Privacy Policy

The data controller is Bianca Palaganas-Jones, contactable at support@ritualx.app. This is the party that decides why and how your personal data is processed, and the party you address any privacy request to.

If we are required to appoint an EU or UK representative under Article 27 of the GDPR, its name and address will be published in this section before we begin actively offering the service in those markets.

• Account data: name, email address, login method, account role and signup date.
• Trading and journal data you enter: trades, accounts, partial exits, playbook setups, daily rituals, habits, goals, mistakes, weekly reviews, notes, ratings, screenshots and any other content you submit.
• Uploaded files: chart screenshots and vision-board images. They are stored privately in our file storage and are only reachable through your account.
• Technical data: IP address, browser and device type, operating system, app version, error logs, and the dates and times you used the service.
• Optional marketing data: the email address and tier interest you provide if you join the waitlist, and your email engagement status (delivered, opened, unsubscribed).
• Billing data once paid tiers launch: your customer identifier, plan, subscription status, tax country and the last four digits of the payment method. Card numbers are entered directly with our payment provider and never reach our servers.

Where the GDPR or UK GDPR applies, we rely on the following legal bases.

• We do not sell your personal data, and we do not share it for cross-context behavioural advertising. There is no “sale” or “sharing” as those terms are defined by the CCPA/CPRA.
• We do not use your trading data to place, copy or execute trades, and we never connect to a broker to trade on your behalf.
• We do not use your journal content to train models for third parties.
• We do not make automated decisions that produce legal or similarly significant effects about you. The insights in the app are informational summaries of your own records.

We use a small number of strictly necessary and functional cookies and local-storage entries. They are set by us, not by advertising networks, and none of them track you across other websites. You can clear them at any time through your browser or through “Cookie settings” in the footer.

We use a limited set of service providers (processors) who act only on our documented instructions and are bound by data-processing terms. We do not give them permission to use your data for their own purposes.

If you are in the EEA, the UK or Switzerland, you have the right to:

• Access a copy of your personal data, together with the information in this policy.
• Correct inaccurate data and complete incomplete data.
• Erase your data where there is no overriding legal reason for us to keep it.
• Restrict or object to processing based on our legitimate interests.
• Receive your data in a structured, machine-readable format, or have it transmitted to another controller where technically feasible.
• Withdraw consent at any time for optional emails and analytics cookies, without affecting processing that already happened.

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what categories and specific pieces of personal information we collect, the right to delete, the right to correct, the right to limit the use of sensitive personal information, and the right to be free from discrimination for exercising those rights.

Because we do not sell or share personal information, there is nothing to opt out of; we nevertheless honour Global Privacy Control (GPC) signals sent by your browser as a formal opt-out request. Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with comprehensive privacy laws have comparable rights, including the right to appeal a refusal — reply to our decision email and we will review it.

You may use an authorised agent to submit a request on your behalf; we may ask for proof of authorisation and for verification of your identity.

Email support@ritualx.app with the right you want to exercise. We verify requests by matching the email address on your account, and we respond within one month for GDPR requests (extendable by two further months for complex requests, with notice) and within 45 days for CCPA requests. It is free to make a request.

You can also delete most of your content yourself from inside the app, and you can export your trades to CSV at any time. If you cannot find a control, write to us and we will do it for you.

If you believe we have handled your data unlawfully you may complain to your local supervisory authority. We would appreciate the chance to resolve it with you first.

Our providers may process data outside your country, including in the EU, the UK and the United States. Where personal data leaves the EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum or International Data Transfer Addendum where relevant), together with technical measures such as encryption in transit.

• All traffic is served over HTTPS.
• Every record you create is bound to your user account, and access rules prevent one user from reading another user’s records.
• Uploaded images live in private storage and are served through short-lived signed links, not public URLs.
• Administrators can access account data only where needed for support, security or legal reasons.
• No system is perfectly secure. Use a unique password, keep it private, and tell us immediately if you suspect unauthorised access.

Product updates and waitlist messages are sent only with your consent or on the basis of an existing customer relationship where the law allows it, and every message contains a one-click unsubscribe link. Unsubscribing stops marketing emails; you will still receive essential service messages about your account, security and billing.

The service is for adults aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe a minor has given us personal data, contact us and we will delete it.

We may update this policy as the product or the law changes. Material changes will be announced in the app or by email, and the date at the top of this page always shows the current version.

Controller and privacy contact: Bianca Palaganas-Jones, support@ritualx.app. Postal address and any EU/UK representative will be listed here once appointed.