Privacy Policy

Last updated: October 19, 2026

Viktury (“we”, “us”) provides a trading journal and analytics service at journal.viktury.com (the “Service”). This policy explains what data we collect, why we collect it, and the choices you have. We collect only what the Service needs to work, we never sell your data, and you can delete your account at any time.

Data we collect

• Account data. Your email address, a password hash (we never see your password), and a phone number if you choose to enable SMS two-factor authentication. If you sign in with Google, we receive your email address and name from Google.
• Trading data you import. Trade history from CSV files you upload or from exchange and broker connections you set up. The Service only accepts read-only API keys, and the keys you provide are stored encrypted. We never ask for keys with trading or withdrawal permissions.
• Journal content. Notes, tags, playbooks, screenshots, and other content you create inside the Service.
• Billing data. Payments are processed by Stripe. We store your subscription tier and status; we never see or store your card number.
• Technical data. Server logs (IP address, timestamps, request paths) kept for security and debugging, error reports, and privacy-friendly, cookieless product analytics.
• How you use the app. Which pages you open and for how long, and the steps you take when connecting an exchange (which exchange you picked and whether saving worked), stored on your account so we can see where setup gets hard. We never record your API keys or anything you type.
• How you found us. The link source and landing page that brought you to sign up, if the link carried them, stored on your account.

What we use it for

• Providing the Service: importing, storing, and analyzing your trading activity.
• Account security: email verification codes, password-reset codes, and two-factor authentication messages.
• Service notifications, such as a notice when an exchange connection stops syncing and needs to be re-authorized.
• An optional weekly summary email of your own trading statistics. You receive it only if you opt in, and every one contains an unsubscribe link.
• Tips and product news: a few emails in your first weeks to help you get set up, and the occasional note about new features. You receive them only if you turn them on in your profile, and every one contains an unsubscribe link.
• Billing and subscription management.
• AI trade critiques. When you ask for a critique of a trade, we send that trade, your recent trades, your notes and tags on them, and your journal entries to Microsoft Azure OpenAI, which writes the critique. On Edge, once a week we also send your recent notes and journal entries so later critiques know your habits and your own rules. We never send your email address, your name, your account names, or your API keys.

We do not sell your data, share it with advertisers, or use it to train machine-learning models.

Where your data lives

Your data is stored on Amazon Web Services servers in the Europe (London) region, encrypted at rest and in transit. Exchange API keys get an additional layer of encryption on top of that.

Third parties we rely on

• Amazon Web Services for hosting, storage, and email delivery.
• Stripe for payment processing.
• Sentry for error monitoring.
• Google, only if you choose “Sign in with Google”.
• Microsoft Azure OpenAI, in the EU, to write AI trade critiques. Microsoft does not use what we send to train its models. To detect abuse of its service, it may keep what we send for up to 30 days before deleting it.

Each of these processes data only as needed to provide its service to us. We do not use advertising or cross-site tracking cookies, or third-party advertising scripts.

Data retention and deletion

Your data is retained while your account is active. You can delete your account from your profile settings at any time. Deletion is not instant: the account is scheduled for deletion and keeps working for 30 days, so you can cancel if you change your mind or the request was not yours. Nothing is removed during that window.

After 30 days the account is deleted. Your data is removed from the live Service, and a copy is written to a separate archive that is not part of the Service and is not used to run it. Before anything is written there we strip out the details that identify you: your email address, your name, your billing and payment identifiers, any exchange API keys you connected, and the account identifier the Service knows you by. What remains is filed under a random reference instead. We keep that archive so we can rebuild an account when a deletion turns out to have been a mistake, and to meet our legal and accounting obligations. We keep it for as long as one of those reasons applies.

Email addresses that hard-bounce or report our emails as spam are kept on a do-not-send list.

Your rights

You can access and export your data (the Service has a built-in export), correct it, or delete it at any time. If you are in the EU/EEA or UK, you additionally have the rights provided by the GDPR (access, rectification, erasure, portability, restriction, and objection). To exercise any right that isn’t available in-app, email us at support@viktury.com.

If you are in Turkey (KVKK)

This section is our notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).

• Who is responsible. Viktury is the data controller for the data described in this policy. You can reach us at support@viktury.com.
• Why we process it. For the purposes listed under “What we use it for” above.
• On what legal basis. Providing the Service you signed up for (KVKK Article 5(2)(c)); keeping billing and accounting records we are legally required to keep (Article 5(2)(ç)); our legitimate interest in keeping the Service secure and working, which covers server logs and error reports (Article 5(2)(f)); and your explicit consent for tips and product news emails and for the referral and link-source cookies, which you can withdraw at any time.
• How we collect it. From you when you sign up and use the Service, from the files you upload, from the exchange and broker connections you set up, and automatically through server logs and the cookies described below.
• Transfers abroad. Your data is stored in the United Kingdom (Amazon Web Services, London) and is processed by the providers listed under “Third parties we rely on”, some of which are outside Turkey. We transfer data abroad only as Article 9 of the KVKK allows.
• Your rights under Article 11. You can ask us whether we process your data and for information about it; learn why we process it and whether it is used for that purpose; know who it is shared with in Turkey or abroad; have it corrected if it is incomplete or wrong, or deleted; have those corrections and deletions passed on to anyone we shared it with; object to a result that goes against you and comes only from automated analysis; and claim compensation if unlawful processing harms you.
• How to apply. Email us at support@viktury.com from the address on your account. We answer free of charge within 30 days.

Cookies

The Service uses essential cookies and local storage for signing in and keeping you signed in. The two cookies below are set only if you agree when the Service asks; if you decline, no cookie is stored and the details are kept only while the page is open. The one exception is a friend’s referral code: the sign-up screen shows it (you can remove it), and when you start signing up with it, your browser tab keeps it in session storage until your account records it, so your friend still gets credit. Closing the tab deletes it. If you agree and arrive through a friend’s referral link, it sets one first-party cookie that remembers their code for up to 30 days, so they get credit if you sign up; it is deleted once your account records it or after 30 days. If the link you followed says where you came from, a second first-party cookie keeps that source and the page you landed on for up to one day, so they reach your account even if the page reloads while you sign up. It is deleted once your account records them, and Google sign-in carries them through as well. It sets no advertising or cross-site tracking cookies. The marketing site (viktury.com) uses cookieless analytics and sets no cookies at all.

Changes

We will update this policy as the Service evolves. Material changes will be announced in the Service before they take effect. The “last updated” date at the top always reflects the current version.

Contact

Questions about this policy or your data: support@viktury.com