XBreakout Privacy Policy

Last updated: 7 September 2026

This Privacy Policy explains how we collect, use, share, and protect personal data when you visit our marketing site at https://xbreakout.com or use the XBreakout application at https://app.xbreakout.com (together, the "Service"). XBreakout is a charting and trading-journal workspace for crypto and forex traders. It provides native charting, a guided trading plan, automatic trade journaling, psychology analytics, and paper (simulated) trading. XBreakout is not a broker, exchange, or financial adviser; it executes no real-money orders, issues no trade signals, and gives no personalised investment advice.

We wrote this policy to be read. Please read it in full so you understand what data we handle and the choices you have.

1. Who is responsible for your data (controller and contacts)

The controller responsible for personal data processed through the Service is [ FILL IN: your legal entity / name ], a [ FILL IN: entity type (e.g. sole proprietor) ] established in Sri Lanka, with its registered address at [ FILL IN: your business address ] (registration number [ FILL IN: registration number ]; VAT/tax number [ FILL IN: VAT / tax number ] where applicable).

For any privacy question, or to exercise the rights described below, contact us at [ FILL IN: privacy email ]. For general enquiries you may also use [ FILL IN: support email ].

Our home data-protection law is the Sri Lanka Personal Data Protection Act No. 9 of 2022 (the "PDPA"). Because our audience is global and our copy and pricing are offered internationally, we also apply the EU General Data Protection Regulation, the UK GDPR, and applicable ePrivacy rules to individuals those laws protect.

Where we are required under Article 27 of the EU/UK GDPR to designate a representative in the EU or the UK for data subjects located there, that representative's name and contact details will be published in this section. Our designated PDPA privacy contact (data protection officer or equivalent point of contact) is reachable at [ FILL IN: privacy email ] and will be named here where a formal designation is required.

2. What data we collect

We collect only what the Service needs to function. The categories differ between the marketing site and the app.

Marketing site (xbreakout.com)

The marketing site is a static site. It has no forms, no analytics or tracking scripts, no advertising, and it self-hosts its fonts. When your browser requests a page, our hosting infrastructure automatically processes standard technical data needed to deliver the page and keep the server secure, including your IP address, the requested URL, the date and time, your user-agent string, and referrer, recorded in short-lived server logs.

The only browser storage the marketing site sets is a single first-party localStorage key named xbk-theme, holding the value "light" or "dark". It is written only if you click the theme toggle, it records nothing but your chosen display appearance, and it contains no identifier. It is not used to track you and is not shared with anyone.

The "Try it live" demo

The marketing site offers a "Try it live" demo. Nothing loads until you click "Load live demo". Only then do we embed the XBreakout app in an iframe, after which the app (and the third parties it contacts to draw charts) processes data as described for the app below. See section 9 for details.

The app (app.xbreakout.com)

When you create an account and use the app, we process:

• Account credentials — the email address and password you register through our authentication provider (Supabase Auth). Passwords are handled by the authentication provider and are not stored by us in readable form.
• Device identification at sign-up — when you create an account we collect device and browser signals through Fingerprint to generate a device identifier, used only to detect and limit fraudulent or abusive account creation (for example one person opening many accounts to bypass limits). It is not used for advertising, cross-site tracking, or profiling, and legitimate users are never blocked when it cannot be determined.
• Journal and trade entries — the trades, notes, plans, tags, screenshots, and review data you record, including any emotions, confidence, and plan-adherence data you choose to log.
• Trader profile — profile details you supply about yourself and your trading.
• App preferences — settings such as chart preferences, workspaces, watchlists, and display options, which sync to your account.
• Technical and security data — server logs and security-related metadata generated when your browser communicates with the app, as described above.

When you use charting features, your browser contacts third-party market-data providers directly to retrieve price data (see section 4). Paper trading is fully simulated and involves no real money, no real orders, and no connection to a live brokerage account.

3. Why we process your data and our lawful basis

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms and only proceed where they are not overridden.

4. Sub-processors and third parties

We use a small number of carefully chosen service providers to run the Service. We do not sell your personal data, we run no advertising networks, and we set no advertising or cross-site tracking cookies.

Market-data providers are contacted directly by your browser to retrieve price data for charts; the requests they receive are subject to their own privacy terms. We share personal data with a provider only to the extent needed for the purpose above, under contractual confidentiality and security obligations.

5. International data transfers

Some of the providers above process data outside your country, and personal data of EU/UK individuals may reach our operations. Where personal data moves across borders, we put appropriate safeguards in place.

• Account and application data is stored with Supabase in region [ FILL IN: Supabase region ].
• Sri Lanka does not currently benefit from an EU adequacy decision. Where personal data protected by the EU/UK GDPR is transferred to us or to a provider in a country without an adequacy decision, we rely on an appropriate transfer safeguard, namely Standard Contractual Clauses (and the UK IDTA where relevant) (for example, EU Standard Contractual Clauses or the UK International Data Transfer Agreement), together with any supplementary measures required.
• For cross-border processing governed by the PDPA, we transfer personal data only where a lawful basis under the PDPA applies, such as adequate protection in the destination, appropriate safeguards, your consent, or another permitted ground.

You may contact us at [ FILL IN: privacy email ] to ask about the safeguards applied to a specific transfer.

6. How long we keep your data

• Account data (email, profile) and your journal/trade entries, and preferences — kept while your account is active. If you delete your account, or after a prolonged period of inactivity, we delete or anonymise this data within 30 days, except where we must retain limited records for legal, tax, or dispute-resolution purposes.
• Server and security logs — kept for a short period, normally up to 30 days, then deleted or aggregated, unless a specific log must be retained longer to investigate a security incident.
• The xbk-theme preference — stored in your own browser until you clear it or change your choice; we do not receive or retain a copy.
• Billing records (when paid plans launch) — retained for the period required by applicable tax and accounting law after the relevant transaction.

7. Your rights

Subject to the law that applies to you (including the PDPA and, where applicable, the EU/UK GDPR), you have the right to:

• Access the personal data we hold about you and obtain a copy;
• Rectify data that is inaccurate or incomplete;
• Erase your data ("right to be forgotten") where a legal ground applies;
• Portability — receive your data in a structured, commonly used, machine-readable format and, where feasible, have it transmitted to another controller;
• Object to processing based on our legitimate interests;
• Restrict processing in certain circumstances;
• Withdraw consent at any time where we rely on consent, without affecting processing already carried out;
• Complain to a supervisory authority — in Sri Lanka, the data-protection authority established under the PDPA; in the EU/UK, your local data-protection authority.

To exercise any of these rights, email [ FILL IN: privacy email ]. Many rights can also be exercised directly in the app: you can export your data and request deletion from your account settings. We will respond within the timeframe required by the applicable law (generally within one month under the GDPR) and may need to verify your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive.

8. Our commitments: we never sell your data; export and deletion

These are not just marketing statements — they are terms you can hold us to:

• We never sell your personal data, and we do not share it with advertisers or data brokers. We share it only with the sub-processors listed in section 4, for the stated purposes.
• You can export your data. Your journal, trade entries, trader profile, and preferences can be exported from within the app; if you need help, contact [ FILL IN: privacy email ].
• You can request deletion. You can delete your account and associated data from your account settings, or ask us to do it for you at [ FILL IN: privacy email ]. On deletion we remove or anonymise your data within the window stated in section 6.

9. How the "Try it live" demo works

On the marketing site, the "Try it live" demo does not load automatically. Nothing beyond the static page is loaded, and no third party is contacted, until you click "Load live demo". When you do, we embed the XBreakout app in an iframe. From that point the app behaves as described in this policy: it may set first-party storage for the app, and your browser will contact the market-data providers (Binance, Twelve Data) directly to draw charts. If you do not sign in, no account is created. Closing or not loading the demo means none of this occurs.

10. Children and minimum age

The Service is intended for adults. You must be at least 18 years old to create an account or use the Service. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact [ FILL IN: privacy email ] and we will delete it.

11. Security, breaches, and changes to this policy

We use reasonable technical and organisational measures appropriate to the risk, including HTTPS/TLS in transit (terminated by Caddy), access controls and authentication on our database, least-privilege access to systems, and reliance on established providers for authentication and hosting. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

If a personal-data breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority and, where required, affected individuals, within the timeframes set by applicable law (for example, without undue delay and within 72 hours of becoming aware, under the GDPR).

We may update this policy from time to time. The "Last updated" date at the top reflects the latest version. If we make material changes, we will take reasonable steps to notify you, for example by a notice on the site or app or by email to your account address. For disputes, you may use the local alternative dispute resolution bodies and data-protection authorities available in your jurisdiction.

This document was prepared as engineering and risk drafting and is not a signed legal opinion; we recommend it be reviewed by a qualified lawyer in the operator's jurisdiction before you rely on it.