Short version. Your MT5 files are parsed in your browser and stay on your device unless you sign in or turn on Cloud sync. When you are signed in, some data (listed in Section 1.4) is saved to our database so it is tied to your account. We never see your card number. We do not sell your data, we run no advertising trackers, and Nika AI is not live. You can export, delete and ask about your data at any time: [email protected] (subject: Privacy).
Contents: Who we are · 1. Data We Collect · 2. Legal Basis for Processing (GDPR) · 3. How We Store Your Data (storage, retention, security) · 4. Cookies and Local Storage · 5. Who We Share Data With · 6. International Data Transfers · 7. Your Rights (GDPR) · 8. Public Content, Scores and Automated Decisions · 9. Children's Privacy · 10. California Consumer Privacy Act (CCPA) · 11. Changes to This Policy · 12. Contact, DPO and Representatives
NikaQuant is operated by [Legal entity name], registered under number [Company registration number], with its registered address at [Registered address] ("NikaQuant", "we", "us", "our"). For the personal data described in this Policy, we are the controller under the EU General Data Protection Regulation (EU GDPR) and the UK GDPR, and a business under the California Consumer Privacy Act as amended by the CPRA (CCPA). The one exception is Teams (Section 1.8), where an organisation that invites you may also decide how its workspace is used.
This Policy covers the NikaQuant product suite (the "Service"): nikaquant.com, www.nikaquant.com, app.nikaquant.com, and the module front doors tracker.nikaquant.com, journal.nikaquant.com and arena.nikaquant.com. backtest.nikaquant.com and teams.nikaquant.com are reserved addresses that are not open to customers today; if they open, this Policy applies to them. Each focused product remains independently usable and owns its canonical records. The app may show you a view of records from another module, but that does not make private records public.
It also covers two sibling sites. store.nikaquant.com sells one-time software licenses through Stripe Payment Links. The store has no accounts and never sees card details: Stripe processes the payment and passes us the order details we need to deliver your files, such as your email address. coin.nikaquant.com is a static token page with no accounts or forms; its live price panel and embedded chart load from DexScreener and Jupiter, which receive your IP address and browser details when you open the page.
NikaQuant is analytics software. We are not a broker, investment adviser or regulated financial firm, we do not hold client money and we do not place trades. See our Terms of Service and Risk Disclosure.
We list data by where it comes from. "On your device" means it stays in your browser and we never receive it. "Our servers" means we or our providers (Section 5) hold a copy.
You can load MT5 Strategy Tester reports, optimization XML, CSV and XLSX exports and account history. The app parses these files in your browser. The files and the results (Score, Grade, Verdict, robustness checks and so on) are stored in your browser's IndexedDB and localStorage on that device. Journal notes, playbooks, plans, alerts, screenshots you attach and most settings are stored the same way. Browser-local data is not sent to NikaQuant merely because it appears in the interface. If you clear your browser data, anything that is not synced is gone, and we cannot restore it.
Trading files can contain personal data, for example your MT5 account number (the Bridge EA puts it in its file names), broker name, account balance and trade history. Please treat them that way.
In supported browsers (such as Chrome and Edge) you can connect a folder on your computer so the app re-reads new files from it. That folder access happens inside your browser; files are not uploaded because of it.
The Bridge EA (also called the NikaQuant Exporter EA) is an MT5 Expert Advisor you install in your own terminal. It reads your account's deal history and balance and writes them as CSV files into your terminal's own MQL5/Files folder, and it can copy Strategy Tester reports there. The current Bridge EA makes no internet connection and sends nothing to us. Its files reach NikaQuant only when you load them into the app (Section 1.2), and then follow the same on-device and cloud rules. It is a reporting tool and does not place, modify or close trades. If a future version sends data over the internet, we will update this Policy and tell you in the app before it does.
When you are signed in, the following is saved to our database (hosted by Supabase) so it is tied to your account and available on your other devices:
Subscriptions are paid through Stripe Payment Links and managed in the Stripe Customer Portal. We never see or store your full card number. Stripe collects your payment details directly. When you check out from the app, we pass Stripe your email (to prefill the form) or, if you are signed in, your NikaQuant user ID so Stripe can tell us which account paid. Stripe then sends us your email, Stripe customer ID, subscription ID, plan and subscription status (for example trialing, active, past due or cancelled). We store the customer ID, subscription ID and plan with your account. Stripe sends payment receipts. Store purchases work the same way: Stripe passes us the order details we need to deliver your license.
The app includes a Teams workspace. If you use it, we process organisation names, member and invited-member email addresses, invitations, roles, seats, membership status, consent records, assignments, review status and private coaching notes. If an organisation invites you, it gives us your email address before you have an account; we use it only to deliver and run that invitation and the membership that follows.
Nothing is public by default. Public publication is deliberate and optional. See Section 8 for what others can see.
Journal records are private by default. A Journal record is not public proof and is not treated as live trading evidence just because it exists.
Nika AI is included on Premium only and is not live yet. Free and Pro have no AI features. The currently released Nika AI boundary is fail-closed: our server refuses AI requests, sends nothing to any AI model provider, and cannot write to your records. When Nika AI goes live, it may send data you choose (for example a report summary or a question) to an AI model provider acting as our processor. Before that happens we will update this Policy and the in-app notice to name the provider, say what data is sent and why, how long it is kept, and whether it may be used to train models (we will not allow that by default), and give you a choice.
We do not collect passwords, broker or MT5 login credentials, card numbers, government ID, precise location, or contacts. We do not use advertising cookies, social-media pixels or cross-site tracking.
Under the EU and UK GDPR we must have a lawful basis for each use of personal data. Where we rely on legitimate interests, we have balanced them against your rights and you can object (Section 7).
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create your account and sign you in | Email, user ID, session tokens | Contract (6(1)(b)) |
| Run the analysis, Journal, Tracker and other features you use | Files, trades, results, journal entries, settings | Contract (6(1)(b)) |
| Save and sync your data across devices; Cloud Save | Data listed in Section 1.4 | Contract (6(1)(b)) |
| Take payment, run trials, manage plans and access | Email, Stripe IDs, plan and status | Contract (6(1)(b)) |
| Keep billing and tax records | Billing records | Legal obligation (6(1)(c)) |
| Send service emails (sign-in codes, welcome, trial reminder) | Email, send records | Contract (6(1)(b)); legitimate interests (6(1)(f)) for the welcome email |
| Answer contact-form and support messages | Name, email, message | Legitimate interests (6(1)(f)), or contract where it concerns your account |
| Share links, comments, Teams and anything you publish | What you choose to share or publish | Contract (6(1)(b)), at your instruction; Teams also legitimate interests of running a workspace you joined (6(1)(f)) |
| Show aggregated broker costs to other users | Broker reports you submit | Legitimate interests (6(1)(f)) |
| Credit referrals | Referral code | Legitimate interests (6(1)(f)) |
| Measure website use (cookieless) | Aggregated page views | Legitimate interests (6(1)(f)) |
| Fix errors, keep the Service secure, prevent abuse | Minimized error reports, server and security logs | Legitimate interests (6(1)(f)) |
| Defend legal claims, respond to lawful requests | Relevant records | Legal obligation (6(1)(c)); legitimate interests (6(1)(f)) |
| Marketing emails (if we ever send them) | Consent (6(1)(a)), opt-in only | |
| Nika AI (when live) | Data you choose to send | Contract (6(1)(b)); consent (6(1)(a)) where required |
If you do not give us your email, we cannot create an account, but you can still use the app signed out with data kept on your device.
| Data | How long |
|---|---|
| Data on your device | Until you delete it in the app or clear your browser data. We hold no copy. |
| Sign-in codes | Expire after 10 minutes. |
| Account, profile and plan data | While your account exists. Deleted when your account is deleted (Section 7.3). |
| Synced trades, run summaries, journal, preferences, snapshots, Cloud Save workspaces and their versions | Until you delete them or your account is deleted. |
| Strategy share links and comments | Until you delete them or your account is deleted. Report links carry their data in the link, so copies people already have cannot be recalled. |
| Teams records | While the workspace exists; on offboarding, access ends but the organisation may keep its audit history and records it owns. [retention period — to be set] |
| Broker cost reports | Until your account is deleted. Aggregated averages may remain. |
| Email send records | While your account exists; deleted with your account. |
| Billing records (us and Stripe) | [retention period — to be set], as tax and accounting law requires. Stripe also keeps records under its own policy. |
| Contact-form and support emails | [retention period — to be set] |
| Server logs and error reports | [retention period — to be set] |
| Website analytics | Aggregated statistics only; no personal profiles are kept. |
We may keep data longer where the law requires it, or for as long as needed to establish, exercise or defend a legal claim, prevent fraud or protect security. Backups held by our providers are overwritten on their own cycles.
What we actually do:
No system is perfectly secure. We hold no security certification. Keep your email account secure, because anyone who controls your inbox can sign in. Data stored in your browser is only as safe as your device. If a personal data breach is likely to put your rights at risk, we will notify the relevant authority and, where required, you, as the law requires. To report a security issue, email [email protected] (subject: Security).
We use browser storage (mostly localStorage and IndexedDB) to keep you signed in, hold the data you load into the app and remember your choices. We use no advertising or cross-site tracking cookies. Cloudflare may set a bot-protection cookie if its security checks are triggered, and Stripe sets its own cookies on its payment pages. Our Cookie Notice (nikaquant.com/cookies/) lists every item, what it does, how long it lasts and how to clear it.
NikaQuant does not sell your personal data. We share it only as described here.
These providers process data on our behalf, under contract, only to provide their service to us.
| Provider | What they do for us | Data involved | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, DNS, our server code (Workers), Cloud Save file storage (R2, KV), bot protection, server logs, cookieless Web Analytics where enabled | Requests and IP addresses, security data, Cloud Save workspaces, logs | Global network (see vendor) |
| Supabase, Inc. | Sign-in (email codes) and database | Email, user ID, profile, synced data, share links, Teams data, email send records | See vendor |
| Stripe (Stripe, Inc. and affiliates) | Payments, subscriptions, trials, Customer Portal, receipts, store checkout | Email, payment details, billing address, plan and payment status | See vendor |
| Resend, Inc. | Sending service emails and relaying contact-form messages | Email address, email content, delivery data | See vendor |
| Plausible Analytics OÜ | Cookieless website analytics on parts of nikaquant.com | Page views; IP address used transiently, not stored as such | EU (see vendor) |
| Google LLC | Web fonts (Google Fonts) on nikaquant.com, the store and the token page; mailbox where contact-form messages are delivered | IP address and browser details when fonts load; contents of messages you send us | See vendor |
| An AI model provider (only when Nika AI is live) | Running Nika AI requests | Data you choose to send to Nika AI | Named before launch |
A listed provider does not receive every category of data. Each one gets only what its job needs.
Some pages load content directly from independent third parties, which receive your IP address and browser details under their own privacy policies: DexScreener and Jupiter on coin.nikaquant.com, and the unpkg script CDN on some nikaquant.com pages. Stripe's hosted payment pages are also governed by Stripe's own privacy policy.
Some of our providers process data in countries outside the EEA and the UK, including the United States. Where that is a restricted transfer, we rely on one of: an adequacy decision (including the EU-US Data Privacy Framework and the UK Extension, where the provider is certified); or the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum for UK data, included in the provider's data processing terms; plus the provider's additional safeguards where needed. To ask for more detail about the safeguard for a particular provider, email [email protected] (subject: Privacy).
If the EU or UK GDPR applies to you, you have these rights. Similar rights apply in many other places, and we offer them to all users where we can.
For anything else, including a full copy of your server-side data or deleting your account, email [email protected] with the subject "Privacy" from the address on your account. If you write from another address, we may ask you to confirm you control the account email before we act. We reply within one month. If a request is complex or we get many, we may extend that by up to two more months and will tell you why within the first month. Requests are free unless they are clearly unfounded or excessive.
When we delete your account, we erase your Cloud Save workspace files and their index, your email send records, your profile and the database rows linked to it (synced trades, run summaries, journal entries, preferences, snapshots, share links and comments), and your sign-in account. Data in your browser is not affected; clear it yourself. Billing records we must keep by law, and what Stripe keeps under its own policy, are retained as Section 3.2 says. Cancelling a subscription does not delete your account.
Public content. Anyone with a report or strategy share link can open it and forward it. Comments on a shared analysis can be seen by people who can open it. If you publish a public profile or to Arena or its leaderboard where offered, your display name and what you publish can be seen by anyone, including people without an account and search engines. Public Arena versions are designed as a permanent record: revoking one replaces it with a marker showing it was withdrawn, and minimal integrity data may be kept. Only share what you are comfortable with strangers seeing, and do not publish other people's data. You can delete strategy share links you created, and you can ask us to remove published content.
Scores are about strategies, not people. The Score, Grade, Verdict, robustness checks, prop-firm simulations and Arena rankings are automated analytics about trading strategies and results. They are not decisions about you and have no legal or similarly significant effect on you. We do not use them to decide whether you can get credit, insurance, a job or anything similar, and we do not sell or share them for that. We do not carry out automated decision-making about people within the meaning of Article 22 GDPR. Plan access depends on your payment status, not on any profiling.
The Service is for adults. It is not directed at anyone under 18, and you must be 18 or older to use it. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us data, email [email protected] (subject: Privacy) and we will delete it.
This section applies to California residents and adds to the rest of this Policy. In the last 12 months we have collected these categories of personal information, from you, your browser and Stripe, for the purposes in Section 2:
| Category | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Email, user ID, IP address, Stripe customer ID | Cloudflare, Supabase, Stripe, Resend, Google (fonts and mailbox) |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Name and email in support messages; billing details held by Stripe | Stripe, Resend, Google, Supabase |
| Commercial information | Plan, subscription status, store purchases | Stripe, Supabase |
| Internet or other electronic network activity | Aggregated page views, minimized error reports, server logs | Cloudflare, Plausible |
| Financial-related information you upload | Trades, balances, MT5 account numbers in file names, strategy results | Supabase, Cloudflare (only where synced) |
| Other information you provide | Journal text, display name, bio, comments, Teams details | Supabase, Cloudflare |
No sale or sharing. We do not sell personal information and we do not "share" it for cross-context behavioral advertising, and have not done so in the last 12 months. We have no actual knowledge of selling or sharing data of consumers under 16. Because there is nothing to opt out of, we do not offer a "Do Not Sell or Share" link; if we ever change this, we will add one and honour Global Privacy Control signals as an opt-out.
Sensitive personal information. We do not collect account log-in credentials, card numbers or other sensitive personal information as defined by the CCPA, and we do not use any personal information to infer characteristics about you. So the right to limit does not apply.
Your rights. You can ask to know what personal information we collect, use and disclose (categories and specific pieces), to delete it, and to correct it. We will not discriminate against you for using these rights. Send requests to [email protected] (subject: Privacy). We will confirm receipt within 10 business days and respond within 45 days, extendable by another 45 days if we tell you. We verify requests by confirming you control the email on the account. You can use an authorized agent; we may ask for proof of the agent's authority and ask you to verify your identity directly.
Retention is set out in Section 3.2.
We update this Policy when our products, providers or the law change, and change the date at the top. For a material change, such as a new kind of data, a new purpose, a new provider category, or Nika AI going live, we will tell you in the app or by email before it takes effect. Where the law requires your consent to a change, we will ask for it.
Related: Terms of Service · Cookie Notice · Refund Policy · Risk Disclosure · Acceptable Use Policy