Skip to privacy policy
User
Account Settings
Help Center Developer Portal Status
Logout

Support & Legal

Privacy Policy

How TRINITY Trade, Inc. collects, uses, and protects personal information.

Effective date: October 1, 2026 · Version 2.0

Introduction

This Privacy Policy describes how TRINITY Trade, Inc. (“TRINITY,” “we,” “us,” or “our”), a Delaware corporation, collects, uses, discloses, and safeguards personal information in connection with our consumer products and related sites.

TRINITY is a software and education product for retail investing discipline. The market we support today is the United States. Anyone may use the product as a learning and paper-trading tool: we do not geo-block other countries, and the product does not connect to real trades, banks, or brokers. Portfolios in the product are paper / simulated. We use real market data so you can test the process. We are not a bank, broker-dealer, registered investment adviser, commodity pool operator, or custodian. We do not hold customer cash or securities. This Policy is about information, not brokerage custody.

By using the Services, you acknowledge this Policy. If you do not agree, do not use the Services. Our Terms of Service govern use of the product. If this Policy and the Terms conflict on a privacy topic, this Policy controls for that topic.

Who We Are

Controller: TRINITY Trade, Inc.
Privacy contact: info@trinitytrade.io.

Privacy requests go to that email. We will provide a postal address for a specific legal process if the law requires it and you ask.

Scope

This Policy applies to personal information we process when you use:

  • the TRINITY web application at app.trinitytrade.io (and related product hostnames);
  • the native iOS app that talks to that same product;
  • the public marketing site at www.trinitytrade.io;
  • the TRINITY Learning Center at learn.trinitytrade.io;
  • APIs, emails, and support channels that serve those surfaces

(collectively, the “Services”). It does not apply to third-party sites we do not control, to employee/internal tools, or to information processed solely for someone else as a processor under a written contract (we do not currently offer that as a consumer product).

What we collect, in short

We collect the categories below to provide accounts, paper portfolios, market research displays, optional alerts, security, and product improvement. We do not sell personal information and we do not share it with third parties for advertising. Sensitive login data is used to authenticate you, not to sell or advertise.

Categories: identifiers (email, user ID); account login data; commercial / product-usage information (paper portfolios, settings, plan entitlements); internet / device activity (logs, analytics, limited session replay); approximate location derived from IP for security; inferences we generate from usage to operate the product (not a consumer credit profile). We do not collect Social Security numbers, government IDs, bank or brokerage account numbers, or precise geolocation, and we do not want those in free-text fields.

Information We Collect

1. You provide

  • Account. Email address, authentication provider (email/password, Google, or Apple), display name if you set one, and the Firebase user identifier we use to keep you signed in.
  • Paper portfolios and settings. Portfolio names, risk choices, cash and position entries you type or generate, notification preferences, sharing settings, and similar product content. This is simulated bookkeeping, not a live brokerage account.
  • Communications. Support messages, feedback, and optional newsletter signup. Newsletter addresses are stored with encryption at rest on our side.
  • Invites. If you share a paper portfolio, the invitee email you enter so we can create the share. Owners see a masked version of that email in the product.

2. We collect automatically

  • Session. A secure, HTTP-only cookie (or equivalent token on iOS) so we know you are signed in.
  • Security logs. Time, IP address, user agent, request path, and similar operational records to run, debug, and protect the Services.
  • Abuse-prevention signals. When enabled, Cloudflare Turnstile and/or Google reCAPTCHA / Firebase App Check collect device and interaction signals to distinguish humans from bots (including on anonymous or demo flows).
  • Analytics. First-party page analytics and, on sampled sessions, masked session replay, as described below.

3. From providers

  • Authentication providers (Google, Apple, Firebase) confirm the login and give us a stable user ID and, depending on the provider and your settings, email and basic profile fields.
  • Market data vendors supply prices and reference data. That data is about securities, not about you, except insofar as it is displayed next to your paper book.

What we do not want

Do not paste bank passwords, brokerage credentials, government ID numbers, or health information into the product. If you do, we may delete it when we find it, but you are responsible for not putting it there.

How We Use Information

  • Create and authenticate accounts; keep sessions; enforce entitlements and feature gates.
  • Operate paper portfolios, research screens, learning content, and optional automated paper trading against real market prices.
  • Send transactional mail you need for the product (for example welcome, portfolio created, paper-trade confirmation, security notices) and, if you opt in, newsletter mail. You can unsubscribe from marketing mail.
  • Deliver in-product or push alerts you enable.
  • Secure the Services: fraud, abuse, rate limits, incident response, debugging.
  • Measure and improve the product using analytics, aggregated or de-identified statistics, and sampled session replay with masking.
  • Comply with law, enforce our Terms, and protect TRINITY, users, and the public.

We may create aggregated or de-identified information that is no longer reasonably linkable to you and use it to improve models, coverage, and the product. We do not attempt to re-identify that information except as needed to test our de-identification or as required by law.

Cookies, App Check, and Similar Technologies

  • Strictly necessary. Authentication / session cookies. The product cannot stay signed in without them. These are not advertising cookies.
  • Analytics. First-party Umami scripts on our infrastructure (page metrics; sampled session replay as below).
  • Security widgets. Turnstile and/or reCAPTCHA / App Check may set their own cookies or storage on their domains. Google’s and Cloudflare’s privacy policies apply to what those vendors collect.

We do not use third-party advertising cookies or a cross-site advertising pixel on the product. This section is the cookie disclosure. There is no separate cookie-preferences page.

Analytics and Session Replay

We run Umami ourselves (first-party collector on our infrastructure), not a consumer ad network. It records page views, events we emit (with identifiers such as portfolio IDs and emails redacted in our helper), and — on a sample of sessions — a time-limited session replay with strict masking of password fields and similar inputs.

Replay exists so we can see where the product breaks, not to build an advertising profile. Sample rate and duration are configured to stay small. Do not type secrets into non-password fields.

We do not currently operate Google Analytics on these surfaces. If that changes, we will update this Policy before using it for the product.

Sharing, Processors, and No Sale

We do not sell personal information. We do not share it with third parties for advertising. We disclose it only as follows:

  • Service providers / processors who act on our instructions:
    • Google (Firebase Authentication; Google Cloud hosting, databases, object storage, and logs, primarily in us-central1; Google Workspace SMTP for transactional mail; reCAPTCHA / App Check when enabled);
    • Apple (Sign in with Apple; App Store distribution of the iOS app);
    • Cloudflare (DNS, edge security, Turnstile);
    • infrastructure we operate for first-party analytics (Umami).
  • People you involve. Portfolio invitees see what you shared. If you post a share link, anyone with the link may see that paper book under the share rules you set.
  • Legal and safety. If we believe disclosure is required by law, valid legal process, or to protect rights, safety, or the integrity of the Services.
  • Corporate events. In a merger, financing, or sale of assets, information may transfer under this Policy or a successor policy we notify.

Internal engineering systems that compute research, paper fills, and mail are part of TRINITY. They are not a sale to a third party.

Retention

  • Account and paper-portfolio content while the account is open and as needed afterward to complete deletion, resolve disputes, or meet legal duties.
  • Newsletter until you unsubscribe or we delete the list entry.
  • Security and application logs for a limited operational period, and longer if needed for an incident, abuse investigation, or legal hold.
  • Analytics according to our collector configuration; replay clips are short-lived by design.

Backups and disaster-recovery copies can lag live deletion. We do not keep customer accounts indefinitely after a verified deletion request except as the law requires.

In-product account deletion may not yet complete a full purge. Email info@trinitytrade.io to request deletion. We will verify that you control the account.

Security

We use TLS in transit, cloud-provider encryption at rest, HTTP-only session cookies with Secure and SameSite attributes in production, least-privilege access for operators, and encrypted storage for certain emails (including newsletter and share invites). No method of transmission or storage is 100% secure. You are responsible for your password and device.

Report a security issue to info@trinitytrade.io. Do not publicly post exploit details until we have had a reasonable chance to fix them.

Your Rights

We handle verified privacy requests the same way for every account holder, wherever you are using the product from: you may ask us to tell you what personal information we hold, correct it, delete it (subject to legal exceptions), or send you a copy. You may use an authorized agent with proof of authority. We will not discriminate against you for asking.

Email info@trinitytrade.io from the address on the account (or otherwise prove control). We will not fulfill a request we cannot authenticate. We aim to respond within 45 days, or longer if the request is complex and we tell you why.

Children

The Services are for individuals 18 or older. They are not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a minor under 18 created an account, contact us and we will delete it.

Where data lives

We host and process personal information in the United States (primary region us-central1). That is true whether you are in the United States or you reached the product from another country. We do not geo-block access. We do not run a local data center, local support office, or local privacy program outside the United States. Using the Services from abroad means your information is still stored and processed in the United States.

Automated Features

The product uses models and rules to classify market stages, score names, suggest paper allocations, and — if you opt in — place simulated orders in a paper book using real market data. Those outputs can be wrong, incomplete, or stale. They do not grant credit, refuse a government benefit, or execute a live brokerage trade. You can ignore suggestions and you can turn optional paper automation off.

Changes

We may update this Policy. We will post the new version with a new effective date. If a change is material, we will give additional notice (for example in-product or by email) where reasonably possible. Continued use after the effective date is acceptance of the updated Policy, except where the law requires a different consent.

Contact

Privacy and rights requests: info@trinitytrade.io.