Privacy Policy
KD Desk, by KD Trading. Last updated November 1, 2026.
KD Desk is a trading calendar and journal. This policy explains what we collect when you use the hosted version at app.kdtrading.org, why we collect it, and what you can do about it. The short version: we keep what the service needs to work, we do not sell your data, and you can download or delete everything yourself.
What we collect
- Account details. Your email address and a password, which we store only as a salted hash (argon2id). We never see or store the password itself.
- Your trading data. The trades, accounts, notes, journal entries, grades, tags, playbooks, screenshots and settings you enter or import. This is stored in a database that belongs to your account alone.
- Broker API keys, if you add them. The optional TopstepX sync needs an API key. It is encrypted at rest and only used to fetch your own trades when you ask the app to sync.
- Technical records. Your IP address and browser type appear in server logs and are used to limit abusive traffic (for example repeated login attempts). Logs are rotated and kept for a short time.
- Consent records. When you accept these terms or opt in or out of the newsletter, we record the date, time, IP address and where the choice was made, so we can demonstrate consent.
- Billing records, when a paid plan exists. Payments are handled by Stripe. We receive your plan, its status and a customer reference. Card numbers never reach our servers.
What we use it for
- Running the service: signing you in, storing and showing your journal, syncing with a broker when you ask.
- Transactional email: confirming your address, resetting a password, confirming a newsletter choice. These are sent through Resend.
- The KD Trading newsletter, only if you opt in. Every issue has a one-click unsubscribe link, and you can also change the setting in Account.
- Keeping the service safe: rate limiting, abuse prevention, backups.
We do not sell your data, share it with advertisers, or use your trading records for anything other than showing them back to you. We do not train models on your data.
Cookies
KD Desk sets two cookies: a signed session cookie that keeps you logged in, and a CSRF token that protects forms. Both are strictly necessary. There are no advertising or analytics cookies.
Who else sees it
- Hetzner hosts the servers (United States region). Your data is stored on encrypted-at-rest disks there, and nightly backups are kept for a limited number of days.
- Cloudflare provides DNS for our domain.
- Resend delivers the emails described above and sees your email address and the message content.
- Stripe processes payments if you subscribe to a paid plan.
- Your broker (for example Topstep), only if you connect an API key, and only to fetch your own trades.
Each of these providers processes data on our behalf under their own terms. We disclose data to anyone else only when the law requires it.
How long we keep it
Your data stays as long as your account exists. Deleting your account (Account → Delete my account) erases your database, screenshots and settings immediately; copies in nightly backups expire within the backup retention window, currently 14 days. Consent records and billing records are kept as long as the law requires us to be able to show them.
Your choices
- Download everything as one file from Account, or from Settings → Data & backup inside the app, at any time.
- Delete your account yourself from Account. No email required, no waiting period.
- Unsubscribe from the newsletter with the link in any issue or from Account.
- Ask us at support@kdtrading.org to access, correct, export or erase your data, or to object to any processing. We answer within 30 days.
If you are in the European Economic Area or the United Kingdom, these choices are your rights under the GDPR, and you may also complain to your local supervisory authority. If you are in California, nothing here involves selling or sharing personal information as the CCPA defines it.
Security
All traffic is encrypted with HTTPS. Passwords are hashed, broker keys are encrypted, sessions are signed, and every form is protected against cross-site request forgery. No system is perfectly secure, so if you think your account has been accessed by someone else, change your password in Account (which also signs out every other device) and tell us.
Age
KD Desk is for adults. You must be at least 18 to create an account. We do not knowingly collect data from anyone younger.
Changes
If this policy changes in a way that matters, we tell account holders by email before the change takes effect. The date at the top always shows the current version.
Contact
KD Trading
support@kdtrading.org