This policy explains how DT Terminal (formerly DT Journal; “DT Terminal,” “we,” “us,” or “our”), operated by DT TERMINAL, a sole proprietorship registered in Singapore, handles personal data across our websites, web app, desktop app, mobile apps, APIs, community, verification and broker-sync features, affiliate program, and DT Scholarships (the “Service”). DT Terminal is responsible for the processing described here unless a third party tells you it acts separately under its own policy.
1) Information we collect
Account and contact data: email address, user ID, profile name, handle, avatar, country, timezone, preferences, age or eligibility confirmations, and authentication-provider identifiers. Password authentication is handled by our authentication provider; we do not display your password to our staff.
Trading and journal data: accounts, trades, orders, balances, journals, reflections, strategies, rules, analyses, chart annotations, backtests, paper trades, performance calculations, attachments, and the context you provide to Edge.
Broker-sync data: broker, exchange or platform name, account identifiers, server details, connection status, synchronization logs, imported trading history, and, where the broker reports it, the account holder name and plan, which we read to identify the prop firm or plan behind an account. Depending on the connection type, API keys and secrets, OAuth access and refresh tokens, or platform credentials are encrypted server-side and retained until you disconnect or delete the account. For MetaTrader sync, your investor password is sent to MetaApi, which operates the connection; DT Terminal does not persist that password in its own database.
Verification and public record data: payout claims, the certificates and images you upload, challenge phases and firm names, the outcome of our verification checks, consistency and identity scores and their history, rankings and streaks, and the sharing settings on your DT Passport and on each account. Section 4 explains what is public.
AI inputs and outputs: prompts, screenshots, files, relevant journal or trade context, generated responses, and safety or quality metadata when you use an AI feature. Some uploads are read automatically: a certificate image is sent to our AI provider when you upload it, to suggest the form fields, and a screenshot pasted into Edge is read to pre-fill a trade.
Import files we cannot read yet: when you import a trade file (a CSV, Excel, TXT or HTML export from your broker) and we do not recognise its layout, we keep a copy of that file in a private store that only the DT Terminal team can open; it is not visible in the app or to other users. We use it for one purpose: to see how the file is laid out so we can add support for that broker's format. We do not use the trades, balances or account details in it for anything else, we do not add them to your journal or any other account, and we do not sell, share or publish them. Files we already support are not kept. If Edge reads the file for you, it is sent to our AI provider like any other AI request, under terms that do not permit training on your data.
Questions you ask Edge on our website: when you ask Edge a question on our public website without signing in (the home page, the product tour, our guides and other public pages), we keep the question, Edge's answer, the page you asked it on, and a random identifier for that visit, so we can see what visitors want to know and improve Edge's answers and our website. We remove email addresses, phone numbers and long account or card numbers before the question is stored, and we do not store your IP address with it. Please do not include personal details in a question.
Community content: posts, comments, reactions, follows, messages, reports, shared trades or analyses, and the visibility choices attached to them. Content you mark public can be viewed by people outside your account.
Commercial and program data: plan, billing status, transaction and invoice identifiers, affiliate application and attribution data, payout-onboarding status, scholarship applications, eligibility snapshots, testimonials, and donation records. We do not receive full payment-card or payout-bank credentials.
Technical and security data: IP address, device and browser information, app version, timestamps, request and audit logs, crash details, abuse signals, and approximate location inferred from network data.
Mobile app data: a push notification token for each device you sign in on, its platform, app version and device identifier, your notification preferences and muted rooms, and crash or error reports from the app. The app asks for camera, photo library and notification permissions only when a feature needs them, and you can change them in your device settings.
Usage measurement data: which screens, features and buttons you use, page paths and session identifiers, on the website, the desktop app and the mobile app, recorded on our own systems so we can see how the Service is used and what needs fixing. We rely on our legitimate interest in maintaining and improving a service you use. It is not shared with or sold to anyone, and you can switch it off at any time in your privacy choices.
Optional analytics and referral data: the same usage data shared with a third-party analytics provider, masked replay, campaign parameters, and affiliate referral codes, only after you allow the relevant optional category. Affiliate link attribution lasts up to 60 days.
2) How and why we use data
Provide, secure, personalize, synchronize, and support the Service, perform purchases, and deliver features you request.
Import broker history, maintain connection health, and show whether records were synced or verified.
Run verification checks and compute the consistency and identity scores shown on your DT Passport (see Section 4).
Process AI requests and return generated results using the context required for the feature you selected. While tips and product updates are on for your account and a personalised email campaign is enabled, relevant usage summaries may also be processed by Anthropic to draft that message; you can turn these emails off at any time.
Operate community, affiliate, and scholarship programs; prevent fraud, enforce rules, attribute valid referrals, and process approved payouts or sponsorships.
Send essential account, security, billing, and service communications. Product reminders such as streak, report and alert notifications are sent only while they are turned on in your notification settings. When you create an account we tell you that we will also email you tips to get started and news about DT Terminal and its plans; you can turn these off at any time in Settings or from the link in any of those emails. We send offers from other companies only where you separately opted in.
Measure and improve the Service using first-party usage measurement, and diagnose crashes and security incidents using necessary, minimized error reports kept on our own systems.
Meet legal, accounting, tax, dispute-resolution, and regulatory obligations.
Depending on the law that applies, we rely on performing our contract with you, your consent, compliance with legal obligations, and legitimate interests such as security, fraud prevention, support, and improving a service you use. Where consent is the basis, you may withdraw it prospectively.
3) Who receives data
We do not sell personal data. We disclose only what is reasonably needed to:
Infrastructure and operations: Supabase for database, storage, and authentication; Cloudflare for edge routing, hosting the web app, and serving desktop installers; Railway for hosting the API; Resend for email delivery; and Expo for delivering mobile push notifications. Usage measurement and error reports are stored in our own database and are not sent to an analytics or monitoring provider.
Requested integrations: Anthropic to process AI requests, under API terms that do not permit training on your data; MetaApi to operate MetaTrader connections; Stripe to process subscriptions, donations, affiliate onboarding, and payouts; and Google or Apple when you choose their sign-in service.
Connected AI assistants: when you connect an AI through DT Terminal Connect, data covered by the permissions you tick on the consent screen is sent to that application and to the AI provider operating it, and is handled under their terms and their privacy policy, not ours. These applications are registered by third parties and are not verified by us, so check the address shown on the consent screen before approving one. A connection starts read-only; if you tick a write permission, the assistant can also create, change, and delete records in your account, and those changes are treated as yours. A connection can only ever reach your own profile, journal, backtests, and connected-account records; it cannot reach community content or chat messages, so no other member's writing is disclosed through it. You can review and disconnect any connection at any time in Settings, Connected AI, which stops all further access immediately but cannot recall what was already sent.
Other users and the public: profile, community and DT Passport content according to the visibility controls you choose, as described in Section 4. A frozen copy of content you deliberately share can remain attached to the post until that post is removed.
Legal and safety recipients: courts, regulators, law enforcement, advisers, or affected parties where required or reasonably necessary to protect rights, safety, and the Service.
Business transfers: a buyer, successor, or restructuring participant, subject to appropriate confidentiality and notice where required.
These providers may process data under their own terms when acting independently. Links to third-party brokers, prop firms, and other sites are governed by those parties’ privacy practices.
4) Public records and automated scores
DT Terminal can publish a verified record of your trading when you choose to, so some of your data is designed to be public. This section says what, when, and how to turn it off.
Public by default at claim. When you claim a handle, the sharing switch on the claim screen is set to public unless you turn it off, and each connected account can be shown or hidden separately. Both can be changed at any time in your DT Passport settings. We do not change the sharing setting of an existing record without telling you first.
What a public DT Passport shows: your handle, display name, bio, avatar and join date; verified profit and loss and returns; trade counts; payouts and phases; certificates you upload, including their images; consistency and identity scores and their monthly history; rankings and streaks; and program status such as DT Scholarships. Backtests and paper trades are never public. Your email, broker credentials, account numbers and private journal entries are never public.
Where it appears. Public records are shown in trader search and rankings, are indexed by search engines, and can appear on share cards and link previews on other platforms. Copies and preview images already fetched by other platforms may persist after you switch to private, and we cannot recall them.
Testimonials. When you send a testimonial from the Write a testimonial page, you agree that we may show it on our website, in the app and in our marketing, together with the name you chose on that page and the kind of trader you picked. We read each one before it is shown, and we may shorten it or correct spelling without changing what it says. You can remove a testimonial at any time from Your testimonials on that page, and we will take it off our website; copies already shared on other platforms may persist.
Automated scores. The consistency and identity scores on a DT Passport are computed on our servers from the trades, returns and payouts on your connected accounts, using the method described in the product, and are recomputed on a schedule. They describe a record; they are not used to make any decision that has a legal or similarly significant effect on you, and you can hide them by setting the record to private.
5) Cookies, local storage, and privacy choices
Essential: authentication, security, theme, app settings, offline data, explicit invite or manually entered referral state, and your privacy-choice record. These are used to provide the Service or remember a choice you made.
Usage measurement (on by default): first-party analytics events written to our own database. On unless you switch it off below. Never shared with a third party.
Error reports (essential): when something in the app breaks, a minimized report of the error and the page it happened on is written to our own database so we can fix it. Never shared with a third party.
Referral attribution (optional): an affiliate cookie and local-storage record retained for up to 60 days, and campaign parameters from the link you arrived by retained for up to 30 days.
Optional storage stays off until you choose. You are asked on thedtterminal.com, and inside the app you can change your choice at any time in Settings, under Usage data. Permission is never granted by opening a link: when you move between thedtterminal.com and dtterminal.app, a refusal or withdrawal comes with you, but anything you allowed has to be allowed again on the other site. If you are signed in, your choice is also saved to your account and applied on a site or device where you have not chosen yet. Usage measurement is the exception: it runs from your first visit, on our own systems only, until you switch it off.
Rejecting optional storage does not block the Service, and neither does switching off usage measurement. Withdrawing consent stops new optional collection and clears optional referral and campaign records on that site, including other open tabs on the same site. A withdrawal carried when you navigate to the other site can restrict its existing choice, but cannot enable anything. Provider-side records already collected are retained under the schedule below.
6) Retention and account deletion
Account, journal, trade, community, and program data is generally kept while your account or relevant content remains active.
Encrypted exchange credentials, OAuth tokens and platform credentials are retained until the connection is disconnected or the account is deleted. MetaApi retains connection credentials under its service until the MetaApi account is removed.
Mobile push tokens are kept until you log out on that device, turn notifications off, or the token is reported invalid by the platform.
Failed MetaTrader credential fingerprints exist in memory for the current page session only and are not written to durable browser storage.
Security, billing, payout, tax, fraud, and dispute records may be kept for the period required by law or reasonably needed to establish or defend claims.
Questions asked to Edge on our public website, and Edge's answers, are deleted 90 days after they are asked.
Import files we could not read yet are deleted automatically 90 days after you upload them, or sooner if you delete your account.
Optional referral records on your device expire after 60 days. Analytics and service-provider logs follow configured provider retention periods and are deleted or aggregated when no longer needed.
Account deletion first attempts to revoke or destroy broker access, remove stored files, delete user-owned database records, and then delete the authentication account. If a required step fails, we keep the account so the deletion can be retried rather than falsely reporting completion. We retain a limited deletion audit containing internal and payment-provider identifiers, timestamps, step status, and deletion counts where needed for compliance, fraud prevention, billing disputes, and proof of completion. It does not retain your journals, trades, reflections, passwords, or broker secrets.
7) Your rights and controls
Subject to local law, you may request access, correction, export, deletion, restriction, objection, portability, or withdrawal of consent. You may also:
change profile, visibility, notification, and privacy settings;
disconnect broker integrations and revoke credentials at the provider;
unsubscribe from marketing using the email link or account settings without stopping essential messages;
export available trade data and delete your account from Settings; and
complain to your local data-protection authority.
We may verify your identity before fulfilling a request and may decline or limit a request where law permits. Authorized agents should contact us and provide proof of authority.
8) Security and credential handling
We use access controls, row-level database policies, encrypted transport, server-side authenticated encryption for supported stored broker API secrets, secret-column restrictions, audit logging, and service-provider controls. Use read-only broker or exchange credentials with trading and withdrawal permissions disabled, use a unique DT Terminal password, and disconnect access you no longer need. The Service never places orders or moves funds; a credential that can trade or withdraw is one you connected against our instruction, and the Terms of Service explain how responsibility for its misuse is allocated. No security measure can guarantee absolute protection.
9) International processing
DT Terminal and its providers operate across countries, so data may be processed outside your location. Where required, we use contractual or other recognized safeguards and assess provider protections. Local law and government-access rules can differ from those in your country.
10) Children
The Service is not directed to anyone under 18, and we do not knowingly collect personal data from children under 18. Contact us if you believe a child has provided data.
11) Policy changes
We may update this policy as the Service or law changes. We will post the revised date and provide prominent notice of material changes. Where law requires fresh consent, we will ask before applying the change to consent-based processing.
12) Contact and privacy requests
Our data protection officer can be reached at hi@thedtterminal.com. Include “Privacy Request” in the subject. Formal notices and requests for the registered business number or service address may be sent to the same address.