional use | What it involves | Retention |
|---|---|---|
| Product analytics | Measuring how features and sign-in steps are used, with a fixed list of event names. No email address, session name, exact order or raw trading data is included. A random device identifier is stored in your browser so that visits from the same device can be counted together; you can reset it by clearing site data. | 24 months |
| Experience recordings and heatmaps | Sampling selected in-app journeys to find layout and usability problems. A recording is a cleaned record of interface events, not a video. Form values, keystrokes, account details, session names, exact orders, trading state and sign-in pages are excluded. | Recordings 30 days; detailed heatmap positions 12 months |
| Enhanced diagnostics | Storing more detailed, cleaned error and performance information, such as stack traces and the preceding interface steps, to fix problems faster. An event is dropped if it cannot be confirmed as safe. | 90 days |
| Customer research | Showing you occasional optional questions about the Service and storing your answers. Free-text answers are marked clearly and stored separately. Please do not include personal, financial or sensitive information in them. | 24 months, unless made anonymous so they cannot identify you |
Basis: your consent (Article 6(1)(a) GDPR). Where an optional use stores information on your device, such as the product analytics device identifier, it also relies on your consent under Article 399 of the Polish Electronic Communications Law.
Withdrawing consent: you can turn any optional use off at any time in Settings → Privacy. Your choice applies to your account on every device. Turning a use off stops future collection for it. It does not affect the lawfulness of anything done before you withdrew.
4. Cookies and similar storage
The Service stores the following information on your device. All of it is strictly necessary to provide the Service you ask for, or to remember a setting you chose, so under Article 399 of the Polish Electronic Communications Law it does not require your consent.
| Name | Set by | Purpose | How long |
|---|---|---|---|
sb-…-auth-token (may be split into parts) | Backtest | Keeps you signed in | Until you sign out; renewed while you use the Service, at most 400 days |
sb-…-auth-token-code-verifier | Backtest | Completes a Google sign-in securely | Used only during sign-in |
bt-pending-email | Backtest | Remembers the address you asked a code for, between the sign-in steps | 10 minutes |
sidebar_state | Backtest | Remembers whether you collapsed the sidebar | 7 days |
theme (browser storage) | Backtest | Remembers the light or dark appearance you chose | Until you change it or clear site data |
| Turnstile | Cloudflare | Runs the bot check when you ask for a sign-in code | Only for the check |
The product analytics device identifier described in section 3.7 is stored only if you allow product analytics and we have started that use.
5. Where your data comes from
Most of the data comes from you, or is created by your use of the Service. If you sign in with Google, Google provides your identifier, email address, name and profile picture. Cloudflare provides the result of the bot check.
6. Do you have to give us your data?
You need an email address or a Google account to create an account, because we cannot provide the Service to you without one. Everything in section 3.7 is optional.
7. Who receives your data
7.1. We use the following service providers, who process data on our behalf and on our instructions under data processing agreements (Article 28 GDPR):
| Provider | Role | Location |
|---|---|---|
| Supabase, Inc. | Database and authentication: stores your account, sessions and results | Data is stored in London, United Kingdom; the provider is based in the United States |
| Vercel Inc. | Hosts and delivers the web application | Global infrastructure; the provider is based in the United States |
| Resend | Sends sign-in code emails | United States |
| Cloudflare, Inc. | Turnstile bot check | Global infrastructure; the provider is based in the United States |
| Google (Google Workspace) | Hosts the office@backtest.trading mailbox | European Union and the United States |
Cloudflare also uses limited information from Turnstile checks to improve its bot detection, as an independent controller under its own privacy policy.
7.2. When you choose to sign in with Google, Google Ireland Limited acts as an independent controller of your Google account and of its sign-in. Its own privacy policy applies to that processing.
7.3. Our market data providers receive no personal data about you.
7.4. We may disclose data to public authorities, courts or our professional advisers where the law requires it or where it is necessary to establish, exercise or defend legal claims.
8. Transfers outside the European Economic Area
Some of the providers above process data in the United Kingdom or the United States. The European Commission has decided that the United Kingdom ensures an adequate level of protection. For transfers to the United States, we rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the standard contractual clauses adopted by the European Commission. You can ask us at office@backtest.trading for information about these safeguards.
9. Your rights
9.1. You have the right to:
- access your data and receive a copy of it;
- have inaccurate data corrected;
- have your data erased;
- restrict how your data is processed;
- receive the data you provided in a structured, commonly used, machine-readable format, and have it sent to another controller (data portability);
- object, on grounds relating to your situation, to processing based on our legitimate interests; and
- withdraw your consent to an optional use at any time, without affecting what was done before.
9.2. To exercise a right, write to office@backtest.trading from the email address of your account, so that we can confirm the request comes from you. We will reply within one month. Where a request is complex, or we receive many, we may extend this by up to two further months and will tell you why within the first month.
9.3. To delete your account, write to us as above. We will delete your account and its data, except the records in sections 3.5 and 3.6, which we keep for the periods stated there. Copies in our providers' backups are removed as those backups expire, within [BACKUP RETENTION, e.g. 7 days].
9.4. You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl. You can also complain to the supervisory authority of the country where you live or work.
10. Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.
11. Security
Data is encrypted in transit between your browser and the Service. Database access rules ensure that each account can read only its own sessions and results. Sign-in uses Google, one-time codes or passkeys, so we never hold a password for you. Access to production systems is limited to the people who operate the Service.
12. Children
The Service is intended for adults. It is not directed at anyone under 18, and we do not knowingly process the data of children. If you believe a child has created an account, please tell us and we will delete it.
13. Changes to this notice
We publish each version of this notice with its own number and effective date, and we keep every earlier version. If we make a significant change, we will tell you by email and in the Service before it takes effect, and the Service will ask you to acknowledge the new version.