Privacy

Privacy policy

This page explains what RiskBrake stores, why, for how long, and who else sees it. It is written for Article 13 GDPR. Last updated: 4 August 2026.

Controller

[DEIN NAME], [STRASSE HAUSNUMMER], [PLZ ORT], Germany · support@riskbrake.com
There is no data protection officer, as none is required for an operation of this size.

What we store

Account	Your email address, a salted hash of your password (PBKDF2-HMAC-SHA256, we never store the password itself), your API key and your sign-up date. Purpose: running your account. Legal basis: Art. 6(1)(b) GDPR, performance of a contract.
Your rules and locks	Your limits, your trading sessions, your trades, profit and loss, your trading account names as reported by ATAS, and any active lock. Purpose: this is the service itself, the lock cannot work without it. Legal basis: Art. 6(1)(b) GDPR.
Computer identifier	A one-way hash derived from your Windows installation ID and system drive. We never receive the raw values and cannot reverse the hash. Purpose: preventing a running lock from being bypassed by creating a second account. Legal basis: Art. 6(1)(f) GDPR, legitimate interest in an enforcement tool that actually enforces.
Technical data	IP address, page path and time spent on a page, your time zone offset, the version of the installed guardian and its last error message. Purpose: security, rate limiting against abuse, ending your lock at your local midnight, and support. Legal basis: Art. 6(1)(f) GDPR.
Journal screenshots	If you use the journal with auto screenshots (on by default, can be switched off in the RiskBrake strategy settings inside ATAS), the guardian captures images of your ATAS windows only, never your full screen or other programs, at the moment you enter and exit a trade, and uploads them to your journal. These images can show whatever your ATAS windows show, including account balances and positions. Only you can see them after logging in, you can delete any image individually in the trade view, and we keep at most the 300 most recent images per account, older ones are deleted automatically. Purpose: your own trade journal. Legal basis: Art. 6(1)(b) GDPR; you control the feature entirely.
Messages	Anything you send us through the contact form or by email, so we can answer. Legal basis: Art. 6(1)(b) and (f) GDPR.

What we do not do

No advertising, no advertising cookies, no analytics services, no tracking pixels, no profiling, no automated decision-making with legal effect, and no selling or sharing of your data with anyone for their own purposes. We never see your broker password and we cannot place trades. RiskBrake only ever sends close orders through your own platform.

Cookies

One single cookie, named sid. It keeps you logged in and is strictly necessary for the service, so it needs no consent banner. It contains a random session token, nothing else. Deleting it logs you out.

Who else processes your data

Railway	Hosting of the application and the database. Railway Corporation, USA. Data may therefore be processed outside the EU, on the basis of the EU standard contractual clauses.
Brevo	Sending transactional email, for example your verification link and important notices about your protection. Brevo SA, France, inside the EU.
Cloudflare	Domain routing and protection against attacks. Cloudflare Inc., USA, on the basis of the EU standard contractual clauses.

Each of them acts as a processor under Art. 28 GDPR and only on our instructions.

How long we keep it

Account data for as long as your account exists. Trades and locks for the current period plus a short history so you can see your own record. Technical logs are shortened automatically and are not kept as a long-term archive. Delete your account and we delete the personal data belonging to it, unless a legal retention duty applies.

Your rights

You may request access, correction, deletion, restriction of processing, and a copy of your data in a portable format. You may object to processing based on legitimate interest. You may withdraw consent at any time where processing is based on it. Write to support@riskbrake.com and we will answer within one month. You also have the right to complain to a supervisory authority, for example the data protection authority of your federal state.

One thing worth knowing

RiskBrake is built so that a lock cannot be removed on your own machine. That means some of your data, in particular an active lock, deliberately survives a reinstall and a new sign-up on the same computer. That is not a bug, it is the entire point of the product, and it is why the computer identifier exists. If you want to stop using RiskBrake, the dashboard has a proper way out that unlocks the next morning.