Back to NIKO Journal
Privacy & data

Privacy Policy

Last updated: August 11, 2026

NIKO Journal is a trading journal designed to help you record, review, and understand your trading process. This policy describes the information the service handles and the choices available to you.

1. Information we collect

Account information

When you create or use an account, we handle the email address used for authentication and account-management information such as your profile, preferences, timezone, language, and subscription-related records where applicable.

Journal and trading information

We store the information you choose to enter or import, including trades, entry and exit details, risk, results, notes, emotions, tags, strategies, routines, reviews, and related account or performance settings.

Files and media

If you upload screenshots or other journal media, the service handles those files and their related metadata so they can be displayed, synchronized, exported, and deleted with your account.

Device and product-use information

The app may handle browser and device information needed for sessions, synchronization, reliability, security, and product analytics. Analytics events can include an event name, page, session identifier, timestamp, and an account identifier when a valid session is present.

Messages to support

If you contact us as a guest, we handle the name, email address, subject, and message you submit so the support team can respond. Signed-in users can also use the in-app support system.

2. How we use information

  • To provide, authenticate, maintain, and secure your NIKO Journal account.
  • To save and synchronize your journal, trading accounts, preferences, and uploaded files across supported sessions and devices.
  • To calculate the charts, reports, summaries, progress views, and other features you request.
  • To provide AI Coach and related review features using the journal context needed for the requested response.
  • To respond to support requests, operate communications you request, and investigate errors or abuse.
  • To understand product usage, improve reliability, and plan improvements through first-party event analytics.

We do not use your journal to sell advertising data. We do not run third-party advertising trackers in the app.

3. Storage and service providers

Application database

Account, profile, journal, trading, synchronization, subscription, and related application records are stored in the service database, which currently uses Supabase infrastructure.

Uploaded files

Uploaded journal files may be stored in the service's configured object storage, including Cloudflare R2-backed storage. The application uses the related database records to find and manage those files.

AI processing

When you use an AI feature, the message and journal context needed to produce the response may be sent through one of the AI providers configured by the service, such as Groq, OpenRouter, Together, or Hugging Face. Do not submit information to AI features that you do not want processed for that request.

4. Security

The service uses application and infrastructure safeguards intended to protect accounts and requests. No online service can promise absolute security.

  • Session protection. User and admin session cookies are HttpOnly, scoped to the API path, and configured with SameSite protection; session cookies are Secure in production.
  • Request protection. State-changing cookie requests use a CSRF token mechanism in addition to SameSite cookie protection.
  • Access controls. Authenticated routes require a valid session, and account deletion immediately invalidates the account's tokens.
  • Operational safeguards. Analytics and error-reporting paths are designed to fail without blocking the application, and public contact intake is rate-limited.

5. Cookies and browser storage

Essential cookies

The service uses session cookies to keep you signed in and a readable CSRF cookie to protect account requests. A remember-me choice can make a user session persistent for up to 30 days; otherwise the session cookie can end when the browser closes.

Local and session storage

The browser may store preferences, language and display settings, drafts, synchronization state, cookie-consent choice, leaderboard opt-in choice, and a temporary analytics session identifier. These are used to keep app features working and remember choices.

6. First-party analytics

{company} operates its analytics collection through its own API rather than a third-party analytics SDK. It records an allowlisted set of product events, such as page views, feature use, reliability signals, cookie-consent actions, and views of this policy. Analytics events are scheduled for deletion after 90 days by the server's retention process.

7. Sharing and public features

Service operations

Information is shared with infrastructure and processing providers only as needed to run the features described in this policy, including database, file-storage, support-notification, and AI processing functions.

Optional sharing

Leaderboard participation is an opt-in feature. Sharing a stats card is also an action you choose and uses the share or clipboard tools available on your device. We do not sell personal information or use it for third-party advertising.

8. Your choices and account controls

  • Review. Use the account, journal, settings, and export features to review information associated with your account.
  • Correct. Update profile, preference, journal, and trading information through the app where those controls are available.
  • Delete. Use the account deletion control to request deletion of your account and user-owned data.
  • Cookie choice. Choose Accept All or Essential Only in the cookie prompt. The choice is stored in your browser.
  • Analytics choice. You can block or clear browser storage and requests through your browser or device controls, though some app features may not work as intended.

For a privacy question or request that the app does not cover, contact Support.

9. Account deletion and retention

When an authenticated user deletes an account, the account is marked for deletion and its tokens are invalidated immediately. The service then asynchronously purges the user row and associated journal entries, sync data, accounts, trades, profiles, subscriptions, uploaded-file records, and related referral, payment, leaderboard, and stored-file data. Analytics events are handled separately under the 90-day analytics retention process.

10. Contacting us

Questions about this policy or a privacy request can be sent to Support.

11. Changes to this policy

NIKO Journal may update this page when the service or its data practices change. The date at the top shows when this version was last updated.

12. Scope of this policy

This policy describes the practices confirmed in the NIKO Journal web application and API. It does not change the separate Terms of Service, Cookie Policy, Refund Policy, or any instructions shown for a specific feature.

13. Privacy contact

For privacy questions, account-deletion follow-up, or help understanding this policy, contact Support