Privacy Policy

sizeforzero (“we”, “us”, “our”) operates the sizeforzero trading journal platform (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the Service. We have written this policy to be readable in plain English, and to comply with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Act Respecting the Protection of Personal Information in the Private Sector (often called “Law 25”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and other applicable privacy laws across North America.

We are a Canadian company. Our service is operated from Canada and our servers are located in North America. If you live in the European Union or United Kingdom, please note that we do not currently market the Service to those regions and do not represent compliance with the GDPR or UK GDPR.

1. The short version

2. Information we collect

2.1 Information you provide

• Account information: email address, handle (optional), name (optional), timezone, currency preference.
• Profile information: trading experience level, preferred markets, trading style — all optional and editable in Settings.
• Trade data: trade entries, fills, positions, instruments, notes, tags, the setup and mood labels you choose on a trade, and related financial data you enter manually, import via CSV, or import from a brokerage account you connect through our aggregation partner, SnapTrade (see §6).
• Notes and journal entries: the notes, thesis, and review you write on a trade are saved with your records on our servers as part of your account. They are sent to AI only if you turn on AI processing (§4) — that single switch is the only consent gate; there is no separate journal-storage opt-in.
• Billing information: if you subscribe to a paid tier, your name, billing address, and payment-card metadata are collected by Stripe on our behalf (see §6 — Subprocessors). We do not store full card numbers on our servers.
• Communications: emails or messages you send to our support team, including any attachments.

2.2 Information collected automatically

• Server logs: each request to the Service records the page or interface called, the time, your IP address and browser type, and any error. We use them only for security and debugging and keep them for a limited time, then delete them. Inside the app we do not track which pages you view or how long you stay.
• Device information: browser type, operating system, and IP address — used for security (rate limiting, fraud detection) and not used for profiling or advertising.
• Cookies: we use only essential, first-party cookies required for authentication. See §10 — Cookies.

2.3 What we do NOT collect

• We do not collect Social Insurance Numbers, Social Security Numbers, government IDs, or any other sensitive identifiers.
• We do not collect brokerage account credentials, broker logins, or full payment-card numbers (Stripe handles those directly).
• We do not use third-party analytics tools, advertising trackers, or session replay tools.
• We do not buy data about you from data brokers.

3. How we use your information

We use your personal information for the following purposes:

• To provide, operate, and maintain the Service.
• To authenticate your identity and manage your account.
• To send transactional emails — sign-in links, sign-up invitations, a welcome message, billing and trial notices, account-deletion and restore notices, and account-security alerts — and, if you ask us to tell you when a broker you requested becomes available, one email when it does.
• To send you a short note when a new letter is ready, only if you switch that on in Settings, under “Notifications”. Free can switch on a note that the monthly letter or digest is ready; Pro can also switch on a note for the Sunday letter. The note links to the app and never contains the letter itself. It stays off until you turn it on, and you can turn it off at any time in Settings or with the unsubscribe link in the note. We do not send promotional or marketing email.
• To respond to your inquiries and provide customer support.
• To improve the Service, using aggregated and anonymised patterns that cannot be linked back to individual users.
• To comply with legal obligations and respond to lawful requests.

We do not use your personal information to provide financial advice, trading recommendations, or investment signals. We do not sell your personal information. We do not share your personal information for cross-context behavioural advertising.

4. AI processing — opt-in only

sizeforzero offers AI-generated reflections on your trading. Pro includes a daily reflection, the weekly Sunday letter and per-position reflections. Free accounts receive two reflections a month, a monthly letter, a monthly digest and the lessons rulebook, on the same terms. A month in which you close no trades gets no monthly letter and no monthly digest. Because this involves sending some of your data to a third-party AI processor, we treat AI consent as a separate decision from signing up: nothing is sent to the AI processor until you turn AI processing on.

4.1 Our AI processing partner

As of the date above, our AI processing partner is Anthropic, PBC (model providers of Claude). Anthropic processes our requests in the United States. Our agreement with Anthropic includes a Data Processing Addendum incorporated automatically when we accepted Anthropic’s Commercial Terms of Service, and is published at anthropic.com/legal/data-processing-addendum.

Anthropic’s Commercial Terms forbid training on customer API data. This means your trades and any journal entries you choose to send are not used to train any AI model.

We treat the AI processor as a swappable subprocessor. If we change providers, we will update this policy and post a banner notice in the app for at least 30 days before the change takes effect. A change in the identity of the processor does not by itself require us to re-collect consent unless the data flow or retention materially changes.

4.2 What we send to the AI processor

• Trades: ticker, the dates you opened and closed, days held and the hold you planned, plus quantity and average cost.
• Results: profit and loss on closed trades, win rate and period totals in your currency. Never balances, portfolio value or unrealised gains.
• Labels: the setup, mood, conviction and after-the-close read you tag a trade with. These come from short fixed lists; nothing is inferred about you.
• Notes: your thesis, review and trade notes as you wrote them, with email addresses and phone numbers redacted. They never train a model. Notes are sent only while AI is on.
• Patterns: habits counted from your closed trades, what they cost and a rule drafted for the costliest; the months and weekdays your results run best and worst; how long you have traded, as you told us in your profile; and one sentence from your previous letter so a letter can build on the last.
• Market: how your results compare with public market indexes, plus news and earnings dates for the tickers you held or traded in the same period.
• Questions: anything you type when you ask Iris a question.
• Request code: when your letter is written in an overnight batch, the request carries a random code with an internal account number inside it, so the result reaches the right person. It is not your name, your email or any other detail we hold about you.

4.3 What we never send to the AI processor

• Your name, email address, handle, IP address, device identifier, broker, account numbers or balances — we never attach these to a request. The one identifier a batched request carries is the internal number described in 4.2.
• Any payment information (card number, billing address).
• Any data that belongs to other users.

One caveat, stated plainly: the notes you write are sent as you wrote them. We automatically remove email addresses and phone numbers from your free text before it is sent, but we do not scan prose for names or account numbers — so please avoid typing personal identifiers into a trade note if you would rather they were not processed.

4.4 Retention at the AI processor

By default, Anthropic retains API requests and responses for up to 30 days for abuse monitoring, after which they are deleted. We are pursuing a Zero Data Retention agreement with Anthropic for our production org; if and when we obtain it, we will update this policy and notify users by email. Until then, the 30-day retention applies.

4.5 Granting and withdrawing AI consent

You grant AI consent in one dedicated step before any AI feature runs. We show you exactly what the AI reads and where it goes, and nothing is sent until you press “Turn on reflection” while setting up your journal, or switch on “Let Iris read my trade notes” in Settings.

You can withdraw consent at any time by switching off “Let Iris read my trade notes” in Settings, under “Data & privacy”. Withdrawal stops new AI requests immediately. When you withdraw, we also delete the AI-written reflections, position reads, lessons, daily drafts and pattern history we had stored for you. We keep your Sunday letters and monthly letters so your history stays readable. They are deleted when you close your account, or sooner if you ask us, and we will do that within 30 days. The notes you wrote yourself are not affected.

When AI processing is off, the rest of the Service continues to work normally; you simply will not see new AI-generated insights.

We keep a record each time you turn AI on or off: the date, the version of the consent text you saw, the country and region we can tell, a one-way scrambled form of your IP address (we never store the address itself) and your browser details. We keep it so we can show what you agreed to, and it is erased with your account.

4.6 AI is reflection, not a decision

The AI generates short reflections about your trading patterns. It does not make decisions for you, does not place trades, does not move money, and does not control any aspect of your account. Under Quebec’s Law 25 and California’s CPRA, the AI is therefore not engaged in “automated decision-making” with legal or similarly significant effects on you. Reflections are informational, not advisory — see our Terms of Service for the full disclaimer.

5. Legal basis for processing

Under PIPEDA and equivalent provincial laws, we process your personal information based on:

• Consent: you provide consent when you create an account, and an additional, specific consent before AI processing runs.
• Contract performance: processing necessary to provide the Service you have asked us to provide.
• Legitimate interest: security, fraud prevention, and improving the Service in ways that do not override your rights.
• Legal obligation: compliance with applicable laws and lawful government requests.

6. Subprocessors and data sharing

We share personal information only with vendors that help us run the Service. Each one is contractually required to protect your data and use it only for the purposes we direct. Our subprocessors as of the date above:

We may also disclose your information when required by law, court order, or governmental request; or in connection with a merger, acquisition, or sale of assets, with notice to you. We will never sell, rent, or trade your personal information or trade data for marketing purposes.

7. Data retention

We retain different categories of data for different periods, set by what is necessary to provide the Service and comply with the law:

• Account data: for as long as your account exists. When you close your account we keep it for 30 days so you can change your mind, then erase it permanently. The erasure runs automatically each night, so it happens within a day after those 30 days end. We email you a reminder 7 days before.
• Sign-ups that are never confirmed from the email link are deleted automatically after 7 days.
• Trade and journal data: for as long as your account exists, or until you delete it yourself with the in-app delete tools. If you close your account it is erased with the rest of your account data (30 days, then permanently).
• AI letters and insights: your Sunday letters and monthly letters are kept for the life of your account so you can revisit them over time; they are not auto-purged on a timer. Other AI-written reflections are deleted when you withdraw AI consent. Everything is erased when your account is erased (see §4.5).
• AI request logs at our processor: up to 30 days (Anthropic’s default), or zero days if and when our Zero Data Retention agreement is in place.
• Billing records: payment, refund and subscription records are kept for at least the 7 years Canadian tax law requires. When your account is erased they are separated from your identity. Stripe also keeps its own records under its own policies.
• Anonymised, aggregated analytics: may be retained indefinitely; cannot be re-linked to individual users.
• Security log: while your account exists we record sign-ins, data exports and similar security events, with the IP address and browser we saw, so we can investigate abuse. When your account is erased these records stay, but your user ID, IP address and browser details are removed, so they can no longer be linked to you. We keep these anonymous records without a fixed end date.
• Email log: we keep a record of each email we send (when, what kind, and whether it was delivered) for 3 years. When your account is erased, the address, subject and any error text on those records are blanked.
• Backups: our database provider keeps a rolling history of the database so we can recover from a serious failure. That history is kept for a limited time set by the provider and then expires. Data we have erased can remain in that history until it expires. We use it only to recover the whole service. Any manual safety copy we take before a major change is kept for a limited time and then deleted.
• To keep free trials to one per card, we keep a one-way fingerprint of the card used for a trial, not linked to your account, after your account is deleted.

8. Data security

We implement industry-standard technical and organisational security measures, including:

• TLS/HTTPS encryption for all data in transit.
• Encrypted database connections with SSL enforcement.
• Encryption at rest for the database (AES-256, managed by Neon).
• Passwordless authentication via signed one-time email links — no passwords stored.
• HTTP-only, secure, SameSite-strict cookies for session management.
• Content Security Policy (CSP) headers and modern security headers across all pages.
• Regular token rotation, session revocation on sign-out, account deletion and security events, and rate limiting on sensitive endpoints.
• Least-privilege database access; production database changes require code review and migration history.
• Secrets stored in Google Secret Manager — not in source code.

No system is perfectly secure. If a breach occurs and we determine it poses a real risk of significant harm, we will notify affected users and the Office of the Privacy Commissioner of Canada in accordance with PIPEDA’s breach-notification requirements, and any applicable provincial or U.S. state laws.

9. Your rights

9.1 Canadian residents (PIPEDA)

You have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Withdraw consent for collection, use, or disclosure (which may limit your access to parts of the Service).
• File a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

We will respond to access and correction requests within 30 days.

9.2 Quebec residents (Law 25)

In addition to PIPEDA rights, Quebec residents have the right to:

• Data portability: request your personal information in a structured, commonly-used technological format. You can download it yourself from Settings, under “Your data”, as a ZIP of JSON and CSV files.
• Opt out of automated decision-making: we do not make automated decisions about you with legal or similarly significant effects (see §4.6). If we ever introduce such a feature, you will have the right to request human review and to obtain an explanation of how the decision was reached.
• Be informed of cross-border transfers: as noted in §11, your data may be transferred to and stored in the United States.

Quebec’s Law 25 designates a “Person Responsible for the Protection of Personal Information” — for sizeforzero, that is the founder, reachable at privacy@sizeforzero.com.

9.3 California residents (CCPA / CPRA) · Do Not Sell or Share

You have the right to:

• Know what personal information we collect, use, disclose, and (if applicable) sell or share — see §2 and §6 above.
• Delete your personal information, subject to legal retention exceptions (e.g. tax records).
• Correct inaccurate personal information.
• Opt out of sale or sharing of personal information — we do not sell or share your personal information for cross-context behavioural advertising, so there is nothing to opt out of.
• Limit use of sensitive personal information — we do not use sensitive personal information for any purpose outside of providing the Service.
• Non-discrimination for exercising your privacy rights — we will not deny service, charge a different price, or provide a different level of quality because you exercised a right.
• Limit automated decision-making technology (ADMT):we do not use ADMT to make decisions about you with legal or similarly significant effects (see §4.6).

To exercise any right, email privacy@sizeforzero.com with “Privacy Request” in the subject line. We respond to verifiable requests within 45 days, with one extension of 45 days available for complex requests.

9.4 Other U.S. state residents

If you reside in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or another U.S. state with a comprehensive consumer privacy law, you may have similar rights to access, delete, and correct your data. Send a request to privacy@sizeforzero.com and we will honour the broadest applicable rights granted by your jurisdiction.

10. Cookies

We use only essential, first-party cookies required for authentication and session management. These cookies are strictly necessary for the Service to function and cannot be disabled. We do not use analytics cookies, advertising cookies, fingerprinting, or third-party tracking.

11. International data transfers

Your data is stored on servers located in North America (Google Cloud Platform, US-East region; Neon database in the United States). If you are accessing the Service from outside North America, your information may be transferred to, stored, and processed in Canada or the United States. By using the Service, you consent to this transfer, and we rely on the contractual protections in our subprocessor agreements to safeguard your data during transfer.

12. Children’s privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you are under 18, do not use the Service or send us any personal information. If we become aware that we have collected data from a child, we will delete it promptly and close the account.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page, updating the “Last updated” date, and (for changes affecting how we process data — including any change of AI subprocessor) by sending you an email and showing an in-app banner for at least 30 days before the change takes effect. Your continued use of the Service after the change takes effect constitutes acceptance of the updated policy.

14. Contact us

If you have questions about this Privacy Policy, want to exercise a privacy right, or wish to file a complaint about our privacy practices, contact us at:

For complaints regarding our privacy practices that we have not resolved to your satisfaction, you may also contact:

• Office of the Privacy Commissioner of Canada — priv.gc.ca
• Commission d’accès à l’information du Québec (Quebec residents) — cai.gouv.qc.ca
• California Privacy Protection Agency (California residents) — cppa.ca.gov