Privacy Policy

This Privacy Policy explains how Trepeat ("we", "us") collects, uses, stores, and shares personal data when you use our services at trepeat.com and app.trepeat.com. We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Maltese Data Protection Act.

1. Data Controller

The data controller is Trepeat, a Malta sole trader. We are not required to appoint, and have not appointed, a Data Protection Officer; our data-protection contact point for all privacy enquiries is contact@trepeat.com.

2. Data We Collect

Account data: email address, display name, account creation timestamp, and (if you enable two-factor authentication) an authenticator-app secret (held by Supabase Auth) and recovery codes, which we store only as bcrypt hashes in our database. We use passwordless authentication (magic links plus optional authenticator-based two-factor) and never store account passwords.
Other account data: data you choose to add — a backup email address, a profile picture, journal notes and screenshots, and support tickets with their replies — plus the date you confirmed you own each broker account you connect, the version of these policies you accepted at signup, and, if you sign in with Google, the basic profile Google shares (name, email address and profile picture).
Broker credentials: MetaTrader login, server, and password, and for cTrader the access and refresh tokens of the authorisation you grant — encrypted at rest in Supabase Vault using authenticated encryption (libsodium AEAD via pgsodium). The plaintext password is never visible through the user interface or accessible to support staff. If a broker rejects MetaTrader details you enter, we keep a keyed fingerprint of the platform, server, login and password together — an HMAC-SHA-256 whose key is stored separately from our database, never the password itself — so the same rejected details are not sent to the broker again. It is deleted within two days of it no longer blocking those details, or when you delete your account.
Broker account data: connected MetaTrader account IDs, broker server names, account balance and equity (read-only, fetched from MetaAPI or the cTrader Open API), open positions, order history.
Trade history: trades executed on the source account and the corresponding repeats on follower accounts, including symbol, volume, side, timestamps, latency, and status.
Repeater configuration: source-to-follower links, contract multipliers and risk-scaling settings, symbol allowlists, symbol remapping rules.
Free-trial record: the cTrader account ID (cTrader's own number for the trading account, nothing else about it) of each cTrader trading account connected before you first paid, with the date and the id of the first Trepeat user who connected it. See Section 9 for why and how long it is kept.
Payment data: billing address, last-four card digits, subscription status, and, if you enter them at checkout, a business name and tax ID (such as a VAT number). At checkout your IP address is sent to Stripe to estimate your country for tax until you enter your address. Full card details are never stored on our servers — they are tokenised and held by Stripe.
Technical data: IP address, user-agent, session timestamps, server logs, error reports, and security-event records (sign-ins from a new device, two-factor changes and session sign-outs, with the IP address and browser).
Acquisition data: the campaign tags on the link you first arrived through, the domain that referred you, and the first page you landed on. Recorded once and never updated, on the basis of our legitimate interest, and not recorded at all if you decline analytics cookies — see Section 5.

3. Lawful Basis for Processing

We process personal data on the following lawful bases under Article 6 GDPR: (a) contractual necessity — operating the Service you have subscribed to; (b) legitimate interests — securing our infrastructure, preventing abuse, and improving the Service; (c) legal obligation — meeting accounting, tax, and regulatory requirements; and (d) consent — where you have given specific, freely given consent (e.g. optional product update emails).

Providing your account email is a contractual requirement to create an account, and providing your broker credentials is a contractual requirement to connect a trading account. If you do not provide them we cannot create your account or connect your accounts, and the Service will not function. All other data is provided voluntarily.

4. How We Use Your Data

Provide, operate, and maintain the Service.
Authenticate you and secure your account.
Process payments, invoices, and refunds.
Send transactional email (sign-in links, billing and subscription notices, security and repeater alerts, policy change notices).
Detect, prevent, and respond to fraud, abuse, and security incidents.
Comply with legal, accounting, and regulatory obligations.
Provide customer support when you contact us.
Understand which channel introduced you to Trepeat, so we know where to spend our limited marketing effort.

We do not sell your personal data. We do not use your trade data to train machine-learning models or share it with advertisers. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects concerning you.

Shared P&L images. When you share a P&L image with verification on, we publish its figures on a page at trepeat.com/v/… that anyone with the link can open. The page shows no name, email address or account number. You can revoke it at any time in the share dialog, and deleting your account deletes all of them.

5. How You Found Us

When you create an account we record how you first arrived — the campaign tags in the link you clicked (utm_source, utm_medium, utm_campaign), the domain that linked to us, and the first page you landed on. This is stored once against your account and never updated afterwards, so it reflects only how you first found us. We rely on our legitimate interest in knowing which channels bring people to a small independent product, so that we can spend our limited effort where it is actually useful.

We store the referring domain only — never the full referring address, which can contain a search term or a private page. We share this record with no one, never use it to profile you, and never use it to make a decision about you. If you accept analytics cookies, our analytics provider (PostHog) separately receives the full address of the page that referred you, as described in Section 7.

On cookies, and your objection. Carrying this information to your new account does not require storing anything on your device, so we do not set a cookie for it unless you have accepted analytics cookies. If you decline analytics cookies we treat that as an objection and record nothing at all. You can object at any time from Settings, and you can ask us to erase what we hold under Section 10. Either way it has no effect on the Service.

6. Waitlist

While new signups are closed you can join our waitlist to be told when they reopen. Waitlist processing is deliberately minimal:

What we collect: the email address you submit, the page you submitted it from, and timestamps. Your IP address is used for abuse prevention and rate-limiting: it is held with your email address in a separate security log for up to thirty (30) days, is checked by Cloudflare Turnstile for bot protection, and is not kept on the waitlist record itself.
Purpose: to send you one email when signups reopen. We do not use waitlist addresses for anything else — no newsletters, no marketing sequences.
Lawful basis: your consent (Article 6(1)(a) GDPR) — you actively submitted the form.
Retention: your waitlist record is removed within approximately ninety (90) days after we notify you, or within approximately twelve (12) months if signups have not reopened — whichever comes first.
Your rights: every waitlist email includes a one-click unsubscribe link. You can also email support@trepeat.com at any time to access or erase your waitlist data or withdraw consent.
Who processes it: our email provider (Resend), our hosting and database sub-processors (Amazon Web Services and Supabase), and Cloudflare Turnstile (bot protection), as listed in Section 7 (Sub-Processors) below.

7. Sub-Processors

We use the following sub-processors. Each is bound by a data processing agreement and processes personal data only on our documented instructions.

Supabase (United States): primary database, authentication, encrypted vault for broker credentials.
Stripe (United States / EU, PCI SAQ A): payment processing, billing, tax calculation.
Amazon Web Services (United States, us-east-1): serverless functions (Lambda), trade-engine compute (ECS Fargate), website hosting (Amplify and CloudFront), Secrets Manager.
MetaAPI (region assigned by MetaAPI per broker server, commonly London): connectivity to MetaTrader 4 and MetaTrader 5 broker servers. MetaAPI also stores the MetaTrader login, password and server you give us, so it can keep the account connected.
Spotware Systems (cTrader Open API): cTrader sign-in (the authorisation you grant on cTrader's own site), account data and order execution for cTrader accounts.
Cloudflare, Inc. (global edge network): DNS, edge CDN, DDoS protection, and Turnstile bot protection on the sign-up and waitlist forms (which receives your IP address and browser signals).
Resend (EU): transactional email delivery.
PostHog (Frankfurt, Germany — EU region): product analytics. Receives an identify-payload (your Supabase user id, subscription type, subscription status, and trial-used flag — not your name or email address) once you have opted in, plus a closed-set event taxonomy covering signup, login, account connection, repeater lifecycle (created / started / stopped / archived / deleted), trade-copied (carrying only the repeater id — no symbol / side / qty / price), trade- flatten, checkout, subscription state changes, account archiving and deletion, two-factor and sign-in-email changes, sign-in link requests, saving recovery codes and feedback, plus page views and, on the public website, which button, pricing control, screen tab, question or footer link was used (the control and the page only — never anything you type). We do not autocapture clicks or keystrokes. PostHog's library also records when you leave a page, page-load performance (Web Vitals), error reports with their stack traces, and the full address of each page you visit and of the page that referred you, with any sign-in, recovery or confirmation code removed from both before they are sent. All analytics is disabled by default and runs only after you give explicit opt-in via the consent banner — until then PostHog captures nothing and sets no cookies. Session recording is disabled entirely. IP addresses are anonymised at ingest. Data residency is the EU (Frankfurt). You can withdraw consent at any time via the Manage Cookies link in the site footer (in the app: Settings → Manage cookie preferences), and we honour your browser's Do Not Track signal. You may also request manual opt-out by emailing support@trepeat.com with the subject "opt out of analytics."

8. International Data Transfers

Some of our sub-processors are based in the United States or other jurisdictions outside the European Economic Area. Transfers to these countries are protected by the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, supplementary technical measures (encryption in transit and at rest, key separation, access controls).

9. Data Retention

Account data: retained for the lifetime of your account and deleted immediately when you delete your account. We keep only: anonymised billing records at Stripe (your email, name and phone are removed; the billing address and any tax ID stay with the invoices), the free-trial record (below), records of any admin actions taken on your account, and security logs for up to thirty (30) days. Removal from our processors (Stripe, MetaAPI, file storage and PostHog) is requested at the same time.
Trade history: retained for the lifetime of your account so you have a complete journal. Exportable as an Excel (.xlsx) file at any time.
Shared P&L pages: kept until you revoke them in the share dialog or delete your account.
Payment data: billing records retained for ten (10) years to satisfy Maltese accounting and VAT obligations.
Security-event records: sign-ins from a new device, two-factor changes and session sign-outs, with the IP address and browser, are kept for the life of your account so you can review them in Settings.
Server logs: retained for up to six (6) months, then deleted automatically. The exact period depends on the service: high-volume operational logs are kept for one month, general application logs for three, and logs that act as an audit trail for account-security or payment events for six.
Broker credentials: deleted from Supabase Vault immediately upon account-removal request.
Free trials that end unpaid: if your free trial ends without your subscription ever having started (a subscription started with a promotion code counts as started), your account and any data it owns are automatically deleted approximately thirty (30) days after the trial ends. You receive an email warning before deletion, and subscribing before then cancels it. A subscription you have paid for and later cancel is archived instead: your data is kept, and subscribing again restores access.
Free-trial record: the cTrader account IDs connected before their user first paid (Section 2) are kept after your Trepeat account is deleted, so that the same cTrader trading account cannot be used for a second free trial under a new sign-up. We rely on our legitimate interest in preventing abuse of the free trial. The record holds only the cTrader account ID, the date of the first trial, and the id of the first Trepeat user who connected it; it holds no name, email address or trading data. Each entry is deleted automatically twelve (12) months after the trial in which the account was first used.
Unactivated accounts: if you sign up but never begin checkout, your account and any data it owns are automatically deleted about thirty (30) days after signup (GDPR data-minimization). You receive an email warning seven (7) days before deletion. Beginning checkout within that window cancels the deletion.

You have the following rights regarding your personal data:

Access — request a copy of the data we hold about you.
Rectification — correct inaccurate or incomplete data.
Erasure ("right to be forgotten") — request deletion of your personal data, subject to retention exceptions.
Portability — receive your data in a structured, commonly used, machine-readable format.
Restriction — request that we limit processing in specific circumstances.
Objection — object to processing based on legitimate interests, including direct marketing.
Withdraw consent — for any processing based on consent, at any time.
Lodge a complaint with the Maltese Information and Data Protection Commissioner (idpc.org.mt) or your local data-protection authority.

Exercise any of these rights by emailing support@trepeat.com. We respond within 30 days.

11. Security

We apply industry-standard security measures including TLS 1.2+ in transit, AEAD (libsodium) authenticated encryption at rest for broker credentials in Supabase Vault, encryption at rest on the underlying database storage layer, key separation between the vault and the application database, row-level security on every public-schema table, and strict CORS allowlists on every Lambda endpoint. Read our vulnerability disclosure policy if you have identified a security issue.

12. Minors

The Service is not intended for individuals under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have done so, contact us so we can delete it.

13. Changes to This Policy

We may update this Policy from time to time. When we make a material change we will revise the "Last updated" date above and notify registered users by email before the change takes effect. Continued use of Trepeat after the effective date constitutes acceptance of the revised Policy.

14. Contact

Privacy questions or requests: support@trepeat.com.