What we store — and what we never do with it

What we collect

• Account & access: email, password (processed over TLS at registration/login but stored only as an Argon2 hash), Discord ID/username, Private access status and expiry.
• Your journal (cloud mode): trading accounts, trades, backtests, screenshots, notes and tags you add.
• AI requests (only when used): your question, up to 12 recent chat messages, and summary statistics for the period you selected — for example trade count, profit/loss, win rate, drawdown and results by setup, trading session and instrument. To find patterns in your own words, some of your recent annotated trades may also be included — their date, symbol, side, result, tags and the note text you wrote. No account or user identifiers reach the AI — not your email, IP, user id or any payment data. The text you write — your question and your own notes — may itself contain personal data; what you include in it is up to you. For prop-firm questions, the relevant catalog information is sent instead. The server does not save the assistant conversation in the journal database; the current tab keeps up to 30 messages in session storage until you clear it or close the browser session.
• Private access metadata: user/tenant identifiers, access and lease expiry, and a one-way SHA-256 device identifier. We do not receive the underlying Windows MachineGuid.
• Technical: IP address and user-agent at sign-up/login, session & CSRF cookies, error logs. No trade content is put in error logs.

Why we process it (purpose & legal basis)

Under the Kazakhstan personal-data law (No. 94-V), we collect and process personal data on the basis of your consent, except where that law itself expressly permits processing without consent. Concluding and performing the contract with you is the purpose and context of the processing, not a substitute for consent. For users covered by the GDPR, the corresponding GDPR bases are shown in parentheses.

• Run the service — accounts, login, the journal, analytics (GDPR: performance of the contract).
• Security & abuse prevention — IP/user-agent, rate limits, error monitoring (GDPR: our legitimate interest).
• Access control — Private access, device and Discord-role checks (GDPR: performance of the contract / your consent).
• AI assistant — process the question and context you choose to send when invoking it (your separate choice to use it; see cross-border transfer below).
• Transactional email — verification codes and password resets (GDPR: performance of the contract).

How your cloud data is protected — and the honest limit

In cloud mode your journal is protected by several layers:

• TLS (HTTPS) on every connection.
• Authentication — Argon2 password hashing + signed JWT sessions.
• Rate-limiting and abuse protection.
• Strict access controls and internal policies.
• Disk encryption at the hosting provider.

The honest limit: cloud mode is not zero-knowledge. Your journal is stored in a form the service can read so that analytics, the AI assistant and sharing can work. That means the operator, with server/database access, is technically able to read your data. We don't — our policies and the "what we never do" section below bind us — but we won't pretend it is cryptographically impossible.

Demetra Private / Local Vault reduces what reaches us: the journal stays on your machine and is not uploaded to Demetra Cloud. The journal databases are encrypted at rest with SQLCipher. A random 256-bit database key, cached credentials and the signed access lease are protected for the current Windows user with Windows DPAPI. Local backups preserve SQLCipher encryption and include a DPAPI-protected key envelope; cloud backup and cross-account key recovery are not included.

Cloud vs Private — pick what fits you

Private / Local Vault is free during the current early-access stage and is issued manually after a request. The current build uses SQLCipher database encryption, local encrypted backup and a signed, device-bound offline lease. Cloud backup and cross-device synchronization are not shipped.

Who else processes data (sub-processors)

A few infrastructure providers process data only to make the app work. We do not provide your data to them for resale or to train Demetra models; their own service terms and privacy notices also apply.

In local-only mode the Kazakhstan host processes account and entitlement metadata, and Discord processes the server-side membership check. The journal itself is not sent to these providers; AI and sharing are off.

💳 Payment data

Demetra never sees your card. The number, expiry date and CVV are entered on the payment provider's own page and are neither transmitted to, nor stored on, our servers. We could not disclose them if we were asked to.

What we do store, for each payment: the provider's payment identifier, the amount and currency, the date, the period it bought, and the account it belongs to. If you pay through Tribute we also store your Telegram account id — it is the only thing their notification names the payer by, so without it a payment could not be matched to you.

These records are kept as accounting documents even after an account is deleted, with the account link removed where the law allows. See Payment & refunds for how a refund is made.

How long we keep it

Cloud account and journal data are kept while your account exists. Private access and entitlement metadata are also kept with the account. When you delete your account, that server-side data is removed from our active systems right away. Payment records are the exception: they are kept as accounting documents with the account link removed (see Payment data). Error reports already sent to Sentry expire on their own schedule (up to 90 days), and sub-processors delete their copies under their own retention terms. A Private journal stored on your device remains under your control and must be deleted locally. A registration code is valid for 10 minutes, an account email-verification code for 30 minutes, and a password-reset link for 60 minutes. Sentry error reports may be retained for up to 90 days. Server logs are kept until log rotation or container replacement and are not archived separately. Trade content is not intentionally written to error logs.

Clear data policy — export, deletion & access end

• Export anytime. Download everything — accounts, trades, backtests, notes, tags — as one JSON file from Settings → Data & privacy. No request, no waiting.
• Delete anytime, permanently. One click in Settings removes your account and its journal data from our active systems right away — trades, backtests, screenshots, shares. It can't be undone. Payment records required as accounting documents are kept with the account link removed — see Payment data and "How long we keep it".
• If Private early access ends: the local journal is not deleted. Private journaling locks until access is extended, while local backup/export remains available. Server-side account data follows the normal export/deletion controls.
• No hostage-taking. Export and deletion are always yours to use.

Local-only / Private desktop: your journal lives on your machine, so export and deletion are local too — and even if access lapses, your on-device data and export stay available.

Cookies

Strictly-necessary cookies — always set, no consent needed, no advertising pixels:

• Session — keeps you logged in.
• CSRF — protects forms from cross-site request forgery.
• Language and short-lived sign-up flow cookies (email/Discord verification).
• Browser local/session storage — interface preferences, calculator values, registration convenience and the current-tab AI chat history. It is not used for advertising or cross-site tracking.

Analytics and advertising cookies — only on the public pages (the landing, the prop-firm directory and the template page) and only after you press «Accept» in the cookie banner. Yandex Metrica and Google Analytics then count visits and clicks on those pages, and the Meta Pixel measures how our Facebook/Instagram ads perform (an advertising cookie); nothing of the kind runs inside the app. If you accepted them and later sign up or pay, our server tells Meta that the sign-up or payment happened (with the amount) so the ad that brought you is counted — never your email, name or journal. «Only necessary» keeps them off; the choice is stored in your browser and is reset by clearing site data.

The strictly-necessary cookies need no consent. Analytics is asked for first, as promised here, and is never a condition of using the service.

What we never do

• Store your card number, expiry date or CVV — they never reach our servers.
• We do not sell your data. Not to brokers, not to prop firms, not to anyone.
• We do not train AI models on your trades. Your journal is not a dataset.
• We do not publish your journal. It becomes visible to others only when you create a share link.

Local-only mode — and how to verify it

Local-only is a free, request-based desktop mode during the current early-access stage. Your journal lives on your computer: trades, backtests, screenshots and notes are stored in a local SQLite database and are not sent to Demetra Cloud; there is no background journal upload or sync.

At activation and normally at startup, the desktop calls Demetra's entitlement endpoint. It sends authentication credentials and a one-way device identifier; the server checks the access grant and the Discord role already linked to the account, and returns a signed device-bound lease. Token refresh and app-update checks may also use the network. These calls contain no trades, notes, screenshots or backtests.

A valid lease permits offline use for up to 7 days, or until the granted early-access period ends, whichever comes first. After that the app locks Private journaling until it reconnects and access is extended. Local data is kept and backup/export remains available.

You don't have to take our word for it — you can check it yourself:

• Turn on airplane mode / unplug the internet — journaling keeps working and your trades still save locally (within the 7-day window).
• Watch the traffic with a network monitor — Wireshark, Fiddler, or your OS firewall/connection log — and verify that entitlement/update traffic contains no journal data.

Current encryption boundary: journal databases are encrypted with SQLCipher; credentials, the lease cache and database key are protected with Windows DPAPI. While Private is running, the key exists in process memory. Local encrypted backups can be restored by the same Windows user. Cloud backup, synchronization and a separate cross-device recovery key are not shipped.

Applicable law & cross-border transfer

The operator is an individual entrepreneur registered in the Republic of Kazakhstan, and processing is governed by the Law of the Republic of Kazakhstan No. 94-V "On personal data and its protection", and by the GDPR where it applies to users in the EU/EEA.

Legal basis. Demetra collects and processes personal data on the basis of your consent, except where the legislation of the Republic of Kazakhstan expressly permits processing without consent. The purposes of the processing are concluding and performing the contract, running the service, keeping it secure, and performing the features you choose to use. For users in the EU/EEA, the GDPR bases listed above apply.

Where your data is processed. The primary database and the application are hosted on a server located in the Republic of Kazakhstan (Almaty), in line with the data-localization requirement. When you use the AI assistant, the question and the summary statistics described above are processed abroad by our AI provider (Anthropic, United States); no account or user identifiers are sent, though the text and notes you send may themselves contain personal data. The assistant does not send anything until you give a separate consent to this cross-border transfer — the app asks for it before your first question, and the date and version of that consent are stored with your account. Declining it leaves the rest of the service unchanged; a copy processed abroad does not change the rights described below.

Supervisory authority. You may complain to the authorized body for personal-data protection of the Republic of Kazakhstan (as of September 2026 — the Committee for Information Security of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan) or, if you are in the EU/EEA, to your local data-protection authority.

Your rights & controls

• Access & export — download all your data as one JSON file, anytime (Settings → Data & privacy).
• Erasure — one click deletes your account and its journal data permanently; payment records kept as accounting documents are the one exception described above.
• Rectification — edit your profile and journal in the app.
• Object / complain — reach us via Contacts; you may also complain to your local data-protection authority.

Private local-only is free during early access and is issued manually after a request. Availability depends on approval, Discord access and a supported desktop build. Any future pricing will require separate notice and updated terms.