Privacy Policy

What this site is

rmclub.org runs an internal trading desk console: a place to record trade decisions, keep a shared journal, and monitor MetaTrader accounts read-only. It is used by a small named group of people.

What we collect when you sign in

Signing in uses Sign in with Google. Google sends us an identity token from which we keep only:

• your email address — this is what the allowlist matches, and what stamps the trades you propose
• your display name and profile picture URL, used to show who is signed in

We request only the standard openid, email and profile scopes. We do not receive or ask for your Google password, your contacts, your Drive, your calendar, or your mail. We cannot act on your Google account in any way.

Second factor

After Google, the console asks for a six-digit code from an authenticator app. We store a secret used to check those codes. It never leaves the server and cannot be used to sign in anywhere else.

What we store about your use

• Session records — a random session id, your email, the time it was created, your IP address, and a one-way hash of your browser's user-agent string. These exist so a session can be expired or revoked. They are deleted 24 hours after sign-in, or immediately when you sign out or an owner revokes your access.
• Desk data you enter — trade proposals, committee votes, written rationales, price levels and strategy names. This is the point of the tool; it is shared with everyone signed in to the desk.
• Trading account snapshots — balance, equity, margin, open positions and a rolling equity history for any MetaTrader account connected to the console.

What we do not do

• No advertising, and no advertising or analytics trackers of any kind.
• No selling, renting or sharing of personal data.
• No profiling, and no automated decisions about you.
• No cookies except one strictly-necessary session cookie. It holds a random id and nothing else, and is HttpOnly, Secure and SameSite=Lax.

Who else sees it

Data lives on our own hosting at Hostinger. Two third parties are involved, and only for what they do:

• Google — verifies who you are at sign-in.
• MetaApi — only if an owner chooses to connect a trading account through their cloud service, in which case that account's read-only credentials go to MetaApi rather than being stored here.

We disclose data to nobody else, other than where the law requires it.

Trading account credentials

The console is read-only by design and cannot place, change or close a trade. Where an account is connected through an Expert Advisor, no credential ever leaves your own terminal. Where an account is connected through MetaApi, only a broker investor (read-only) password is accepted; it is passed straight to MetaApi and is not written to this server.

How long we keep it

Sessions: 24 hours. Journal and account data: until deleted by a desk owner. Removing someone's access ends their sessions immediately and stops any further collection about them.

Your choices

You can sign out at any time, revoke this application's access from your Google account settings, or ask an owner to remove your access and delete the records associated with you. Depending on where you live you may have rights to access, correct, export or erase your personal data; ask and we will do it.

Children

This is a workplace tool and is not directed at anyone under 18.

Changes and contact

If this policy changes, the date at the foot of the page changes with it. Questions, or any request about your data: srjhoney39@gmail.com.