The short version
- If you never sign in, we store nothing about you on our servers beyond ordinary web-server log lines. Your charts, watchlist, drawings and simulated trading account live in your own browser.
- If you sign in, we store your email address, and — if you used Google — your display name and the web address of your Google profile picture. Nothing else about you.
- Your simulated account never leaves your browser. Your balance, your positions and your trade journal are not on our servers at all.
- We do not sell your data, share it for advertising, or use it to train any model.
- There is no delete button yet. Deleting an account is done by hand, when you email us. See section 10.
- Google Analytics runs on the site. These two legal pages do not load it — you can check in your browser's network tab.
01 Who runs this
FreeBacktest is a small independent project, not a company with a privacy department. It runs on a single rented server at Amazon Web Services in Frankfurt, Germany (region eu-central-1). One person has access to that server.
For anything on this page — a copy of your data, a deletion, or a question — write to privacy@freebacktest.app.
02 If you never sign in
You can use the whole product without an account. If you do, the only record of you on our servers is in the server logs described in section 5.
Everything you do is kept in your own browser, in localStorage, sessionStorage and IndexedDB. We cannot read any of it. It includes:
- your simulated trading account — balance, open positions, pending orders and the trade journal;
- your watchlist, chart layout, timeframes, colours and panel positions;
- drawings you place on charts, and their undo/redo history;
- your light/dark choice, and a note that this browser has visited before;
- a cache of the price candles you have already looked at, so the charts do not re-download them. That cache holds public market data only — no information about you.
Clearing your browser's site data for freebacktest.app erases all of it, permanently, and we are not involved. Nothing there is backed up anywhere.
After about fifteen minutes of use, the app may show a panel inviting you to sign in. You can dismiss it and keep going.
03 If you sign in
There are two ways in, and neither uses a password. We never store a password, because we never accept one.
With Google
Google confirms to us who you are. We keep the email address on that Google account, your display name and the web address of your Google profile picture — the address, not a copy of the image; your browser fetches the picture from Google when it shows it. We do not receive or store anything else from your Google account, and we never gain access to it.
With an email code
You give an address, we email a six-digit code. We store the address and a one-way hash of the code, never the code itself. The code is valid for ten minutes and dies after five wrong guesses. It is deleted the moment it is used. If you request a code and never use it, that row is not currently removed automatically — it holds your address and the hash, nothing else.
To limit abuse, we allow three code requests per address per hour and ten per IP address per hour.
What the account record contains
An internal identifier, your email address, your display name and profile-picture address if Google supplied them, which sign-in method you used, when the account was created, and when it was last used. That is the whole record.
04 What you create that reaches our server
Signed in, two kinds of your own content are stored server-side so they follow you between devices:
- Chart drawings, attached to your account, plus up to fifty undo/redo snapshots per chart.
- Rooms you create or join — the room's saved document (its chart, drawings and shared trades) and a record of which rooms you have visited.
Signed out, drawings are written to your browser instead and are never uploaded. Every write route on our server refuses an anonymous request.
What never reaches our server, signed in or out: your simulated balance, your positions, your closed trades and your journal, unless you deliberately take those trades inside a shared room. See section 7.
05 Server logs
The web server keeps a standard access log. For every request it records your IP address, the time, the address requested, the response status and size, the page you came from, and your browser's user-agent string. It does not record the body of a request, so login codes never appear in it, and your session token is deliberately kept out of web addresses so it cannot end up in a log line either.
One thing does end up there, and you should know it: the app asks for prices by putting the symbols in the address. That means your watchlist — which coins you follow — appears in the log next to your IP address, refreshed every few seconds while the tab is open. It is not linked to your account, and it ages out with the rest of the log, but it is not nothing.
These logs rotate daily and fourteen older files are kept, so a given line is deleted after roughly two weeks.
The application's own log records room identifiers, sizes and errors. We checked every line it can print: it contains no names, no email addresses and no tokens. It is capped by size rather than age and currently holds about three weeks.
06 Analytics and cookies
We use Google Analytics 4 to count visits and see which parts of the product get used. Measurement is configured in Google's console and currently reports to two Analytics properties.
Analytics sets cookies in your browser named _ga and _ga_… These hold a random identifier for your browser. There is no cookie banner: they are set as soon as a page loads, without asking you. If you would rather they were not, block them with a browser setting or an extension — the product works normally without them.
Google Analytics automatically collects the page address and title, your screen size, language, browser and platform version, and derives an approximate location from your IP address. That is Google's behaviour, not something we send.
What we send is deliberately narrow. The app reports nine events — opening the app, using a backtest, seeing the sign-up panel, attempting and completing a sign-in, requesting an email code, creating and joining a room. Each may carry values from a fixed list of eight labels, and every value must be a short lowercase word matching the pattern ^[a-z0-9_]{1,24}$. An email address, a display name, a room identifier, a session token and even a symbol like BTCUSDT all fail that test and are dropped before anything is sent. This is enforced in code and covered by an automated test.
The landing page and its demo also report a handful of interface events — which theme you picked, whether you closed the demo and how many practice trades it played. These are fixed words and counters.
This page and the Terms page do not load Google Analytics at all.
Our own server sets no cookies. Your session is kept in browser storage instead.
07 Rooms — what other people can see
A room is the one place where your activity is deliberately shown to other people. If you open or join one:
- Your display name is shown to everyone in the room. If your account has no display name, your email address is shown instead.
- Trades you take while in the room are shared live — symbol, direction, size, entry and exit price and time, and profit or loss. Your account balance is not shared.
- Drawings and the chart position are shared.
- Leaving removes your pending orders from the room. Trades you closed there stay in the room's journal.
A room link is effectively a public address. Anyone holding it can read that room's chart and drawings without an account, and can keep doing so after the room is closed. Joining the live room also shows them the participants and the shared trades. Only the host can delete a room. Treat a room link the way you would treat a public page.
Guests without an account can watch a room they were invited to. We record no visit for them.
08 Who else receives data
This is the complete list. It is not just a promise: every page carries a Content-Security-Policy naming the only outside hosts your browser is permitted to contact, and the browser itself blocks anything else. Adding a new recipient would mean changing that policy.
| Who | What they get, and when |
|---|---|
| Google Analytics | Your IP address, browser and the page you are on — on every page of this site except this one and the Terms page. |
| Google Sign-In | Loaded on the app on every visit, before you do anything, so Google is contacted whether or not you ever sign in. It sets a cookie recording that you dismissed its prompt. |
| Google Fonts | Your IP address and browser, on every page including this one, to serve the two typefaces. |
| Google user content | Your Google profile picture, fetched by your browser, if you signed in with Google. |
| Resend | Your email address and the six-digit code, when you ask for an email login code. Sent from our server, not your browser. We do not control how long Resend keeps its own sending records. |
| Amazon Web Services | Hosting. The server and the database sit on their infrastructure in Frankfurt. |
| A payment processor | Only if you buy a paid plan, and only from the day the checkout opens — there is none today. It acts as the merchant of record, which means it is the seller of record: it collects your name, email and billing address and handles your card directly. We never see or store card details. It is named at checkout before you pay anything. |
Nobody else. We do not sell data, we do not share it with advertisers or data brokers, and we do not use it to train any model. If we are ever legally compelled to hand something over, we will say so here unless we are forbidden to.
09 How long things are kept
| What | Kept for |
|---|---|
| Your account record | Until you ask us to delete it. There is no automatic expiry. |
| Email login codes | Ten minutes, and deleted the moment one is used. An unused one is not swept automatically. |
| Drawings and their undo history | Until you delete them. Undo history is capped at fifty steps per chart. |
| Rooms | Until the host deletes them. Closing a room does not always remove it — a closed room's chart and drawings are normally kept so its link still works, indefinitely. Only deleting it removes the contents. |
| Web-server access logs | About fifteen days. |
| Application logs | About three weeks, by size. |
| Database backups | Seven days. This is why deleted data can survive up to about a week longer. |
| Old migration snapshot | One full copy of the database taken during a server move on 30 July 2026 is still stored on the server and has no deletion date set. |
| Payment and invoice records | Held by the payment processor, not by us, for as long as tax law obliges it to keep them — typically several years, and outside our control because it is the seller of record. On our side we store only which plan an account has and when it expires. Nothing here exists yet: no payment has ever been taken. |
10 Getting your data out, or deleted
There is no delete-my-account button and no download-my-data button. We would rather tell you that than imply a feature we have not built. Both are done by hand:
Email privacy@freebacktest.app from the address on the account, saying whether you want a copy of your data or a deletion. We use the sending address to confirm the request is yours. We aim to act within 30 days and will confirm when it is done.
Deleting your account removes the account record and, with it, your drawings, your undo history, the rooms you host and the record of rooms you visited. Three things survive it, and you should know which:
- Backups, for up to about a week afterwards.
- Trades and drawings you contributed to someone else's room, which belong to that room and stay in it.
- Web-server log lines, which age out on their own within about fifteen days.
Some things you can do yourself, right now, without asking anyone:
- Delete individual drawings, delete rooms you host, and remove rooms from your visited list, inside the app.
- Sign out. This invalidates your session on every device at once, not just the one you are on.
- Clear your browser's site data. Everything described in section 2 disappears with it.
11 Security, honestly
What is true:
- Everything between your browser and us travels over TLS, with a certificate from Let's Encrypt. A plain unencrypted request is redirected to the encrypted one before anything is served.
- The database accepts connections only from the server itself. It is not exposed to the internet.
- Login codes are stored as one-way hashes. Passwords do not exist here.
- Signing out invalidates every session token issued to your account.
What is also true, and you should weigh it:
- We do not encrypt individual records in the database on top of the encryption in transit. Anyone with access to the server can read them.
- Your session lasts 30 days and is stored in your browser, where any script running on this site could in principle read it. We cannot currently revoke one leaked session on its own — signing out revokes all of them, which is the remedy if you are worried.
- This is one server run by one person. It is maintained carefully, but it does not have the staff or the certifications of a large provider.
12 Children
There is no age check anywhere in the product, and we would rather not pretend otherwise. The service is not intended for children, and we do not knowingly keep data about them. If you believe a child's data is here, email us and we will remove it.
13 Changes
If this page changes, the date at the top changes with it. We do not keep a version history, so if a detail matters to you, save a copy.