Who runs Loryn

Loryn is an independently owned and operated service based in the United States. References to "Loryn," "we," "us," and "our" mean the owner and operator of the service. The product is an automatic journal for prop-firm futures traders that captures fills from your connected trading platform — Tradovate for Tradovate-cleared firms, or the TopstepX (ProjectX) API for Topstep — stores them privately, and builds your calendar, analytics, and history. On the Standard and Pro plans (coming soon) it also provides an AI assistant ("Loryn") that helps you review your own data.

Loryn AI — what it is and isn't

The AI assistant in this product is powered by a large language model. Like any AI assistant, Loryn can be wrong. Her verdicts, patterns, and suggestions are based on your data and should be treated as input, not instructions. Loryn does not provide investment, tax, or legal advice and is not a substitute for a licensed advisor. You remain solely responsible for every trading decision you make.

What we collect

Category	Examples	Source
Account	Email, display name, password hash, account creation timestamp, onboarding preferences	You, at signup; the auth provider (Supabase) hashes your password — we never see it in plaintext.
Subscription & billing	Subscription tier (Journal, Standard, Pro, comped, legacy), Stripe customer ID, Stripe subscription ID, billing status, current period end	Stripe webhook. We do not store your payment card details; Stripe holds those exclusively.
Trading data	Fill events (account ID, symbol, side, quantity, price, timestamps), notes you write and any trade screenshots you attach to them, conversations with Loryn, summaries Loryn generates about your trading, strategy and risk preferences you configure	Loryn syncs fill events from your broker's official API — Tradovate for Tradovate-cleared firms, or TopstepX (ProjectX) for Topstep — through the connection you authorize; the rest comes from you typing, speaking, or uploading a photo to a note.
Broker connection	For Tradovate-cleared firms, an encrypted, read-only Tradovate access & refresh token, its expiry, and connection status. For Topstep, the TopstepX (ProjectX) API key you provide, stored encrypted. Read-only means the connection can never place a trade or move funds.	The Tradovate token is created when you connect through Tradovate's own OAuth sign-in; the Topstep key is one you generate in TopstepX and paste in. Both are encrypted at rest, never exposed to your browser, and removed when you disconnect.
Loryn conversations	Messages between you and the AI assistant, including text you typed and text transcripts of what you said in voice mode	You; the Web Speech API in your browser handles the spoken-word → text conversion locally.
Usage metering	Per-call AI cost (input/output token counts, character counts), endpoint name, model name, timestamp. Used to enforce per-user spending caps and bill correctly.	Server-side, on every AI call.
Error reports	Server-side stack traces, request IDs, and the affected account ID. No conversation text or trading data is included.	Loryn's own database (associated with your account, deleted when you delete your account), and Sentry if enabled on the deployment (stack traces only).
Minimal device context	Browser type and OS version (from request headers); session token; preferences cache	Your browser sends these; we store the session token to keep you signed in.

What we do NOT collect

• Your Tradovate or TopstepX password. For Tradovate you sign in on Tradovate's own screen through their OAuth flow; for Topstep you paste an API key you generate yourself in TopstepX. Either way Loryn never sees your broker password. (To sync your fills Loryn does hold an encrypted connection credential — a read-only Tradovate token, or your ProjectX API key — see the “Broker connection” row above; it can never place a trade, and you can revoke it anytime by disconnecting in Settings.)
• Automated screenshots, screen recordings, or scraped HTML of your broker's trading platform — Loryn captures fills through the official API, never by watching or grabbing your screen. (Trade screenshots you deliberately upload to your own notes are a separate, optional feature; those are stored — see the “Trading data” row above.)
• Anything from outside the journal experience — no browsing history, no content from other tabs, no analytics about non-Loryn sites you visit.
• Your raw payment card details. Stripe handles all card collection; we only see the Stripe customer / subscription IDs and the resulting billing status.
• Your physical location, contacts, calendar, or any device sensors.

Why we collect it

Every category above is collected for an operational reason: capturing your trades, running the AI assistant, billing your subscription, keeping the service reliable, and protecting against abuse. Specifically:

• Account + Subscription — to identify you, gate paid features, and process billing.
• Trading data — to be the journal; without it the product can't function.
• Loryn conversations — to power the assistant within the current session and to give Loryn working memory across sessions when you ask her to recall something.
• Usage metering — to enforce per-user spending limits so one user can't run up our AI bill, and to bill the right tier.
• Error reports — to diagnose outages and fix bugs.

We do not use your data for advertising, sell it to data brokers, share it with analytics resellers, or feed it to AI model training. Your data exists to serve you.

Legal basis for processing (EEA / UK)

If you are in the European Economic Area or the United Kingdom, we process your personal data under the following lawful bases (EU / UK GDPR, Article 6):

• Performance of a contract — your account, subscription, trading data, notes, and Loryn conversations are processed to deliver the journal and AI assistant you signed up for. Without this data the service cannot function.
• Legitimate interests — usage metering, error reports, and security measures are processed to keep the service reliable, affordable, and protected against abuse. We balance these interests against your rights and collect only what is necessary.
• Consent — where we rely on consent (for example, an optional feature you turn on), you may withdraw it at any time.
• Legal obligation — we process limited data where required to comply with applicable law (for example, tax records held via Stripe, or responding to valid legal process).

Data controller, representative, and DPO

For the purposes of EU and UK data-protection law, the data controller is the owner and operator of Loryn, based in the United States. You can reach the controller about any data-protection matter via the contact form from the email address on your account, and we will provide the controller's full legal identity on request.

Loryn is a small operation. Its processing is not "large-scale" monitoring of individuals and does not involve large-scale processing of special categories of data, so we are not required to appoint a Data Protection Officer (GDPR Article 37) and have not appointed one. For the same reason we have not designated an EU or UK Article 27 representative; if our processing ever crosses a threshold that requires one, we will appoint a representative and update this policy with their details.

Automated analysis and profiling

Loryn's AI assistant analyzes your own trading data to surface patterns, summaries, and observations, and keeps a working profile and memory so it can be more useful to you over time. This analysis is advisory only. Loryn does not make any decision about you that produces legal effects or similarly significant effects by automated means — it does not set your price, grant or restrict your access, suspend your account, or make any binding decision. Those operational decisions are made by a human operator, not by the AI. Because no such automated decision is made, the right under EU/UK GDPR Article 22 not to be subject to solely-automated decisions with legal or similarly significant effect is not engaged. As stated above, the assistant can be wrong and is not financial, tax, or legal advice.

Where it lives (third parties)

Each vendor below processes your data on our behalf as a processor under a data-processing agreement that restricts them to our documented instructions (Stripe acts as an independent controller for the payment-card data it collects directly from you). They receive only what they need to perform their function:

• Supabase — primary database (Postgres), authentication, and file storage. All your trading data, notes, conversations, settings, and account info live in Postgres; any trade screenshots you upload to notes live in a private Supabase Storage bucket. All encrypted at rest, hosted in AWS us-east-1.
• Stripe — payments processing. Stripe stores your card information; we never see it. We receive the Stripe customer ID, subscription ID, billing status, and current period dates via signed webhooks.
• Anthropic (Claude) — the AI model that powers Loryn's chat. The text of each message you send is forwarded to Anthropic's API to generate a response. Anthropic's privacy policy and data-handling commitments apply to that leg. We do not enable Anthropic's data retention for training.
• ElevenLabs — text-to-speech for Loryn's voice. The text of Loryn's replies (not yours) is streamed to ElevenLabs to produce audio.
• Resend — transactional email delivery. Your email address, display name, and the contents of system emails we send you (password reset, usage warnings, support replies) are processed by Resend.
• Vercel — web hosting for the journal app and marketing site. Vercel sees HTTP request metadata but not your data.
• Web Speech API (in your browser) — converts your spoken words to text locally. Loryn sees the transcript text, not the raw audio. In some browsers (notably Chrome) this transcription may be performed on Google's servers per the browser's own privacy terms.
• Sentry — server-side error monitoring, if enabled on a given deployment. Stack traces and request IDs only; no user data.

Who can see your data

Your data is isolated to your account. The database enforces per-user row-level security: every read and write must be authenticated as you and is scoped to your account UUID. A signed-in subscriber cannot, by any path, read another subscriber's trading data, notes, or conversations.

The only humans with engineering access to the database are Loryn's operators, who access account data only when (a) you've asked for support and granted access in your request, or (b) when investigating a security incident or outage. Any such access is logged. Administrative roles inside the product can comp accounts or restrict them, but admins (other than the owner) cannot view another user's trading data, conversations, or notes.

Sharing & disclosure

We do not sell your data. We do not rent, lease, exchange, or trade it. We do not share it with advertising networks. We share data only with the third-party processors listed above, and only what each one needs to perform its function.

We will disclose data if compelled by valid legal process (subpoena, court order, or other binding legal demand). We will notify you of any such demand unless legally prohibited from doing so.

If the operator of Loryn changes (e.g., the business is sold or restructured), your data may transfer to the new operator under the terms of this policy. You will be notified by email before any such transfer takes effect, and you may delete your account first.

Security

Loryn applies standard security practices:

• All traffic between you and Loryn is encrypted in transit (TLS / HTTPS).
• Database storage is encrypted at rest by Supabase / AWS.
• Passwords are hashed by Supabase Auth using industry-standard algorithms (Argon2 / bcrypt). We never see plaintext passwords.
• Row-level security policies are in place on every user-data table, preventing cross-tenant reads under any code path.
• Edge Functions require a signed JWT for every call; anonymous traffic is rejected with HTTP 401.
• Stripe webhook payloads are verified by signature before being acted on, preventing webhook forgery.
• Per-user spending caps prevent any single user from running up costs that would affect the service.

No system is perfectly secure. If you believe you have found a vulnerability, please use the contact form with the subject line "Security." We review every legitimate report and respond as soon as we can.

Data breaches

No system is perfectly secure, so we plan for the possibility of a breach. If we discover a security incident affecting your personal data, we will act without undue delay to investigate and contain it and to assess the impact. Where the breach is likely to result in a high risk to your rights — and in any other case where the law requires it — we will notify you by email at the address on your account, describing what happened, what data was involved, and the steps you can take. Where applicable law requires us to notify a data-protection authority (for example, your supervisory authority in the EEA or the Information Commissioner's Office in the UK), we will do so within the timeframe the law sets — under the EU and UK GDPR, generally within 72 hours of becoming aware of a qualifying breach.

Retention

• Active accounts — we retain your data indefinitely while your subscription is active or you continue to sign in, so your journal stays complete.
• Account deletion — when you delete your account from Settings, your trading data, notes, conversations, settings, and account profile are deleted immediately and cannot be recovered. Your Stripe subscription is canceled at the same time. We retain a minimal billing/subscription record (such as the Stripe customer and subscription IDs and billing status) where we are required to for tax record-keeping and to prevent abuse such as ban evasion. Residual copies in encrypted backups and downstream caches are purged within 30 days.
• Inactive accounts — if your subscription has been canceled for non-payment, we keep your data for 30 days so you can reactivate, then permanently delete it if you do not return.
• Billing records — Stripe retains its own transaction records under its policies and applicable tax law; we retain the corresponding subscription metadata for as long as we need it for billing, tax record-keeping, and ban-evasion prevention.
• AI usage logs — token and cost records used for spending caps and billing accuracy are kept for 12 months, then automatically deleted by a daily scheduled job.
• Error logs — server-side error records (in our database and, where enabled, with our error-monitoring provider Sentry) are kept for 30 days, then automatically deleted by a daily scheduled job. They contain stack traces and request identifiers, not your trading data or conversation text.
• Anthropic, ElevenLabs, Stripe, Resend, Vercel, and Sentry each retain data per their own privacy policies.

Your rights

You have the following rights with respect to your data:

• Access — view your full account, trading data, notes, and conversation history at any time inside the product.
• Export — your trading data and notes are yours; contact us to request a copy.
• Correct — edit any note. Trading-fill records are not user-editable because their accuracy is the point of the journal; if you believe a fill was captured incorrectly, contact support.
• Delete — wipe your account and all associated data from Settings → Delete account. The deletion is immediate and cannot be undone.
• Withdraw consent — where we rely on consent, you can withdraw it at any time; deleting your account withdraws consent for all processing.

If you are in the EEA or the UK

Under the EU and UK GDPR you also have the rights to access a copy of your data, rectification of inaccurate data, erasure ("right to be forgotten"), restriction of processing, data portability (a machine-readable copy), and to object to processing we base on legitimate interests. To exercise any of these, use the contact form from the address on your account; we respond within 30 days. You also have the right to lodge a complaint with your supervisory authority — your country's Data Protection Authority in the EEA, or the Information Commissioner's Office (ICO) in the UK — though we'd appreciate the chance to resolve it directly first.

If you are in California

Under the CCPA/CPRA you have the rights to know what personal information we collect and how we use it, to access and delete it, to correct inaccurate information, and to not be discriminated against for exercising these rights. The categories of personal information we collect, the sources, and the purposes are described in the "What we collect" and "Why we collect it" sections above, which serve as our notice at collection; the time we keep each category is in the "Retention" section. We do not sell your personal information and do not share it for cross-context behavioral advertising, so there is no "Do Not Sell or Share My Personal Information" action to take. We do not collect or use sensitive personal information for any purpose beyond providing the service to you. To exercise your rights, use the contact form from the address on your account; you may also use an authorized agent acting on your behalf with your written permission. We will confirm receipt and respond within 45 days (we may extend once by an additional 45 days where permitted, and will tell you if we do).

If you are in another US state with a privacy law

Several US states — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana — give residents privacy rights similar to California's. If you are a resident of one of these states, you have the right to confirm whether we process your personal data and access it, to correct inaccuracies, to delete your data, and to obtain a portable copy in a usable format. You also have the right to opt out of the sale of personal data, of targeted (cross-context behavioral) advertising, and of profiling that produces legal or similarly significant effects — but Loryn does none of these: we do not sell personal data, we do not serve targeted advertising, and we do not profile you in any way that produces legal effects, so there is nothing to opt out of. To exercise any of these rights, use the contact form from the address on your account; we respond within the time your state requires (generally 45 days). If we deny your request and your state provides an appeal right, you may appeal by replying to our decision; if your appeal is denied you may contact your state Attorney General.

Cookies, storage, and tracking

Loryn uses minimal client-side storage:

• A first-party session token (stored in localStorage) keeps you signed in. It is sent only to Loryn's own servers.
• A preferences cache (also localStorage) so the app remembers your sound and notification settings instantly.
• A service-worker cache for offline-instant page loads. No personal data is cached, only HTML/CSS/JS assets.

Loryn does not use third-party tracking cookies, advertising pixels, session replay tools, or any cross-site behavioral tracking.

International users

Loryn is operated from the United States, and your data is processed there. For transfers of personal data from the EEA, the UK, or Switzerland to the United States, we rely on appropriate safeguards where required — including the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) with our processors — in addition to your consent to the transfer by using the service. You may request more information about these safeguards via the contact form. The third-party processors listed above each maintain their own data-transfer mechanisms.

Children

Loryn is not directed at, and is not intended for, users under the age of 18. We do not knowingly collect data from minors. If you believe a minor has created a Loryn account, contact us and we will delete the account.

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes (new third-party sub-processors, changes to data retention, or changes to your rights) will be emailed to the address on your account before they take effect, with enough advance notice that you can delete your account first if you do not agree to the change. Continued use of Loryn after a change takes effect indicates acceptance of the updated policy.

Contact

Questions about this policy, requests to exercise your rights, security concerns, or anything else privacy-related: use the contact form from the email address on your account.