1. Company Information

NexTick360, Inc. — a Delaware corporation, United States.

Primary Data Residency: United States (Microsoft Azure — Central US).

Contact: Contact Us

2. Information We Collect

A. Account Information

When you create an account, we collect:

• Name
• Email address
• Authentication provider identifier (Google, Microsoft, or email/password)
• Tenant ID
• Subscription status

We do not collect or store payment card numbers.

B. Social Login (OAuth)

If you sign in using Google or Microsoft, we receive your name, email address, and a unique provider identifier. The authentication provider may receive information that you are signing into NexTick360 as part of the OAuth redirect flow. We do not receive or store your Google or Microsoft password. Social login is governed by the respective provider's privacy policy.

C. Broker Connections (Local Only)

When you connect NexTick360 to your broker through Rithmic, CQG or TradeStation:

• Usernames and passwords are stored only on your Windows computer, encrypted with Windows DPAPI (user-scoped encryption).
• TradeStation uses a browser sign-in instead of a password; the access it grants is kept on your computer.
• None of these are ever sent to NexTick360 servers or stored in the cloud.
• Orders you enter go from your computer straight to your broker, never through NexTick360 servers.

We do not have access to your broker passwords. The application does read your trading account names, balances, positions and P&L from your broker to show them to you; the trades and fills that result are synced to your journal as described below.

D. Trade & Execution Data

Your journal holds your own trading activity: per-trade data (symbol, side, quantity, entry and exit prices, timestamps, realized P&L, commissions, fees, tags and notes), per-fill data (fill price, quantity, timestamp, and the bid and ask at the fill), the broker trading account each trade was on, and numbers about each of your trades, such as how far it ran each way (MAE/MFE), slippage and delta at entry.

This data is captured by the desktop application on your computer and synchronized to our cloud databases with per-tenant isolation, so your journal is the same on the web, on your phone and on every computer you use. Synchronization is a core function of the Service: the web journal's analytics, coaching and reports operate on the synchronized copy. You may export or delete your data at any time, and deleting your account deletes it from our cloud databases.

These records are yours alone. They cover only your own account and are never combined with, or shown alongside, another trader's activity unless you choose to share them. Where a member of our support team needs to look at them to answer a question you have raised, that access is itself recorded — who viewed your records, and when.

E. Market Data Handling

NexTick360 does not operate as a market data redistributor. Market data comes from your own broker account. The desktop application keeps it on your computer, encrypted, so charts load quickly and work while the market is closed; the order flow around your own trades is kept the same way, so you can review a trade as it was. How long it is kept follows the retention setting and disk limit you choose, and you can clear it in the application's settings. Market data is never uploaded to NexTick360, never shared with anyone and never shown anywhere off your computer. Only the numbers about your own trades described above are synchronized. You must maintain valid market data entitlements through your broker or data provider.

F. Journal & Psychology Data

If you use journaling features, we collect journal titles and markdown content, mood/stress/focus scores, day ratings, goals, rules broken, behavioral insights, and screenshots you attach. This data is stored in our cloud databases with per-tenant isolation. If you share a trade, a day or your journal with a coach, they can view what you shared, read-only, until you revoke it.

G. AI-Powered Features

When you use AI-powered features (Nic, the morning brief and the weekly review), your question and the relevant journal data — trade facts, notes, tags and the rules you set — are sent through our servers to Anthropic (Claude) for processing. Your market data is never sent, and neither are your broker passwords. Your conversations with Nic are stored in your journal for continuity, and we record how many AI credits you use. AI-generated responses are informational only and are not financial advice.

Third-party AI providers process data under their own privacy policies.

H. Error Reports & Audit Data

Error reports. When the desktop application, the web journal or our servers hit an error or crash, a report is sent to Sentry: the error, where in the software it happened, the application version, and basic system details such as the Windows version. Reports do not contain your broker passwords or your market data.

Audit logging may occur for security and compliance purposes. Audit records may include machine name, IP address, user ID, and event type.

We use Google Analytics (website usage analytics, with your consent where required) and Sentry (error reports, as above). We do not use advertising trackers, behavioral advertising systems, or session recording tools.

I. Payment Processing

Payments are processed exclusively by Stripe. We share your email, display name, and tenant reference with Stripe. We receive subscription status and customer/subscription identifiers from Stripe. We never receive or store full credit card numbers.

3. Cookies & Tracking Technologies

Our website uses cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Service is used. We use two categories:

• Strictly necessary cookies — required for authentication, session management, and security. These cannot be disabled.
• Analytics cookies — set by Google Analytics to measure website usage. These are non-essential.

We do not use advertising, cross-site tracking, or behavioral advertising cookies. You can control or delete cookies at any time through your browser settings, though disabling some cookies may affect how the Service functions. Where required by law, we request your consent before setting non-essential cookies, as described in the EEA & UK section below.

4. How We Use Information

We use collected information to:

• Run the trading application's account features and license it to you
• Keep your journal in sync across your devices
• Provide journal analytics, coaching tips and behavioral insights
• Generate AI coaching, the morning brief and the weekly review
• Share what you choose with the coaches you choose
• Maintain secure account access
• Improve product reliability and performance
• Manage subscriptions and billing
• Detect and prevent misuse of the Service

We do not sell personal information.

5. Automated Processing & Profiling

A core purpose of the Service is to analyze your trading activity. We use automated processing to generate journal analytics, coaching tips, behavioral insights and AI coaching. Limits and guardrails act on your computer, under rules you set. These outputs are informational decision-support tools intended to help you understand your own trading.

This processing does not produce legal or similarly significant effects, and we do not use it to make automated decisions about you without human involvement. You may ask questions about, or object to, this processing as described in the sections on your rights below.

6. Third Parties & Subprocessors

We do not sell your personal information. We share it only with the service providers (“subprocessors”) that help us operate the Service, each contractually bound to protect it and to use it only for the purposes we specify:

• Stripe — payment processing. We share your email, display name, and tenant reference, and receive subscription and customer identifiers. Stripe never shares your full card number with us.
• Anthropic — AI-powered features (Nic, the morning brief, the weekly review), using its Claude models. We send your question and the relevant journal data. Market data and broker passwords are never sent.
• SendGrid — account, service and briefing emails (your name and email address, and the content of the email).
• Microsoft Azure — cloud hosting, database storage and service logs, in the United States (Central US region).
• Google — Google Sign-In (name, email, and a provider identifier if you choose Google login) and Google Analytics (website usage).
• Microsoft — Microsoft Sign-In (name, email, and a provider identifier if you choose Microsoft login).
• Sentry — error reports from the desktop application, the web journal and our servers.

We do not share your broker passwords or your market data, which never leave your computer. We may also disclose information where required by law or to protect our legal rights.

7. Data Storage & Security

Cloud infrastructure is hosted in Microsoft Azure (Central US region). Production storage uses geo-redundant replication within the United States. All data resides within the United States. Each tenant is logically isolated. Individual customers share a common database in which every record carries a tenant identifier, and separation is enforced both by the application and independently by the database itself, so a request scoped to one tenant cannot read or write another tenant's records.

On your computer, the desktop application keeps your settings, workspaces and drawings, a copy of your trading data waiting to sync, and the encrypted market data described above. The market data is encrypted with a key protected by Windows and rolls off on your retention setting.

We implement reasonable technical and organizational safeguards to protect user data, including encryption in transit (TLS) and at rest.

8. Data Retention

We retain account and trading data for as long as your account remains active. Upon account termination, cloud data may be deleted after a reasonable retention period (typically 30 days). Data on your computer remains under your control; the market data it keeps rolls off on your retention setting and can be cleared in the application's settings. AI conversation history stored in our cloud database is deleted with your account data.

9. Data Breach Notification

In the event of a data breach that compromises your personal information, we will notify affected users within a reasonable timeframe and in accordance with applicable law.

10. Your Rights

You may:

• Access your stored data
• Request correction of inaccurate data
• Request account and data deletion
• Object to error reporting and other processing based on our legitimate interests
• Export your trading data

To exercise these rights, contact us.

11. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request details about the personal information we collect, use, and disclose.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell personal information to third parties.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us.

12. EEA & UK Residents (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, this section applies to you and supplements the rest of this Policy.

Data Controller

NexTick360, Inc. is the controller of your personal information. You can reach us through our contact form.

Legal Bases for Processing

• Performance of a contract — to provide the Service you subscribe to.
• Legitimate interests — to secure, maintain, and improve the Service, including error reports, and to prevent misuse, balanced against your rights.
• Consent — for non-essential cookies such as Google Analytics, which you may withdraw at any time.
• Legal obligation — where we must process information to comply with applicable law.

Your GDPR Rights

You have the right to access, rectify, erase, restrict, or object to the processing of your personal information; the right to data portability; and the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

International Data Transfers

Your personal information is processed and stored in the United States. Where we transfer personal information from the EEA or UK to the United States, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, a copy of which you may request.

Right to Lodge a Complaint

You may lodge a complaint with your local data protection authority. In the United Kingdom, this is the Information Commissioner's Office (ICO). To exercise any of these rights, contact us.

13. Children's Privacy

The Service is not intended for individuals under 18 years of age.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted with a revised Effective Date. We will notify users of material changes via email or in-app notification.

15. Contact Information

NexTick360, Inc. — Contact Us