Privacy Policy
Last updated October 18, 2026
The short version
- We collect what it takes to run your journal, and nothing for advertising. We do not sell your data. There are no ad trackers. The website counts visits with Cloudflare Web Analytics, PostHog and HeyCatch, none of which uses cookies or follows you to other sites, and nothing records your screen.
- Crux never places a trade. Where a broker offers read-only access, Crux uses it. Where a platform offers none, Crux stores the login you give it, encrypted, and uses it only to read your trades and balance.
- Each trader’s journal is kept in its own separate file.
- You can export your trades, disconnect a broker or delete your account whenever you like.
1. Who is responsible
Crux is operated by Shoemate Trades LLC (“Crux”, “we”). This policy covers cruxjournal.com, the web app at app.cruxjournal.com and the Crux desktop app. Contact: support@cruxjournal.com.
2. What we collect
- Account details: your email address, an optional display name, and your password — stored only as a secure hash, never in readable form. We also keep your active sign-in sessions.
- Signing in with Google: if you choose “Continue with Google”, Google tells us your name, your email address, that Google has verified that address, and an account number Google uses for you, so the next sign-in opens the same journal. We ask Google for nothing else: not your contacts, files, mail or anything in your Google account. You can remove Crux’s access at any time from your Google Account’s security settings.
- Your journal: trades imported from brokers you connect or files you upload, and everything you add — notes, tags, ratings, screenshots, playbooks, prop firm evaluations and settings.
- Broker access: the tokens or keys a broker issues when you connect it, and, for trading platforms that offer no read-only access (such as TradeLocker), the login you enter for that platform. They are encrypted at rest with a key held only by our server, used only to read your trades and balance, never shown back to you or anyone else, and deleted when you disconnect the broker.
- How you found us: when you sign up, the word on the link that brought you (such as a creator’s name) or the kind of site you came from (such as “google” or “reddit”), and the first page of ours you saw. The website keeps it in your own browser for up to 30 days until you sign up; it is not a tracker and is not shared with anyone.
- Billing: your plan, subscription status and Stripe customer reference. Card details go directly to Stripe; we never see or store your card number.
- Early-access list: if you joined it before Crux opened, your email address and, if you told us, the platform you trade on and the link that brought you to us. We use it only to tell you about Crux, and you can leave at any time from the link in any of those emails, or by writing to support@cruxjournal.com.
- Messages: anything you send us, such as support emails and reviews.
- Milestones in the web app: that an account signed up (and how it found us, as above), that its first trades arrived, and when its plan or subscription status changes. Each account is named only by a scrambled code, never by its email address or name, and no trades, figures or anything you type are included. We use these counts to see where Crux is confusing people. Nothing is sent from the desktop app.
- Technical logs: the server records requests, errors and IP addresses, which we use to keep the Service running and secure (for example, to limit repeated sign-in attempts). Our logs automatically strip passwords, keys and email addresses. When something breaks in the web app, a report of the error (what kind of error, where in our code, and the reference shown to you, with passwords, keys and email addresses removed) goes to Sentry so we can fix it.
The desktop app keeps your journal on your own computer. Nothing from it reaches us unless you choose to send us something, such as a log file for support.
3. How we use it
- To run your journal: import and sync your trades and calculate your statistics.
- To handle your subscription and billing.
- To keep accounts secure and the Service reliable.
- To send emails you need, such as password resets and receipts, and to answer you when you contact us.
We do not use your trading data for advertising, and we do not sell it or share it with anyone for their own marketing.
4. Who else handles it
We use a small number of providers to run Crux. Each only receives what it needs for its job:
| Provider | What for |
|---|---|
| Render | Hosts the web app and stores journals, on servers in the United States. |
| Stripe | Takes payments and manages subscriptions; where it acts as seller of record, handles sales tax. |
| Resend | Delivers emails such as password resets, and holds the early-access list from before Crux opened. |
| Cloudflare | Runs our domain and hosts the website. Its Web Analytics counts visits to the website (pages viewed, the site you came from, your browser, device type and country) without cookies and without building a profile of you. |
| PostHog | Counts visits to the website (pages viewed, the site you came from, your browser, device type and country) and clicks on the buttons that open the app, without cookies or any storage in your browser and without keeping your IP address; and receives the web-app milestones described in section 2, under a scrambled code instead of your account. It does not record your screen. |
| HeyCatch | Counts visits to the website and how people use it: pages viewed, the site or link you came from, your browser, device type and country, and the buttons and links you click, with their text (never what you type). Nothing is stored in your browser, so each page you open counts as a new, anonymous visitor. Like any website, it receives your IP address with each request. It does not record your screen, and it receives nothing from the web app. |
| Sentry | Receives reports of errors in the web app, as described in section 2, so we can fix them. Reports leave out what you sent, your account, your IP address, passwords, keys, email addresses and trading data. |
| Google sign-in | Only if you choose “Continue with Google”: confirms who you are and gives us your name and email address. |
| Google Fonts | Supplies the typefaces on our pages, which means Google receives your IP address when a page loads. |
| Brokers you connect | For example cTrader, OANDA or Interactive Brokers. We request your trade history from them on your behalf, only after you connect them. |
We may also disclose information if the law requires it, to protect the rights and safety of our users, or as part of a sale or reorganisation of Crux — in which case this policy would continue to apply to your data.
5. Cookies
The web app uses one essential cookie to keep you signed in, and, while you sign in with Google, a second one that lasts at most 15 minutes and only checks that the sign-in finishes in the browser that started it. The website uses no cookies of its own, and its visit counting (Cloudflare, PostHog and HeyCatch) stores nothing in your browser. We do not use advertising or analytics cookies.
6. How long we keep it
- We keep your account and journal while your account is open.
- When you close your account, your journal, saved broker keys and sessions are deleted straight away. Our hosting provider keeps daily backups of the server’s disk for about seven days, after which the deleted data is gone from those too.
- Server logs are rotated and kept only for a short time.
- Stripe keeps billing records for as long as tax and accounting law requires.
7. Your choices and rights
- Export your trades as a CSV file from the app at any time.
- Correct or delete individual trades, and disconnect any broker, in the app. You can also revoke Crux’s access from your broker’s own settings.
- Close your account from Profile → Close account in the app. It is deleted straight away, and a plan you pay for is cancelled at the same moment. You can also email support@cruxjournal.com from the address you signed up with and we will do it for you.
- Depending on where you live (for example the EU, the UK or California), you may have rights to access, correct, delete or move your personal data, or to object to how it is used. Email us and we will respond within 30 days. We do not sell personal information or share it for cross-context behavioural advertising.
8. Security
Connections to Crux are encrypted in transit (HTTPS). Passwords are hashed, broker keys and platform logins are encrypted at rest, and each trader’s journal is kept in its own file. No system is perfectly secure, but we work to protect your data and will tell you promptly if a breach affects it.
9. Children
Crux is not intended for anyone under 18, and we do not knowingly collect information from children.
10. Changes to this policy
If we make a meaningful change, we will tell you by email or in the app before it takes effect.
11. Contact
Questions or requests about your data: support@cruxjournal.com.