Privacy Notice

Effective date: November 5, 2026

This notice explains how the operator trading as q-bitf collects, uses, shares, and retains personal data. The operator is based in Thailand and is the controller for q-bitf account and service data. Contact: [email protected]. See the Imprint for operator information.

What we collect

• Account data. Sign-in is handled by Clerk. We receive your email address and basic profile data needed to authenticate you. We never see or store your password.
• Usage data. Standard server logs (IP address, user agent, request paths, timestamps) generated while operating and securing the Service. We also record anonymous product usage through PostHog — which pages you open, what you click, page-load speed, errors, and a session replay (a reconstruction of the page as you used it, so we can see where things break) — and send crash reports through Sentry. Replays mask everything you type, and hide your API keys and the text of your account, journal, support and sign-in screens. Neither PostHog nor Sentry drops a cookie or follows you between visits: a replay ends when you close or reload the page.
• Journal and Study content. The trades, reviews, daily plans, Study notes, boards and settings you save in the journal are stored in your account so they are available on every device you sign in on. They are private to your account.
• Broker logins (optional). If you connect a broker (Rithmic or a ProjectX firm) to import trades, we store the login you give us, with the password or API key encrypted, and use it only to fetch your fills when you ask for a sync. "Forget login" deletes it; imported trades stay.
• Google Drive (optional). Only if you connect Google Drive to sync an Obsidian vault with Study. What we access and why is described in full under "Google Drive and Google user data" below.
• Visit statistics. We use Google Analytics to count visits to the site: pages viewed, how you arrived (for example a search engine or a link), and your approximate location, device and browser. It is loaded through Cloudflare Zaraz, which sends this to Google from Cloudflare's servers rather than from your browser, and trims your IP address first.
• Browser extension and Discord status. The q-bitf TradingView extension stores your q-bitf API key and settings in your browser. If you choose "Connect Discord", Discord's own sign-in window asks you to let q-bitf set your Discord activity status. The resulting Discord token stays in your browser and is used only to set or clear that status ("In a session · Trading") while a TradingView chart or q-bitf page is open; it is never sent to our servers. We cannot read your Discord messages, friends or servers. "Disconnect" in the extension revokes the token, and you can also remove q-bitf under Discord's Settings → Authorized Apps.

Payments. We do not see or store your card details. Card payments are handled entirely by Stripe, which sends us only the fact that a payment succeeded, the amount, and an identifier for it. If you pay by PromptPay and send us a transfer slip, that image is stored in your support ticket so the payment can be matched to your account; ask us in that ticket if you want it removed once the payment is confirmed. We keep a record of what you paid and when, because we are required to and because you may need it.

We do not sell personal data to anyone.

How we use it

Authentication, providing the features you use (such as saving your journal or syncing your notes), operating and improving the Service, abuse prevention, and security. Nothing else.

Legal bases

Depending on the data and applicable law, we process data because it is needed to perform our contract with you, because you have consented, because we must meet a legal obligation, or for legitimate interests such as keeping the Service secure, preventing abuse, and understanding whether features work. Where we rely on consent, you may withdraw it without affecting processing that already occurred.

Google Drive and Google user data

Study, the note-taking room in the journal, can keep your notes in sync with an Obsidian vault stored in your Google Drive. This is optional and only starts when you choose Connect Google Drive and approve access on Google's own consent screen.

What we access. When you connect, Google asks you to allow q-bitf to see, edit and create files in your Google Drive, and to share your email address. We use that access only for the vault you choose:

• Folder names, to show you your Drive folders so you can pick the one that holds your vault.
• Markdown (.md) notes inside the chosen folder and its subfolders, which are read so they can appear as notes in Study. Other files (images, PDFs, Google Docs, the vault's .obsidian settings folder) are ignored.
• Writes inside the chosen folder only: notes you create or edit in Study are saved back to it as Markdown files, under a Q-BITF folder for notes that started in Study. If you resolve a note that was edited in both places, the version you didn't keep is saved under Q-BITF/Backups.
• Your Google email address, shown in Study so you know which Google account is connected.

We never delete files in your Google Drive, and we do not open, read or change files outside the folder you chose.

How it is used. Only to provide the sync you asked for: importing your vault's notes into Study, saving Study notes back to the vault, and keeping the two in step while Study is open. Note files are transferred directly between your browser and Google Drive; they do not pass through q-bitf's servers on the way. Notes you import become Study notes in your q-bitf account and are stored like any other Study note.

What we store. To keep the sync working without asking you to sign in to Google every hour, our servers store: the long-lived access key Google issues for your connection (encrypted), your Google email address, the ID and name of the folder you chose, and a sync record listing which Study note matches which vault file, with a fingerprint (hash) of each note's last synced contents. Short-lived Drive access keys are handed to your browser when it needs to sync.

Sharing. We do not sell Google user data, use it for advertising, or share or transfer it to anyone, except as needed to provide the sync, to comply with the law, or as part of a merger or acquisition with notice to you. We do not use Google user data to develop, improve or train generalized artificial-intelligence or machine-learning models. No person at q-bitf reads your Drive data unless you ask us to (for example in a support ticket), it is needed for security, such as investigating abuse, or the law requires it.

Limited Use. q-bitf's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deletion. Choose Disconnect in Study's vault panel at any time. That revokes q-bitf's access at Google and deletes the stored access key, email address, folder and sync record from our servers; your notes stay in Study and in your Drive. You can also remove q-bitf at myaccount.google.com/permissions, after which the stored connection is deleted the next time it is used. When you ask us to delete your q-bitf account, the Google Drive connection is revoked and deleted with it.

Third-party processors

The Service runs on infrastructure that processes data on our behalf:

Each processes only what it needs to perform its role, under its own privacy terms.

Cookies

We use two kinds of cookies:

• Sign-in cookies, set by Clerk, which keep you signed in.
• Analytics cookies, set by Cloudflare Zaraz for Google Analytics (named cf_zaraz_client and cfz_google-analytics_v4, kept for up to a year), which let us tell a returning visitor from a new one when counting visits. They are first-party cookies on q-bitf.com that scripts on the page cannot read.

No advertising cookies: Google Analytics' advertising features (audiences and remarketing) are switched off. PostHog and Sentry don't set any cookies of their own, and they lose track of you the moment you close or reload the page. You can block or delete cookies in your browser settings; blocking analytics cookies does not affect how the site works.

See the Cookie Policy for details and Cookie Settings to review available choices.

International processing

The providers listed above may process data in countries other than yours. Where required, we use the provider's contractual and security safeguards for international transfers. No internet or storage system is completely secure.

Retention and deletion

Account data, journal and Study content are retained while your account is active. A Google Drive connection is kept until you disconnect it, Google access is revoked, or your account is deleted. To delete your account and associated data, contact us through the link in the site footer.

Your choices and rights

Subject to applicable law, you may ask to access, correct, export, restrict, object to the processing of, or delete your personal data. You may also withdraw consent and complain to the relevant data-protection authority. Some requests may require identity verification, and legal or security duties may require us to retain limited records. Send requests to [email protected].

Changes

We may update this policy; the effective date above reflects the latest revision.