Last updated: 16 August 2026 · Applies to profitsdiary.com and the Profits Diary Telegram bot
Profits Diary ("we", "us", "our") operates a personal trading journal that lets you log trades manually, by uploading a screenshot, or by sending a screenshot to our Telegram bot. This policy explains what personal data we collect, why, where it is stored, who else can see it, and the rights you have over it under Malaysia's Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024 ("PDPA").
| Category | Examples | How we get it |
|---|---|---|
| Account identity | Email address, display name, password (stored as a salted hash, never in plain text) | You provide it at sign-up, or via Google Sign-In |
| Trading data | Instrument, direction, entry/exit price, stop loss, take profit, P&L, session, setup, personal notes, discipline rating, uploaded chart screenshots | You log it — manually, via upload, or via Telegram |
| Telegram identity | Telegram username and numeric Telegram user ID | You link your Telegram account so the bot can log trades to your journal |
| Payment information | Plan tier, invoice history, last 4 digits and brand of a card, subscription status | Collected and processed by Stripe on our behalf — we never see or store your full card number |
| Technical data | IP address (used once, at sign-up, to infer country — not retained as a log), browser/session identifiers, timezone | Collected automatically when you use the site or app |
| Communications | Support ticket messages, referral activity | You provide it when you contact support or refer a friend |
| Public leaderboard opt-in | A yes/no preference for appearing on an anonymized public leaderboard | You set it at sign-up or in Settings — off by default |
We do not collect bank account numbers, national identification numbers, or government ID documents. We do not collect special/sensitive categories of personal data as defined by the PDPA (e.g. health, religious, or biometric data) as part of the normal service.
Your account and trade data is stored in a managed PostgreSQL database (Neon). Chart screenshots are stored separately as objects in Cloudflare R2, referenced by your trades — never embedded directly in the database. Both providers operate data centers outside Malaysia; where personal data is transferred outside Malaysia, we rely on the processor's own contractual and security safeguards, consistent with the PDPA's cross-border data transfer requirements.
We retain your personal data for as long as your account is active, and for a reasonable period after you close your account or request deletion, to the extent needed to resolve disputes, enforce our terms, or comply with a legal obligation (for example, retaining payment records for tax purposes). Screenshots and trade data tied to a deleted account are removed within a reasonable operational window after deletion.
We use a small number of specialist processors to run the service. Each only receives the data it needs to do its specific job:
| Processor | What it handles | Why |
|---|---|---|
| Stripe | Payment card details, billing address, subscription status | Payment processing — we never see or store your full card number |
| Cloudflare (R2) | Uploaded chart screenshots | Object storage |
| Resend | Your email address, and the content of transactional emails | Sending welcome, verification, password-reset, and support emails |
| Anthropic | Screenshot images and trade text, on a per-request basis | AI vision extraction and written trade analysis |
| Telegram | Your Telegram username/user ID and the messages you send the bot | Operating the trade-logging bot — governed also by Telegram's own privacy policy |
| Basic profile info (name, email) | Only if you choose "Continue with Google" to sign in |
We do not sell your personal data to anyone, for any purpose.
We process your personal data because it is necessary to perform our contract with you (providing the journal you signed up for), because you have given consent (for example, the public leaderboard opt-in, or Telegram linking), or because we have a legitimate interest in operating and securing the service that does not override your rights. Where we rely on your consent, you may withdraw it at any time as described below.
As a data subject under the PDPA, you have the right to:
To exercise any of these rights, contact us using the details in section 10. We will respond within the timeframe required by the PDPA, and may need to verify your identity before actioning a request.
Passwords are hashed (never stored in plain text) using a modern, salted key-derivation function. Sessions use single-use, hashed tokens rather than storing anything an attacker could replay from a database leak. Screenshots are stored as private objects and only ever served via short-lived, single-use links — never a permanent public URL. We restrict staff access to personal data to what is needed for support and operations, and log access to sensitive admin actions.
No system is 100% secure, and we cannot guarantee absolute security of information transmitted over the internet.
We use a single essential cookie to keep you signed in (an httponly session cookie — it is not readable by page scripts and is not used for advertising). We also use Google Analytics on the public marketing pages to understand traffic; this does not run inside the signed-in app, and does not see your trade data.
Profits Diary is not directed at, and is not intended for use by, anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.
We may update this policy as the service changes or the law requires. Material changes will be reflected by updating the "Last updated" date above, and — where the change is significant — we will also notify active users by email.
Data protection requests (access, correction, withdrawal of consent, deletion, or a complaint):
Profits Diary is currently operated as a sole proprietorship based in Kuala Lumpur, Malaysia. Full registered business details will be added here once the entity's incorporation is finalized.