Cookie Policy

Strictly necessary

• Firebase Authentication — session tokens managed by Firebase; required to sign in.
• __tradax_session — httpOnly cookie set after login so protected app pages cannot be opened without authentication.
• Workspace localStorage — mirrors journal trades, settings, playbooks, and recent AI Analyst sessions for speed. Large chart image data URLs are kept only for the most recent few sessions; older sessions stub heavy attachments. Not used for access control.
• Error monitoring (Sentry) — when configured, the client SDK loads only after you choose Essential or Accept analytics. It reports technical faults; request bodies, cookies, and email are stripped before send. Server-side monitoring (if configured) runs on our infrastructure.

[INTERNAL REVIEW] Whether every item above is “strictly necessary” under ePrivacy should be confirmed with counsel for your launch markets.

Optional — product analytics

Product analytics is granted when you create an account and check the age / Terms checkbox (which discloses analytics), or when you choose Accept analytics on the cookie banner. We then record first-party session events (pages visited, feature usage counts) sent to our servers and stored in Firestore under your account. Ingest requires a signed-in user whose server-stored preference (users/…/legal/cookieConsent) allows analytics. Client headers alone cannot grant consent. We do not load Google Analytics, Meta Pixel, or third-party ad trackers.

A local hint is also stored as tradax-cookie-consent-v1 in localStorage for the banner UI. When you are signed in, we sync the preference to your account. Change anytime:

Cookie preferences

Other local / session storage

• Onboarding tour progress (sessionStorage)
• Deploy version check (localStorage) — refreshes UI after releases
• Entitlements cache (sessionStorage) — UI display only; paid features are enforced on the server
• Analytics session id (sessionStorage) — only used when analytics consent is active

Internal creator-ops / admin tools use a short-lived HttpOnly ops session cookie after a one-time secret unlock; the long-lived admin secret is not stored in sessionStorage.

Contact

Questions: support@tradaxlab.com or Contact.