Security & Trust

All TradingGrove data is stored in Supabase (managed PostgreSQL). Every user-data table — journals, trades, notes, pre-session checklists, referrals — has Row-Level Security (RLS) enabled. RLS policies are enforced at the database level, meaning even a misconfigured frontend cannot query another user's data.

• Encryption at rest — Postgres data is encrypted on disk by our infrastructure provider
• Encryption in transit — All connections to TradingGrove and Supabase use TLS 1.2 or higher
• Subscription field protection — Billing fields (plan, expiry, payment IDs, referral count) are guarded by a database trigger that silently reverts any modification attempted by a non-service-role caller. Even a stolen user session cannot grant itself Pro.
• Service-role isolation — Elevated database credentials live only inside our serverless edge functions; they are never sent to the browser

Authentication is handled by Supabase Auth, which issues short-lived JWT session tokens and refresh tokens. We support email/password sign-up and Google OAuth.

• Email verification required — New accounts must confirm their email before signup completes
• Password requirements — Minimum 8 characters with uppercase, number, and special character
• Password hashing — Bcrypt-class hashing; we never see or store plaintext passwords
• Session tokens — Short-lived JWTs that the backend re-validates on every authenticated request

Trade screenshots are stored in Cloudflare R2 (S3-compatible object storage), separately from your trade metadata in Postgres. Uploads use a per-trade signed-URL flow rather than passing files through our servers.

• Per-user namespacing — Every object key is prefixed trades/{user_id}/{trade_id}/, so paths are not cross-user reachable even at the storage layer
• Signed PUT URLs — Upload URLs are generated by an authenticated edge function and expire in 5 minutes
• MIME-type whitelist — Only PNG, JPG, JPEG, and WebP files are accepted; everything else is rejected at the backend
• Filename sanitisation — Path-traversal sequences (../) and unsafe characters are stripped before signing
• Collision-proof keys — Each object key includes a timestamp plus 8 random bytes

All payment processing is handled by PayPal. We never see, store, or process your card number, bank details, or any other payment instrument data — those flow directly between you and PayPal.

• PCI compliance offloaded — PayPal handles all card-data scope
• Webhook signature verification — Every billing event from PayPal is verified against PayPal's own signature-verification endpoint before we act on it
• Rate limiting — Subscription-creation requests are limited to one every 60 seconds per account to block spam and accidental double-charges

• We never sell your personal data — to anyone, ever, under any circumstances
• We never train AI or machine-learning models on your journal data
• We never use your trade content for behavioural ad targeting
• We never share your trades with brokers or third-party analytics
• We never access your calculator inputs — they live in your browser's localStorage only and never reach our servers

When you delete your account from your profile page, it is deactivated immediately: your login is permanently disabled and your account can no longer be accessed or reopened. Your data is then permanently and irreversibly erased from our active systems during a routine purge. Nothing is retained beyond that window.

Email addresses may be retained for a brief fraud-prevention window and then purged. Billing records held by PayPal are retained according to their own financial-regulation obligations.

If you believe you've found a security issue in TradingGrove, please email support@tradinggrove.com with the subject line "Security disclosure". Include reproduction steps and, where applicable, a proof-of-concept.

We do not currently run a paid bug-bounty programme, but we acknowledge every responsibly-disclosed issue and credit the reporter (with permission) once the issue is resolved. Please give us a reasonable window to fix before public disclosure.