Trust

Security & your data

How your journal is protected, where it lives, how long it is kept, the controls you have — and what is not true yet. Last reviewed 13 November 2026.

How your account is protected

Sign-in is handled by Supabase Auth: passwords are stored only as salted hashes, never in plain text, and one-time email codes, Google and Apple sign-in never give us a password at all.
New accounts pass a Cloudflare Turnstile check, so automated sign-ups are stopped before they reach the journal.
Every trade row is guarded in the database itself by row-level security: a signed-in account can read and change only its own rows. A bug in a page cannot show your trades to anyone else.
Payments are confirmed server-side by our own Cloudflare Worker against the payment provider's record. Payment keys live only as Worker secrets, never in a page script.
No advertising, analytics or tracking scripts run on journzen.com. The pages load first-party code only.

Your trades, playbooks and settings are stored in Journzen's Supabase project (managed Postgres). Screenshots you attach are stored in its file storage, in a folder for your account.
Cloudflare serves the site and runs the payment and mentor checks.
Market candles for charts come from Deriv's public market feed and are not stored with your account.
Ask your journal — your AI mentor computes every answer in your browser from your own trades. For Pro accounts, the mentor's written read sends only those computed figures (never your trade rows, email or account id) to our AI model provider, and any reply carrying a number your figures do not is discarded before you see it.

Your trades and screenshots stay until you delete them, or delete your account.
A deleted trade or account is removed from the live database at once. Copies can remain in our database host's encrypted backups until those backups expire on their normal schedule.
Payment receipts — the payment reference, amount, currency, date and the email the Pro time went to — are kept for accounting and refunds, including after an account is deleted.

Download all my data (Account → Your data): one file with your account details, every trade, your playbooks and settings, your subscription and payment claims, your terms acceptance, your mentor share links and links to your screenshots. Free on every plan.
Export trades as CSV for spreadsheets (Pro).
Delete my account (Account, at the bottom): self-serve and immediate. It erases your screenshots, trades, playbooks, share links, coach usage, payment claims, subscription, terms record and your sign-in. Only the payment receipts above are kept.

Journzen has not had a third-party security audit or penetration test, and holds no security certification (such as SOC 2 or ISO 27001). If that changes, the report will be linked here.
Two-factor authentication beyond email codes and Google or Apple sign-in is not offered yet.

Write to support@journzen.com with “Security” in the subject. Please give us a chance to fix it before you share details publicly.