Skip to main content
← Back to TMI

Privacy Policy

Last updated: October 2026

Controller

The controller for the processing of personal data on this website is Quantpeak Holdings LLC, e-mail business@tmi-ai.com. The full postal address is published in the Impressum.

Representative in the Union under Art. 27 GDPR: The appointment is in preparation. Until then, the controller can be reached about any data protection matter at business@tmi-ai.com.

Impressum

Data we process

Depending on how you use TMI, we process the following personal data:

  • Account data: e-mail address, name, password (stored only as a hash), language, the time zone of your browser, and what you add to your profile (display name, profile picture, banner) and during onboarding (trading style, markets, experience, goals, account type and size, prop firm, risk limits, your trading rules, your self-assessed biggest weakness). If you sign in with Google, Google sends us your e-mail address, name and profile picture.
  • Trading data: trades and their details, trading accounts and balances, journal entries, rules and rule violations, prop firm challenges, playbooks, goals, checklists including your daily mental self-assessment, pre-trade checks, and screenshots you upload.
  • Broker connection data: the login details or tokens needed to import your trades (details under Broker connections).
  • AI and coaching data: Mentor conversations and notes, Tarvis conversations, Open Ear transcripts and analyses, chart images you send for analysis, and the patterns TMI learns from your trading.
  • Payment data: plan, subscription status, the Stripe customer number and the payment records Stripe sends us (amount, currency, billing name, e-mail and billing address, card brand, last four digits and expiry date). You enter the full card number directly at Stripe; it never reaches us.
  • Support data: bug reports, feedback and requests, including an optional e-mail address and screenshot, also from visitors without an account.
  • Technical and usage data: IP address, browser and device information and requested pages in server and error logs, counters used to limit requests, page statistics, AI usage per feature (model, tokens, cost), voice coach session metrics and an internal event log (for example when a broker account is reported as disabled).

Purposes

We use this data to:

  • provide the trading journal: store, import and evaluate your trades, accounts and journal, including statistics, reports and exports;
  • provide the AI features and your personal coaching (see AI features and profiling);
  • process payments and subscriptions, handle withdrawals and cancellations and keep the required records;
  • send you e-mails and push notifications (see E-mails and push notifications);
  • operate TMI securely: prevent abuse, limit requests, diagnose errors and monitor the connections to brokers;
  • run the referral programme: attribute sign-ups and payments to referrers and calculate commissions;
  • publish a trade when you create a share link.

We do not sell your personal data.

Legal bases for processing

We process personal data on the following legal bases under Art. 6 GDPR:

  • Performance of a contract and steps prior to entering into it (Art. 6 (1) (b) GDPR): your account, the journal and its evaluations, broker connections, AI features, payments, service e-mails, the e-mails and push notifications you have switched on, trade sharing, and keeping a registration until the e-mail address is confirmed.
  • Consent (Art. 6 (1) (a) GDPR): Google Analytics and Vercel Speed Insights, which you control through the cookie banner. You can withdraw your consent at any time with effect for the future.
  • Legitimate interests (Art. 6 (1) (f) GDPR): security, abuse prevention, error diagnosis and operational alerts; page statistics without cookies and the internal event log, to understand and improve TMI; the referral programme; keeping proof of withdrawals and cancellations to establish and defend legal claims; and direct marketing by e-mail for TMI. You can object to this processing (see Your rights).
  • Legal obligation (Art. 6 (1) (c) GDPR): keeping payment and accounting records, and sending the acknowledgement of receipt for withdrawals and cancellations you submit through the online withdrawal function or the "Cancel contracts here" button.

To open an account you need an e-mail address and a password (or sign-in with Google); without them we cannot conclude the contract. Everything else is voluntary; without it, individual features are not available.

AI features and profiling

For the AI features we send the content they need to Anthropic in the USA. Some run when you use them: the Mentor, chart analysis, Trading DNA, the next-step suggestion on the dashboard, the weekly debrief, Tarvis and the Open Ear analysis. Others run automatically: new trades get a short AI comment, and trades you enter yourself also get a Mentor analysis. The rule check runs only on paid plans and during a trial: trades you enter or import get one right away, and trades that arrive through a connection (a broker or TradingView) get one within a few hours. The weekly game plan and the texts of the Daily Briefing and the Weekly Recap are written by AI. The content sent includes, for example, your trades and trade notes, journal entries, rules, profile answers, learned patterns, earlier Mentor notes, the conversation itself and images you upload. The Mentor and Tarvis receive your name or first name to address you; your e-mail address is not sent. Anthropic processes this data as our processor under a data processing agreement and, under its commercial terms, does not use it to train models. We do not train AI models with your data either.

During Mentor conversations, TMI saves short notes: sentences in which you state a decision or a goal, warnings and advice from the Mentor, and, every fifth message, up to five key points extracted by the AI. Notes from the last two weeks are taken into account in later conversations. They stay stored until you delete the trading account they belong to or your account.

Voice: Tarvis reads replies aloud through a speech synthesis service (OpenAI or ElevenLabs, depending on configuration), which receives only the text of the reply; that text can contain your first name and mention your trades. For voice input, TMI uses your browser's speech recognition; in Chrome, for example, Google turns the audio into text. We only store the recognised text.

Profiling: to personalise your coaching, TMI evaluates your trades statistically from Monday to Friday, without AI: strengths and weaknesses, behaviour patterns such as revenge trading, overtrading, early exits and loss aversion, and your best and worst times, setups and symbols. If you open Trading DNA, TMI calculates scores for consistency, emotional control, setup quality and risk management from your trades, and the AI writes a short summary of them. If you request an Open Ear analysis, the AI evaluates your transcript for emotions, mood, behaviour patterns (for example FOMO or tilt) and a risk level. These results are shown only to you and used only for your coaching.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The pre-trade check is only a pointer to your own rules and numbers; TMI never places or blocks orders.

Broker connections

When you connect a trading account, we import orders, fills, positions and balances. TMI only reads; it never places trades or moves funds. Depending on the connection, we store:

  • MT4/MT5 via MetaApi: you enter login, password and server. We pass them to MetaApi, which stores them to operate the cloud connection. TMI keeps the login number, server, platform and the MetaApi account ID, but not the password. When you disconnect or delete your account, we delete the connection at MetaApi.
  • MT4/MT5 Expert Advisor, Python client and TradingView: we show you a key once and store only a hash of it plus its last four characters.
  • Tradovate and NinjaTrader: when you connect via OAuth, we store your username and an encrypted access token, never your password. If you use the API key option instead, we also store your API password, cid and secret in encrypted form, so that TMI can sign in again automatically when the token expires.
  • TradeLocker: we store your login e-mail and server, and in encrypted form your password and tokens, so that TMI can sign in again when the session ends.

Encrypted means AES-256-GCM with a key that is kept separately from the database. When you disconnect an account, the stored login details are deleted.

E-mails and push notifications

  • Always: confirmation of your e-mail address and password reset.
  • E-mails you control in Settings: the Daily Briefing and the Weekly USD News are off unless you switch them on (users of the earlier daily e-mails were moved to the Daily Briefing in July 2026); the Weekly Recap for paid plans and trials is on by default and can be switched off. The briefing and the recap contain your own statistics, partly written by AI.
  • Other e-mails: a welcome e-mail, tips during your first two weeks, reminders before a trial ends, and alerts about rule violations and about disabled or lost broker accounts. Where these e-mails promote TMI, we rely on our legitimate interest in direct marketing. The unsubscribe link in any of these e-mails stops all of them with one click.
  • If you refer someone, we let you know when they sign up; the e-mail shows their address only in masked form.

We do not measure whether you open an e-mail or click a link. If an e-mail bounces permanently or is reported as spam, we only send the address confirmation and password reset to that address from then on. All e-mails are sent through Resend.

Push notifications: if you switch them on in Settings and allow them in your browser, we store the push subscription (address and keys) and send reminders, for example about your weekly debrief, your journal or your trading streak. Delivery goes through your browser vendor's push service (for example Google, Mozilla, Apple or Microsoft); the content is encrypted end to end. You can switch push off at any time in Settings or in your browser.

Public trade links

If you create a share link for a trade, anyone with the link can see the symbol, direction, entry and exit price and time, profit or loss, status, setup, tags, stop loss, take profit, R-multiple and your display name. Your real name, account, position size, notes and screenshots are not shown. If the link is published, search engines can find the page. The link contains your referral code. You can revoke it at any time on the trade page; deleting the trade or your account also ends it.

Referral programme

When someone opens a referral link, we record the referral code, a hash of the IP address made with a secret key, the browser's user-agent string, the country and the referring page, and store the code in the tmi_ref cookie for 60 days. If the visitor signs up, we assign the account to the referrer. For payments by referred users we calculate commissions (amount, currency, rate) and handle payouts. In the dashboard, referrers see referred users only with a masked e-mail address, together with sign-up date, plan, status and the commissions earned, and clicks only in aggregate by day, country and referring site.

Storage and security

Your account data and content are stored in a Supabase database in Ireland (EU). The application's server functions run on Vercel servers in Dublin (Ireland, EU); requests are routed and pages are delivered through Vercel's worldwide network. All connections are encrypted with TLS, passwords are stored only as bcrypt hashes, and broker passwords, API secrets and tokens are additionally encrypted. Access to the admin area is restricted to authorised staff, and administrative changes are logged.

Files: trade screenshots, profile pictures and banners, and screenshots attached to feedback are stored in Supabase Storage and delivered through a link that is hard to guess but works without signing in. Anyone who has the link can open the file. Removing a screenshot or replacing your profile picture deletes the old file. Screenshots that no trade uses any more, because you deleted the trade or its trading account or uploaded a new image, are deleted automatically within two days. Deleting your account deletes all your files.

Retention period

We store your data for as long as your account exists. If you only cancel your subscription, your account and all its data remain on the free plan. When you delete your account in Settings, it is erased immediately; copies in our hosting provider's backups are overwritten in its regular backup cycle. The following exceptions and fixed periods apply:

  • Registrations whose e-mail address is never confirmed are deleted after 30 days.
  • Technical records are deleted automatically: counters used to limit requests within a few hours, sync history and voice coach metrics after 90 days, the e-mail send log after 60 days (entries that stop a one-time notice from being sent twice are kept until your account is deleted), the internal event log after 180 days and the operational log after 12 months. When you delete your account, your user ID and e-mail address are removed from the user fields of the operational log; any other mention there is deleted with the log after 12 months at the latest.
  • Payment records (the Stripe customer record, invoices, payment events and commission records) are kept for as long as statutory retention obligations, for example under tax law, require.
  • Withdrawals and cancellations you submit through the online withdrawal function or the "Cancel contracts here" button (name, contract reference, e-mail address, time of receipt and, for cancellations, type, reason and requested end) are kept as proof until the end of the third calendar year after their receipt, even if you delete your account earlier.
  • Referral clicks that do not lead to a sign-up are deleted after 24 months. The other referral records are kept for settling commissions; after your account is deleted, they are no longer linked to you.
  • Feedback and bug reports are kept for product development; when you delete your account, your user ID and e-mail address are removed from them and attached screenshots are deleted. Copies that were sent to our support inbox by e-mail stay there.
  • Our service providers keep server, error and delivery logs for a limited time under their own retention periods.

Service providers and other recipients

We use the following service providers, which process data on our behalf, and pass data to the following other recipients:

  • Stripe - payments, subscriptions, customer portal and invoices; receives your e-mail address, the chosen plan and your payment details. If automatic tax calculation is switched on, Stripe also collects your billing address and, optionally, your VAT ID
  • Vercel - hosting and server functions (server functions in Dublin, Ireland, EU; requests are routed and pages are delivered through Vercel's worldwide network); processes every request, including IP address and browser information
  • Vercel Analytics - page statistics without cookies (pages visited, referring page, country, device and browser type), also for pages in the signed-in area; runs without consent on the basis of our legitimate interest
  • Vercel Speed Insights - performance measurement; loaded only after you accept analytics cookies
  • Google Analytics - website analytics; loaded only after you accept analytics cookies in the cookie banner
  • Google Sign-In - sign-in with Google, if you choose it: Google confirms your identity and sends us your e-mail address, name and profile picture
  • Supabase - database and file storage (Ireland, EU)
  • Upstash - request limiting; stores short-lived counters linked to your e-mail address, IP address or user ID
  • Anthropic Claude - AI features (see AI features and profiling); processes the content as our processor under a data processing agreement
  • ElevenLabs / OpenAI - speech synthesis for the Tarvis voice coach; receives only the text of the reply, which can contain your first name and mention your trades
  • Web Speech API - browser speech recognition for the Tarvis voice coach and Open Ear; the microphone audio can be sent to your browser vendor for transcription (Google in Chrome, for example), and only the resulting transcript is stored in your account
  • MetaApi - MT4/MT5 connection; receives the login, password and server of your MT account and operates the connection from servers in London, New York and Singapore
  • Tradovate - futures account connection (read-only)
  • TradeLocker - TradeLocker account connection (read-only)
  • NinjaTrader - NinjaTrader account connection through the Tradovate interface (read-only)
  • Resend - sending all e-mails (sending region Ireland, EU)
  • Namecheap Private Email - e-mail inboxes of support@tmi-ai.com and business@tmi-ai.com, where support requests, bug reports and privacy requests arrive
  • Sentry - error diagnosis and performance samples (10 % of requests), without session recording; data is stored in Germany (EU)
  • Telegram - internal operations alerts to the TMI team; they contain only internal account IDs, the broker server, plan and sync status, no names or e-mail addresses
  • Web Push - delivery of the push notifications you switch on (depending on your browser, for example Google, Mozilla, Apple or Microsoft); the content is encrypted end to end

Transfers to third countries

Quantpeak Holdings LLC is based in the USA, so your data is also processed there. Our database is in the EU, but several service providers process data in the USA: Vercel (hosting), Stripe, Anthropic, Google and OpenAI or ElevenLabs. Supabase, Resend and Sentry store data in the EU but are US companies, as are Upstash and Namecheap. These transfers rest on the EU standard contractual clauses or, where the provider is certified, on the EU-US Data Privacy Framework; you can request a copy of these safeguards at the contact address below. The push services of your browser vendor and Telegram (for internal alerts that contain only internal account IDs) can also process data outside the EU.

When you connect a broker account, your data is transferred to that provider (MetaApi with servers in London, New York and Singapore, Tradovate and NinjaTrader in the USA, TradeLocker) because you asked for this connection (Art. 49 (1) (b) GDPR).

Your rights

Under GDPR, you have the following rights regarding your personal data:

  • Right of access - request a copy of your personal data
  • Right to rectification - correct inaccurate data
  • Right to erasure - request deletion of your data, or delete your account yourself in Settings
  • Right to restriction of processing - have processing restricted, for example while the accuracy of data is being checked
  • Right to object - object to processing based on legitimate interests (see below)
  • Right to data portability - receive your data in a machine-readable format: your trades as a CSV file per trading account directly in the app, everything else on request
  • Right to withdraw consent - withdraw a consent at any time with effect for the future, for cookies via 'Cookie Settings' in the footer
  • Right to lodge a complaint - with a supervisory authority, in particular in the EU member state where you live or work

Right to object (Art. 21 GDPR)

Where we process your data on the basis of legitimate interests, you can object to this processing at any time on grounds relating to your particular situation. You can object to direct marketing at any time without giving reasons; we will then no longer use your data for this purpose. Use the unsubscribe link in any e-mail that has one, or write to business@tmi-ai.com.

To exercise your rights, contact us at business@tmi-ai.com.

Cookies and browser storage

We use the following cookies:

  • Essential cookies - keep you signed in (session cookie, up to 90 days) and protect sign-in and broker connections against forged requests (security cookies, from 10 minutes to the end of the browser session). Always active.
  • Functional cookies - remember the trading account you last selected (selectedAccountId, 1 year) and your language (NEXT_LOCALE, until the end of the browser session).
  • Referral cookie - tmi_ref stores the referral code for 60 days after you open a referral link or a shared trade, so that a later sign-up is credited to the referrer.
  • Analytics (with consent) - Google Analytics (cookies _ga) and Vercel Speed Insights are only loaded after your explicit consent in the cookie banner.

TMI also keeps settings and data in your browser's local storage: your cookie choice, theme, dashboard layout, time zone, voice coach mode, today's mood, dismissed notices, cached calendar data and the last 50 Mentor messages on this device until you reset the chat. The time zone and mood are also saved to your account. The Mentor history stays after you sign out, so reset it on shared devices. A service worker stores static files and public pages for faster loading.

You can change or withdraw your cookie preferences at any time via the 'Cookie Settings' link in the footer, which reopens the cookie banner. Choosing 'Only Essential' removes any analytics cookies that were already set.

Contact

For privacy-related questions, contact us at business@tmi-ai.com.