Privacy at a glance
- Your signed-in account has its own private trading journal. Other traders cannot access your records through their accounts.
- Google sign-in verifies identity. It does not give us access to your Gmail, contacts or Drive files.
- We use sign-in and security cookies, plus device preferences. The journal does not include advertising or audience-analytics trackers.
- cTrader access is read-only, but it includes sensitive financial records. We store those records on our server and encrypt connection tokens to keep syncing.
Read-only protects against trading actions; it does not remove the privacy risks of storing financial data. Authorized operators may access stored records to run the service. No online service can guarantee absolute security.
Who is responsible
Utility Insights, also called My Trading Journal, at utilityinsights.co.za is operated by Tinotenda Bumhira. For privacy questions or requests about your personal information, contact bumhira27@gmail.com.
This notice describes the hosted service and its sign-in features. A local development installation stores data on the device or server chosen by its operator and may use password sign-in or have authentication disabled. Features that are not enabled do not set their associated cookies.
What connecting cTrader authorizes
Google sign-in creates your journal; connecting cTrader is a separate choice. When you select Connect cTrader, you are taken to cTrader's authorization page. Your cTrader password is entered with cTrader and is not provided to this journal. You can review the permission request there before approving it.
We request account-information access (the accounts permission), rather than trading permission. The integration also blocks requests to place, change or cancel orders and close positions. It cannot withdraw funds. You can read cTrader's explanation of authorization and permissions.
cTrader returns the authorized account list so you can choose which accounts to journal. For selected accounts, the service imports and stores trading and account records, then checks for updates in the background. This continues when you close your browser or sign out, until synchronization is paused or access is revoked. The authorization can cover multiple accounts; review the accounts you approve in cTrader as well as those you select in the journal.
Access and refresh tokens are digital permissions that let the server retrieve new records without your password. They are encrypted in storage and used by the server to maintain your connection. They are sensitive credentials, even with read-only access.
Information we process and why
- Sign-in information. When you use Google sign-in, Google returns an identity token that may contain your account identifier, email, verification status and basic profile fields. We verify the token and use your identifier and email to establish a signed session and associate your records with your private journal. We store your Google account identifier and email in our user database. Your Google password is not provided to us. We do not retain Google access or refresh tokens for this login; names and photos are not saved as profiles.
- Trading and journal information. Your connected cTrader accounts supply executions, positions, account identifiers, broker details, balances, fees, deposits, withdrawals and related broker records. The journal stores those records, calculated performance, notes and attachments for recordkeeping and review. Encrypted broker authorization tokens are stored to maintain the connection.
- Device and technical information. Hosting systems and identity providers may process IP addresses, browser details, request times and diagnostic logs to serve pages, verify sign-in, troubleshoot faults and prevent misuse. Device preferences are described in the cookie notice below.
- Messages you send us. If you email a privacy request or support question, we receive the contact details and information you include, to respond and keep a record of the request. Please do not send passwords, access tokens or unnecessary financial records.
We process information for the stated service and security purposes and, where applicable, to respond to legal obligations or requests you make. We rely on an appropriate ground under applicable data-protection law, which may include your request for a service, consent where required, or a lawful operational or security interest. Agreement to the Terms of Use is not blanket consent to unrelated processing.
Retention and deletion
The Google sign-in cookie lasts up to seven days; optional password sessions last up to thirty days. Sign-out removes the journal's sign-in cookies from that browser. The cookie inventory explains the shorter cTrader authorization cookies and persistent browser preferences.
Trading records, notes, attachments and encrypted broker tokens remain on the journal server until removed by you or under an applicable retention process. Archiving an account pauses its synchronization but does not delete its history. Disconnecting or revoking broker access does not by itself erase records already synchronized.
To pause new imports for an account, archive it from the Accounts page. To withdraw the app's broker authorization, revoke its access in your cTrader ID settings. Sign-out alone does not stop background sync. Revoking cTrader access does not delete your journal or close positions at your broker.
To request deletion of your journal, email bumhira27@gmail.com from the address you use to sign in. There is currently no self-service button to delete your entire journal. We may need to verify your identity before acting. You can export your records before requesting deletion; exports do not include connection tokens or attachment files. Keep separate copies of attachments you need.
Operational logs, support correspondence and backup archives have retention periods determined by the system and the purpose for keeping them; we do not promise a single automatic deletion period for all records. Backups may retain copies after an active record is removed until those backups are rotated or removed. Contact us for the retention information relevant to your request and any legal or recovery reasons for retaining a copy.
Your choices and privacy rights
You may contact the operator to ask whether your personal information is held, request access or correction, or request deletion or object to processing where applicable. You may also withdraw consent where processing relies on it; this does not undo processing already lawfully carried out. Rights and any exceptions depend on applicable law, including South Africa's Protection of Personal Information Act (POPIA).
We may need enough information to verify your identity and locate the relevant record. We will explain any information we cannot provide or delete, applicable limits, and the next steps for your request. Your request concerns your own personal information; it does not authorize access to another customer's journal or broker credentials.
You can clear browser site data or remove the application in your Google Account settings. Removing Google access does not automatically invalidate an already issued journal session; sign out of this site as well. Clearing browser data does not delete server-side records. The account holder can revoke the broker connection through cTrader.
If you believe your personal information has been processed unlawfully, you may complain to the Information Regulator of South Africa or another competent data-protection authority. You do not have to give up that right to contact us first.
Security protections and their limits
The hosted service uses HTTPS, signed sign-in sessions and server-side access checks. Broker connection tokens are encrypted at rest using AES-256-GCM. This token encryption does not mean every trade, note or attachment is individually encrypted. The service is not end-to-end encrypted: the server must be able to read records to produce your journal. No internet service can guarantee absolute security, and a local HTTP development environment has different protections from the hosted service.
Protect your Google and cTrader accounts, sign out on shared devices, and keep exported files private. If you suspect unauthorized access, revoke the cTrader connection and contact bumhira27@gmail.com. Do not include passwords or tokens in your report.
Changes to this notice
We will publish changes on this page with an updated effective date. Material changes to purposes, sharing or optional tracking will be explained, with any additional notice or consent required by applicable law. Contact bumhira27@gmail.com with questions.