0. Who is responsible
Cranes is a sole proprietorship (eenmanszaak) registered with the Dutch Chamber of Commerce (KVK) under number 95838570, based in the Netherlands. Cranes is the data controller for the personal data described below. You can reach us through our Discord community.
1. What we collect
We collect the details needed for your account, including your name, email address or internal login name, username, Cranes member code and optional profile photo. Username and password sign-in is processed privately on our server; account email addresses are not returned by a public username lookup. Email remains available for confirmation and password recovery. We also store the journal data you enter, including trading accounts, markets, trades, entries, notes, emotions, setups, confluences, tags, chart images and certificates. Your settings can include timezone, trading hours, risk limits, news preferences, theme and sidebar layout. When you sign up through the start flow, we also store the optional answers you give about your trading style, markets, edge, goal and how you found Cranes, so we can tailor the app and understand where members come from. These answers are never shown to other members.
Cranes Community adds a public @handle, an optional bio, an optional profile cover image, links to your own social profiles (X, Instagram, TikTok, YouTube and TradingView) and a choice of which journal figures your profile may show. When you take part we also store your posts, replies, reposts, stories and team chat messages, the images you attach, the trade you attach to a post, your likes, saves, follows, blocks and reports, the notifications sent to you, and a record of which members have viewed a post and how often.
If you sign up or log in with Google, Google shares your name, email address and profile photo with us so we can create and identify your account. We never receive your Google password and do not access any other Google data. Google's own privacy policy applies to your Google account.
If you begin checkout before creating an account, we collect your email address and optional display name so payment can be completed and your account can be created after successful payment. Stripe handles payment details. We do not receive or store your full card number.
2. Why we use it
We use this information to provide your journal, calculate dashboard and Analytics results, show recorded patterns, apply your account limits, generate share cards, display certificates, personalise the News Station, manage purchases, provide data exports and protect your account. We also use it to run Cranes Community: showing your profile and posts to other members, notifying you about activity, letting teams chat, keeping a feed in order, recording how often a post is seen, and applying blocks and reports. We do not sell your data and we do not use your trading data for advertising.
Our legal basis is the performance of our contract with you (running your account and lifetime purchase), our legitimate interest in keeping the service secure, and our legal obligation to keep billing records for tax purposes.
3. Who can see your data
Your journal records are isolated per user at the database level. The owner can access limited account administration information needed to manage membership, security and purchases, including your Cranes member code and recent account activity. Support access to your journal data is intended for troubleshooting and can be enabled or withdrawn in Settings. Do not enable it unless you want help with your account.
Cranes Community is separate from your journal. Your trades, entries, notes, certificates and settings stay visible only to you. Other signed-in members can see your profile photo, display name, @handle, bio, cover image, any social links you add, and the journal figures you choose to show: trades, win rate, total P&L and funded or payout status are all off until you turn them on. Members you block are hidden from your feed and your new posts are hidden from them. Team chat messages are visible to the members of that team. A report names its reporter only to the owner.
4. Processors we rely on
We use Lovable Cloud for database storage, private file storage and authentication, Lovable for application hosting and transactional account emails, and Stripe for checkout, one time payments, and receipts, and Google for optional Google sign-in. Stripe receives the customer and payment information needed for those services and keeps records for its own legal and compliance obligations. Our community support runs on Discord, which processes anything you choose to share there under its own privacy policy. The News Station retrieves public economic calendar information from a third party feed associated with ForexFactory. Your journal data is not sent to that feed.
A trade share card can be drawn over a market price chart. To build it, our servers ask a public third party market data source for close prices, sending only the market symbol, the time window and the interval you chose. No name, email address or journal record is part of that request. The provider keeps its own access logs under its own privacy policy.
Firm logos and the Prop Firms directory are bundled with the app and served from our own content delivery network, so viewing them sends nothing to the firms themselves. We do not share any personal data, journal data, accounts you track or cookies with prop firms, and we place no prop firm or affiliate cookies or trackers in the app. Links to firms open without sending which page you came from. Following such a link takes you to that firm's website, whose own policies and cookies then apply.
Some of these providers are based outside the European Economic Area or use infrastructure there. Where that happens, the transfer relies on the European Commission's standard contractual clauses or another mechanism allowed under the GDPR.
4a. Technical logs and security records
To keep the service running and secure we process authentication records, technical error information and timestamps for selected account actions. The in-app audit log can record actions such as adding a trade or account, changing a password or theme, and exporting data. We also store a recent activity timestamp for account administration. Journal content is not copied into the audit log. These records are used for security and troubleshooting, not advertising or behavioural profiling.
Community keeps a per-post view record so a member can see how often a post was read. Each member is counted once per post, your own views are not counted, and the record holds only which member read which post and when.
4b. Accounts we create for others
Some accounts are created directly by us for friends and family. Those accounts start with an internal login name and no email address; the person can add their own email in Security at any time, and the same rights described here apply to them.
4d. Age
Cranes is for adults only. You must be at least 18 years old to buy or use it, and we do not knowingly collect data from children. If you believe a minor has an account, tell us and we will delete it.
4e. Analytics, security and automated decisions
Dashboard and Analytics figures, including the Cranes Score, discipline index, streaks, rule compliance and observed patterns, are calculated from the records and limits you enter. They are shown only as journal summaries. They are not used to make decisions with legal or similarly significant effects about you, and we do not profile you for advertising.
Data is transmitted over encrypted connections, access is restricted at the database and private file storage level, and administrative functions require authenticated owner access. No system is perfectly secure. If a personal data breach is likely to affect your rights, we will notify you and the relevant authority when the law requires.
5. Retention
We keep your account and journal data while your account exists. When you delete your account, your trades, entries, notes, accounts, custom markets, profile photo, chart images and certificates are removed. Invoices and other records required for tax, accounting, fraud prevention or legal claims may be retained for the period required by law. Backup copies and technical logs can remain for a limited period before deletion or rotation.
Community content follows the same rule: deleting your account removes your posts, replies, stories, likes, saves, follows, blocks, reports and view records, and removes you from any team chat. Stories expire on their own after 24 hours whether or not you delete them. Team chat messages remain with the team until the team or its members are removed. A reported post is kept until the owner resolves the report.
6. Your rights
Under the GDPR you can request access to, correction of, export of, or deletion of your personal data, and you can object to certain processing. Contact us through our Discord community and we will respond within one month. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
7. Cookies
We use first party cookies, local storage and session storage to keep you signed in and remember functional choices such as Light, Dark, Obsidian or Monochrome mode, sidebar position and state, selected accounts, News Station globe or map view, whether journal amounts are hidden, your Community view preferences, recently used emoji, share card choices, and whether the login intro has been shown. Sidebar state is kept for up to seven days. Other functional values remain until they expire, are replaced or you clear them. We do not use advertising or cross site tracking cookies.
8. Changes
If this policy changes materially, we will announce it in the app before the change takes effect.
9. Contact
Questions about this policy? Reach us through our Discord community.