Effective September 28, 2026. This policy covers the Dojo at dojo.onepunchalgo.com, operated by Golden Lines Academy LLC (doing business as OnePunch ALGO Academy). The privacy policy on onepunchalgo.com covers that site and your subscription and payment.
What we collect
- Account: email, display name, password (stored as a one-way hash), optional avatar and Discord handle, time zone, theme and preference switches.
- Broker data (read-only): account identifiers with masked numbers, option fills (symbol, contract, side, quantity, price, fees, time) and the trades, P&L and statistics computed from them. We do not receive your broker login or the ability to trade.
- What you write: journal fields, notes, tags, screenshots you paste, daily plans, rule contracts, support tickets, and questions you ask the coach.
- Market data key: the key you paste from your data provider, encrypted at rest.
- Learning: course progress, quiz attempts and certifications.
- Technical: session cookie, IP address and browser information in server logs, and error reports you choose to send from an error card (page, message, time, browser).
How we use it
- To run the product: sync and pair trades, score discipline and plan adherence, draw charts, compute the volatility gauge, track streaks and certificates.
- To generate coach reviews and answers, which means sending a computed fact sheet and your questions to an AI provider (currently OpenAI) under its API terms. The fact sheet contains trade statistics, journal labels and notes you wrote; it does not contain your password, broker credentials or payment details. The provider does not use API data to train its models under those terms.
- To send the emails you have not turned off: welcome, weekly recap, ticket replies and billing notices, delivered through Postmark.
- To show community features you opt in to (leaderboard, Discord posts): display name, avatar, Discord handle, percent return, discipline score, certificates and streaks. Never dollar amounts.
- To keep the service secure, debug problems and understand usage in aggregate.
Who else touches the data
- A regulated account aggregation provider that holds your read-only broker connection and returns your fills to us.
- Your market data provider, when charts or the gauge are requested with your key.
- OpenAI for coach output; Postmark for email; Discord for posts you opted in to; WooCommerce on onepunchalgo.com for subscriptions and payments (we receive your email and subscription status, never card numbers).
- Our hosting provider, where the database and backups live in the United States.
- We do not sell personal data and do not share it with advertisers.
Retention
- Your data stays while your account exists. If your subscription lapses, sign-in pauses and data is kept for at least 12 months so you can return.
- When you delete your account, everything tied to it is removed from the live database immediately, broker connections are revoked, and it ages out of encrypted backups within 35 days. A minimal record (email and time of deletion) is kept so we can prove the request was honoured.
- Coach questions and answers are kept with your account and deleted with it. The AI provider retains API inputs for up to 30 days for abuse monitoring under its policy.
Your choices and rights
- Export every closed trade with journal labels as CSV from the Trades page at any time.
- Turn emails, leaderboard and Discord sharing off in Settings.
- Remove your market data key or disconnect a broker in Settings and Brokers.
- Delete your account yourself in Settings, or email support@onepunchalgo.com and we will do it for you within 7 days.
- Residents of California, the EU, the UK and other regions with data protection laws can request access, correction, deletion or a copy of their data through the same address.
Cookies
The Dojo uses one first-party session cookie to keep you signed in and a small amount of browser storage for preferences like theme and the tour. No advertising cookies, no third-party trackers.
Security
Passwords are hashed, secrets and market data keys are encrypted at rest, broker access is read-only, connections use TLS, and admin access is limited to the team. No system is perfectly secure; if we learn of a breach affecting you we will tell you without undue delay.
Children
The Dojo is not for anyone under 18 and we do not knowingly collect data from minors.
Changes and contact
We update this policy when practices change and post the new effective date here. Questions or requests: support@onepunchalgo.com. Golden Lines Academy LLC (doing business as OnePunch ALGO Academy), Orlando, Florida.
