Privacy policy

Last updated 31 October 2026

Kort på svenska: LogBook sparar din e-post och det du själv loggar (trades, anteckningar, bilder och inställningar) för att kunna visa din journal. Inget säljs, ingen spårning och ingen reklam. Datan ligger hos Supabase i Irland. Kontomejl skickas via Supabase eller Resend, registrering och inloggning kan skyddas av Cloudflare Turnstile, och blir du Supporter sköter Stripe betalningen (LogBook ser aldrig ditt kort). Du kan exportera allt och radera kontot själv under Settings. Betalningsuppgifter sparas hos Stripe och i bokföringen så länge bokföringslagen kräver, även efter att kontot raderats. Frågor: ludvigschonbeck@gmail.com.

Who is responsible

LogBook is run by Ludvig Schönbeck, Sweden, who is the data controller for the personal data described here. Contact: ludvigschonbeck@gmail.com.

What we store

Account: your email address and your password. The password is stored only as a hash by our authentication provider.
Your journal: trades, prices, results, notes, tags, playbooks, daily notes, goals, settings and the screenshots you upload.
Montrose connection (optional): if you connect Montrose, encrypted tokens that let LogBook read your Montrose accounts on your behalf (a short-lived one is reused for up to 15 minutes). Your holdings and transactions are fetched when you open the Holdings page and are not saved; your browser keeps the last answer in memory for at most a minute.
Discord reminders (optional): if you save a Discord webhook in Settings, the webhook address and which reminders you want, plus a short record of which reminders have already been sent (for example "evening review, 30 October") so that none goes out twice. The record is deleted with your account.
Supporter (optional): if you become a Supporter, your Stripe customer and subscription IDs, the subscription's status, which price you pay and when the paid period ends. LogBook never receives or stores your card details.
Feedback (optional): if you send feedback from the app, the text you write, the page you were on (for example /journal), your window size, the time and which account sent it. Only LogBook's owner reads it, and it is deleted once handled, or with your account.
Technical logs: IP address, browser and time of requests, kept by our hosting and database providers for security and troubleshooting. If something breaks in your browser, the app also reports the type of error, a short error message with none of your content (no trades, notes, amounts or email) and the path of the page (for example /calendar) to our hosting provider's logs.

Why, and on what legal basis

We use this data only to provide the journal to you: to sign you in, store what you log and show you your own statistics. The legal basis is the agreement between you and LogBook (GDPR article 6(1)(b)). Technical logs and the human check on sign-up and sign-in are based on our legitimate interest in keeping the service secure and free of abuse (article 6(1)(f)). Bookkeeping records of payments are kept because Swedish bookkeeping law requires it (article 6(1)(c)).

We do not sell your data, use it for advertising, or share it with anyone other than the providers below. We do not use tracking or analytics cookies.

Where your data is stored

Supabase — database, file storage and sign-in. Servers in Ireland (AWS eu-west-1).
Vercel — hosting of the app. May process request data in the EU and the US under the EU Standard Contractual Clauses.
Google Calendar (optional) — only if you press "Sync calendar" and allow access in Google's own window. LogBook then adds the economic releases you ticked (name, currency, impact and time) as events in your Google Calendar, directly from your browser. No trades, notes, images or account details are sent. The access token is kept in memory for that visit only and never stored by LogBook. You can remove the access at any time in your Google Account (Security → Third-party connections). Google LLC is in the US; transfers rely on the EU–US Data Privacy Framework and Google's Standard Contractual Clauses.
Montrose (optional) — only if you press "Connect Montrose" and approve with BankID at Montrose. LogBook can then read your accounts, holdings and transactions there, read-only; it can never place an order. The data is shown to you and not stored, only the encrypted tokens are kept. It stops working after 90 days, or when you press "Disconnect" or revoke it at Montrose (Profile settings → Third-party integrations). Montrose is part of DNB Carnegie Investment Bank AB in Sweden.
Crypto wallets (optional) — only if you add a wallet address on the Holdings page. LogBook stores the public address and the label you give it, and reads its balance and history from public services: mempool.space (Bitcoin), the Hyperliquid API, a Cronos POS node and the crypto.org explorer. They see the address but nothing else about you. Prices come from CoinGecko, which only learns which coins are asked for. LogBook never asks for keys and cannot move anything. Remove the wallet and the address is deleted.
Discord (optional) — only if you save your own Discord webhook in Settings, or press "Send test". LogBook's server then posts short reminders to that webhook, which means to the Discord channel you chose: that your morning routine or evening review is still open, an economic release you ticked that starts soon, and, if you set daily limits, that you have reached your planned number of trades or that today's loss has reached your loss limit (the message then includes the amount). Nothing else is sent: no other trades, notes, images or account details. Discord Inc. is in the US and receives the messages under its own terms and privacy policy. To stop, clear the webhook in Settings and save, or delete the webhook in Discord.
Resend — sends account emails: confirming your address, invitations, sign-in links, password resets and changes of email address. Account emails are sent by Supabase or, once it is set up, by Resend. Resend receives your email address and the email itself, and nothing from your journal. Resend (Plus Five Five, Inc.) is in the US; transfers rely on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses.
Cloudflare Turnstile — a check that you are a human, shown when you create an account or sign in once account creation is open. When it runs, Cloudflare sees technical signals such as your IP address and browser, to tell people from bots. Cloudflare also uses these signals, on its own responsibility, to improve its bot detection. No journal data and no email address is sent. Cloudflare, Inc. is in the US; transfers rely on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses.
Stripe (Supporters only) — handles payment if you become a Supporter. Stripe receives your email address and the payment details you enter on Stripe's own page, and LogBook keeps only the IDs, status, price and period end listed above. Stripe Payments Europe Limited (Ireland) processes the payment for LogBook, and is responsible on its own for the data it must keep by law, such as fraud prevention and its own records. Some processing may take place in the US under the EU–US Data Privacy Framework and the EU Standard Contractual Clauses.

The news page loads the public economic calendar from Forex Factory and official US figures from FRED (Federal Reserve Bank of St. Louis) through our server. No data about you is sent to them.

If we add any other provider, it will be listed here before it is used.

Who can see your data

Other LogBook users can never see your data; every row and image is locked to your account. As the operator, Ludvig Schönbeck can technically access the database. We only look at your data when you ask for help or when needed to investigate a security incident.

How long we keep it

As long as your account exists. When you delete your account, everything is removed at once from the live database and file storage. Backup copies containing your data are deleted within 30 days. One exception: if you have been a Supporter, records of your payments (amounts, dates and receipts) are kept by Stripe and in LogBook's bookkeeping for as long as Swedish bookkeeping law requires (7 years), even after your account is deleted.

Your rights

Export: Settings → Data & account → Full backup (JSON) or Export all trades (CSV).
Delete: Settings → Data & account → Delete account.
Access, correction, restriction or objection: email us.
Complaints: you can contact the Swedish Authority for Privacy Protection (IMY), imy.se.

Storage in your browser

LogBook keeps only what it needs in your browser's local storage: your sign-in session, an unsaved trade draft and display choices such as filters. This is strictly necessary for the service, so no consent banner is needed. Signing out removes the session and the draft. When the human check runs, Cloudflare may also store a small amount of security data in your browser to remember that the check was passed; it is used only for that, never for tracking.

Changes

If this policy changes in a way that matters, we will tell you by email or in the app before the change takes effect.