Privacy Policy — Roast My Trades

1. Who we are

Roast My Trades is operated by Shapes.io Ltd, a company registered in England and Wales (company no. 12749052). You can contact us at RoastMyTrades@shapes.io.

2. What data we collect

We collect and process the following data when you use Roast My Trades:

Account data: your email address and, if you sign in with Google, your display name and profile picture.
Trade data: trade records you enter manually or import via CSV (ticker, entry/exit price, dates, position size, notes).
Usage data: page views, feature interactions, and analysis events via Google Analytics 4 (GA4), collected only with your consent.
Cookie data: a consent preference cookie and Firebase session cookies required for authentication.

We do not collect payment card details, national identification numbers, or sensitive personal data as defined by UK GDPR.

3. How we use your data

To provide the service: authenticating your account and storing your trade records in Firebase Firestore.
To generate AI analysis: your trade data is sent to Google's Gemini API to produce feedback. Google processes this data under their API Terms of Service and does not use it to train their models by default.
To improve the product: aggregated, anonymised analytics (GA4) help us understand how the app is used.
To communicate with you: responding to support enquiries you initiate.

4. Legal basis for processing (UK GDPR)

Contract: account data and trade data are processed to provide the service you signed up for.
Consent: analytics cookies are set only after you accept via the cookie banner. You can withdraw consent at any time by clearing cookies.
Legitimate interests: basic server logging to maintain security and diagnose errors.

5. Third-party services

We use the following sub-processors:

Google Firebase (Auth, Firestore, Cloud Functions, Hosting) — your data is stored in Google's eu-west region where available.
Google Gemini API — trade data is sent for AI analysis. Data is not retained by Google for model training under standard API terms.
Google Analytics 4 — anonymised usage analytics, subject to your cookie consent.

We do not sell your data to third parties.

6. Data retention

Your trade and analysis data is retained for as long as your account is active. If you delete your account, your data is removed from Firestore within 30 days. To request account deletion, email RoastMyTrades@shapes.io.

7. Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request erasure of your data ("right to be forgotten").
Restrict or object to processing.
Data portability (receive your trade data in a machine-readable format).
Withdraw consent for analytics cookies at any time.

To exercise any of these rights, contact us at RoastMyTrades@shapes.io. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

8. Cookies

We use the following cookies:

rmt_cookie_consent — stores your analytics consent preference. Expires after 1 year. Strictly necessary.
Firebase session cookies — required for authentication. Session-scoped.
_ga, _ga_* — Google Analytics cookies, set only with your consent.
rmt_utm — session storage (not a cookie): if you arrive via a tagged link (e.g. an ad), the link's campaign tags are held for the duration of the browser session so we can record which channel brought you here if you create an account. Contains no personal data and is deleted when the tab closes.

9. Changes to this policy

We may update this policy from time to time. Material changes will be notified via the app. The "last updated" date at the top of this page always reflects the current version.

10. Contact

For any privacy-related questions, contact us at RoastMyTrades@shapes.io.