Privacy policy

Who we are

The controller of your personal data is the operator of FxMind (fxmind.ai). In this policy, FxMind, we and us mean that operator.

For any privacy question or request, write to support@fxmind.ai. The same address reaches our data protection officer, including for the purposes of Brazil's LGPD (encarregado).

What we collect

Account data

Email address, name, language, time zone and notification preferences.
Your password, stored only as an Argon2id hash. We cannot read it.
If you sign in with Google or Apple: the account identifier and the email address the provider shares with us.
2FA data: the authenticator secret, stored encrypted, and recovery codes, stored as hashes.
Plan, trial status, referral code and, if you connect them, your Telegram or Discord identifiers, and your browser's push notification subscription if you turn on push alerts.

Trading account data

When you link a trading account, through a read-only link or a guarded link, we receive from your broker's server:

the broker server, login number, account currency and leverage;
balances, equity and margin;
open positions, pending orders, deals and order history.

We also keep your guard rules, action policies and a log of every warning and guard action, with the broker's replies. If you import trades from a CSV file, we keep what the file contains.

Broker passwords

The investor password of a read-only link, or the master password of a guarded link, is encrypted at rest with AES-256-GCM. Only the isolated bridge service that signs in to brokers can decrypt it, and it does so only to sign in to your broker. The password is never shown again, never returned by any part of our API and never written to logs. It is deleted when you remove the account link.

Content you create

Journal content: notes, tags, setups, mistakes, playbooks, screenshots and voice memos. If you turn on transcription, the text of a voice memo is kept beside it; the audio itself is kept only for as long as your account exists.
Analyst conversations: your questions, the answers and the sources cited, including conversations started in the demo account, and any journal changes you asked the analyst to make and applied.
Support conversations, emails, tickets, attachments, ratings and any machine translation of a support message. If you chat with us without an account, the email address you give us.
Community messages, setup cards and comments you post, and mentor comments on a journal you were invited to read.

Billing records

Card payments are handled by Stripe. You enter payment details on their pages. We do not receive or store full card numbers. We keep your plan, invoices, amounts, currency, taxes, billing country, payment status and Stripe's customer and payment references.

Technical and security data

IP address, approximate country, device and browser type, sign-in events (successful and failed), session records (device, IP address, country and last activity), security logs and error logs.

Audit log

We keep an audit log of sensitive actions on your account (for example signing in, changing a guard rule, creating an API key, inviting a mentor, or an automatic action a guard or a followed setup took), with the time, the IP address and device it came from, and what changed. You can see your own account's entries under Security in Settings.

Trial fairness codes

To keep the free trial to one per person, we store one-way codes made from the email address, the network (IP address range) and the browser used to sign up, and from MT5 and MT4 accounts linked during a trial. We keep the codes, not the email address, IP address, browser id or account number themselves. A code cannot be turned back into the original value. It can only be compared with the code of a new sign-up or link.

Referral and affiliate data

If you arrive through a referral or partner link, we record the time, the landing page, campaign tags, the country, and one-way codes of the IP address and browser. If you are an affiliate, we also keep your payout details, stored encrypted, your commissions and payouts, and any tax forms you send.

We do not ask for sensitive data such as health, religious beliefs or political opinions. Please do not put it in notes, chats or tickets.

How we use data and our legal bases

We use personal data only for the purposes below. Where the GDPR, the UK GDPR or Brazil's LGPD applies, each purpose relies on the legal basis shown next to it.

Providing the service: accounts, sign-in, linked accounts, journal, warnings, guard actions, analyst answers, briefs and support: Performance of our contract with you
Billing, invoices, taxes and accounting records: Contract, and legal obligations
Security, fraud and abuse prevention, including trial fairness codes, sign-in alerts and self-referral checks: Legitimate interests in protecting you, other users and the service, and legal obligations where they apply
Service messages about security, billing, your account and changes to our terms: Contract, and legitimate interests
Product news and marketing emails: Consent, or legitimate interests where the law allows it for existing customers. You can unsubscribe in any such email or in Settings
Improving FxMind with statistics that do not identify you, and fixing faults: Legitimate interests
Running the affiliate program: attribution, commissions and payouts: Contract with the affiliate, and legitimate interests in correct attribution
Complying with the law, answering lawful requests, and establishing or defending legal claims: Legal obligations, and legitimate interests (under the LGPD, the regular exercise of rights)
Cookies and browser storage that are not strictly necessary: Consent, where the law requires it

Where we rely on legitimate interests, we have weighed them against your rights, and you can object as explained under your rights. Where we rely on consent, you can withdraw it at any time.

We do not make decisions based only on automated processing that have legal or similarly significant effects on you. Trial eligibility is checked automatically. If you think a trial was refused by mistake, write to us and a person will review it.

Market positioning. If you link a trading account, FxMind may include the direction of its open positions (long or short) in an aggregated figure shown to other FxMind users, such as "62% of FxMind traders holding EUR/USD are long". The figure combines at least 20 accounts per currency pair, is shown only once FxMind has at least 200 linked accounts, is delayed by at least 30 minutes, and never identifies you, your account, the size of any position or when you opened it. Practice (demo) accounts are not included. The legal basis is our legitimate interest in giving traders context about the market they trade in.

AI processing

When you ask the analyst a question, your message and the account context needed to answer it, for example positions, trades, journal notes, balances and guard rules, are sent to DeepSeek, our AI model provider, to generate the answer. Nightly trade reviews work the same way.
When you use the support assistant, your support conversation and the account status needed to answer are sent to DeepSeek. To draft a reply to a message you send us on a ticket, by chat or by email, the ticket's conversation (your messages, our replies, your first name and the subject) is sent to DeepSeek; if you have agreed to AI processing, the draft may also read the account details needed to answer. A person at FxMind reads the draft and decides what is sent to you. A machine translation of a support message is sent to DeepSeek to translate, and nothing else.
If you turn on trade ideas, the market data and journal context needed for an idea are sent to DeepSeek to generate it. If you ask the analyst to change your journal, the change is only ever a preview until you apply it yourself.
Voice memos are kept as audio only. They are not sent to an AI model provider.
DeepSeek processes and stores this data in the People's Republic of China, under the terms of its open platform. Those terms do not say that DeepSeek keeps data sent through its API out of the training of its models, or how long it keeps that data. We do not use your conversations or your trading data to train AI models.
Broker passwords, 2FA secrets and payment card data are never sent to an AI model provider.
Guards do not use AI models. They are plain code that compares your account with the rules you set.
If you connect your own AI application through MCP, the data it reads and the trading instructions it sends move between that application and FxMind under your API key; FxMind is not the one choosing to send your data to that application, you are.

We share personal data only with the recipients below, and only as far as each one needs it. Service providers process data on our instructions, under contracts that require them to protect it. DeepSeek, our AI model provider, processes it under the terms of its own open platform, described in "AI processing" above.

Hosting and network security: Our server hosting provider, and Cloudflare for network security, content delivery and protection against attacks
Email delivery: Resend, for account, security, billing and alert emails
Payments: Stripe for card payments, once it is turned on. Affiliate payouts are USDT transfers on a public blockchain (Tron or Ethereum), where the amount and the receiving wallet address are visible to anyone
AI model provider: DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China), for the analyst, trade reviews, trade ideas, the support assistant, draft replies to support messages and support translations (see "AI processing" above and "International transfers" below)
Connection to your broker: Proxy providers that carry the connection between our bridge and your broker's server
Sign-in and messaging: Google or Apple if you sign in with them; your browser's own push service (for example a service run by your browser maker) if you turn on push alerts; Telegram or Discord if you turn those channels on
Your broker: Receives the sign-in and, on a guarded link, the actions your policy allows, as it would from any MetaTrader terminal you use, including an action a followed setup's automatic management sent
An AI application you connect: If you turn on and allow it, an AI application you connect with your own API key receives the FxMind data your key allows and can send trading instructions back, under your control, not ours
A white-label site's owner: If you sign up on a white-label site, its owner can see your activity as a customer of their business (for example that you signed up and your plan), never your broker credentials, trading account details or journal content

Market data providers, such as our price, calendar and news sources, receive no personal data from us.

Affiliates see counts and commission amounts for the people they referred, never their trading data. We disclose data to authorities, courts or regulators only when the law requires it, and we tell you when we are allowed to. If FxMind is sold or merged, data may pass to the new owner, who must keep protecting it as this policy describes.

We do not sell personal data, and we do not share it for targeted advertising.

White-label sites

Some businesses (for example a prop firm or an introducing broker) offer FxMind under their own brand, on their own subdomain. If you sign up on a site like that, FxMind still runs the service and is still the controller of your personal data under this policy: your trading data, your broker credentials and your journal are held to the same rules as any other FxMind account, and the site's owner cannot read them. The site's owner can see that you are their customer and your plan, so they can run their own business, but nothing more.

International transfers

Our providers operate in several countries, so your data may be processed outside the country where you live. This includes the United States (for example Cloudflare, Resend and Stripe) and the People's Republic of China (DeepSeek, our AI model provider, for the analyst, trade reviews, trade ideas and support).

When we transfer personal data out of the European Economic Area, the United Kingdom or Brazil, we use a safeguard the law recognises: an adequacy decision where one exists, the standard contractual clauses approved by the European Commission with the UK addendum, or the standard contractual clauses approved by Brazil's ANPD. You can ask us for a copy of the relevant safeguard. For DeepSeek, in China, there is no adequacy decision and no standard contractual clauses are signed yet. So you agree to it when you create your account (for an account created before 30 September 2026, the first time you use an AI feature), knowing the risks: Chinese law may give authorities access to data held there, and you may not have the same rights and ways to complain there as at home. If you chat with the support assistant without an account, it asks you first. You can withdraw that agreement at any time in Settings, and the AI features then stop for your account. Support messages sent on a ticket, including by email and by people without an account, are drafted and translated with DeepSeek for the person at FxMind who answers them.

How long we keep data

Account data, linked account data, journal and conversations: While your account is open, and up to 30 days after a deletion request is completed
Account deletion: You have 7 days to cancel a deletion request. After that the account is closed and its data erased as above
Broker passwords: Deleted when you remove the account link, or when the account is deleted
Billing records and invoices: As long as tax and accounting law requires, also after the account is deleted
Sign-in events, session records and security logs: Up to 12 months
Trial fairness codes: Network, browser and MT5 or MT4 account codes up to 12 months. The email code of a started trial for as long as needed to enforce one trial per person
Affiliate commissions and payouts: As long as tax and accounting law requires
Referral click data: Up to 12 months
Support conversations without an account: Up to 24 months after the conversation closes
Demo conversations: Only as long as needed to run the demo and protect it from abuse
Voice memo audio: While your account is open; the transcript, not the audio, stays in your export
Audit log: Up to 12 months for ordinary entries; longer for money and security entries, and for as long as needed to investigate a specific incident
Community messages and setup cards: While the community exists; a deleted account's past posts stay in the community, shown as "Deleted trader"
Mentor access grants and comments: While the grant is active, and up to 30 days after it ends or the account is deleted
Backups: Deleted data leaves our backups within 35 days

We keep data longer only where the law requires it, or to establish or defend a legal claim, and then only for that purpose.

Cookies and local storage

FxMind uses a small number of cookies and browser storage entries. We do not use advertising cookies. If that changes, this page will say so first, and we will ask for your consent where the law requires it.

fx_rt (strictly necessary): Keeps you signed in. A secure cookie that scripts cannot read. It lasts until you sign out, or up to 30 days without use and 90 days in total
Security cookies (strictly necessary): Set by Cloudflare to tell people apart from automated traffic and protect the service
fx_session (strictly necessary): A browser storage flag that tells the app this browser has signed in
Language (preference): A cookie that remembers the language you chose
Theme and display (preference): Browser storage that remembers the light or dark theme and layout choices, such as hidden table columns
fx_device (trial fairness): A random id created in your browser storage and sent when you sign up or confirm your email. We store only a one-way code of it, to limit free trials to one per browser
fx_ref (referral): Set only when you arrive through a referral or partner link, so the right person is credited. Lasts 30 or 60 days, depending on the program

You can delete cookies and browser storage in your browser settings. If you block strictly necessary cookies, you cannot stay signed in.

Your rights

Depending on where you live, the law gives you rights over your personal data. We offer these to every user:

Access. Confirmation that we process your data, and a copy of it.
Correction. Fixing data that is wrong, incomplete or out of date.
Deletion. Deleting your account and data, except records the law makes us keep.
Portability. Your data in a structured, machine-readable format.
Objection. Objecting to processing based on our legitimate interests, and to direct marketing at any time.
Restriction. Limiting how we use your data while a question about it is resolved.
Withdrawing consent. At any time, without affecting what we did before.
Complaint. Complaining to a data protection supervisory authority.

European Union and United Kingdom

Under the GDPR and the UK GDPR you have the rights above, and the right not to be subject to a decision based only on automated processing that has legal or similarly significant effects. You can complain to the supervisory authority where you live or work, or in the United Kingdom to the Information Commissioner's Office.

Brazil

Under the LGPD you also have the right to information about the public and private entities we share data with, to information about the option of not giving consent and its consequences, to anonymisation, blocking or deletion of unnecessary or excessive data, and to a review of decisions made only by automated processing. You can complain to the Autoridade Nacional de Proteção de Dados (ANPD).

California

Under the CCPA, as amended by the CPRA, California residents have the right to know what personal information we collect, use and disclose, and to delete and correct it. The categories we collect are identifiers, customer and commercial records, internet activity and approximate location, as listed under what we collect, for the purposes and recipients described above. We do not sell personal information or share it for cross-context behavioural advertising, and we use sensitive personal information, such as account credentials, only to provide and secure the service. We will not treat you differently for using your rights. An authorised agent may make a request for you with your written permission.

How to use your rights

Much of this is in Settings: edit your profile, export your data, remove account links and delete your account. For anything else, write to support@fxmind.ai from the email address on your account. We may ask you to confirm your identity first.

We answer within the deadlines the law sets: one month under the GDPR and the UK GDPR, which can be extended by two months for complex requests; 15 days for a complete access report under the LGPD; and 45 days under the CCPA, which can be extended once by 45 days. Requests are free, unless they are clearly unfounded or excessive.

Children

FxMind is not for anyone under 18. We do not knowingly collect personal data from children. If we learn that an account belongs to someone under 18, we close it and delete its data.

How we protect data

Connections to FxMind are encrypted with TLS.
Account passwords are stored as Argon2id hashes.
Broker passwords are encrypted at rest with AES-256-GCM and can be read only by the isolated bridge service, only to sign in to your broker.
2FA secrets are stored encrypted and recovery codes as hashes. Trial fairness codes are one-way codes.
You get 2FA, a list of active sessions you can sign out, and an email when a new device signs in.
Staff and support accounts require 2FA, and staff access to your data is limited to what their work needs.

No system is completely secure. If a personal data breach affects you, we tell you and the authorities as the law requires. Report a vulnerability to support@fxmind.ai. More detail is on the security page.

Changes to this policy

We may update this policy. The dates at the top show the current version. If a change materially affects how we use your data, we tell you by email or in the app before it takes effect, and we ask for your consent where the law requires it.

Contact

Privacy requests and data protection officer: support@fxmind.ai
Security reports: support@fxmind.ai
Everything else: support@fxmind.ai

See also the terms of service and the risk disclosure.

Questions about this document: support@fxmind.ai