The short version
- If you never sign in, we store nothing about you on our servers beyond ordinary web-server log lines. Your charts, watchlist, drawings and simulated trading account live in your own browser.
- If you sign in, we store your email address, and — if you used Google — your display name and the web address of your Google profile picture. Nothing else about you.
- Your simulated account never leaves your browser. Your balance, your positions and your closed trades are not on our servers at all.
- We do not sell your data, share it for advertising, or use it to train any model.
- You can delete your account yourself, from the account menu in the app, or ask us by email. See section 10.
- Nothing optional runs until you say so. Google Analytics, the recording that comes with crash reports and Google's one-tap sign-in prompt start only if you click Allow in the cookie panel. The legal pages never load Analytics at all — you can check in your browser's network tab.
01 Who runs this
FreeBacktest is a small independent project, not a company with a privacy department. It runs on a single rented server at Netcup in Germany, and copies of its database backups are kept off that server with Cloudflare R2 (sections 8 and 9). One person has access to both. The fonts on this site are served from that same server, not from Google.
For anything on this page — a copy of your data, a deletion, or a question — write to privacy@freebacktest.app.
02 If you never sign in
You can use the whole product without an account. If you do, the only record of you on our servers is in the server logs described in section 5.
Everything you do is kept in your own browser, in localStorage, sessionStorage and IndexedDB. We cannot read any of it. It includes:
- your simulated trading account — balance, open positions, pending orders and the trade journal;
- your watchlist, chart layout, timeframes, colours and panel positions;
- drawings you place on charts, and their undo/redo history;
- your light/dark choice, and a note that this browser has visited before;
- a cache of the price candles you have already looked at, so the charts do not re-download them. That cache holds public market data only — no information about you.
Clearing your browser's site data for freebacktest.app erases all of it, permanently, and we are not involved. Nothing there is backed up anywhere.
After about fifteen minutes of use, the app may show a panel inviting you to sign in. You can dismiss it and keep going.
03 If you sign in
You sign in with Google. We never store a password, because we never accept one.
With Google
Google confirms to us who you are. We keep the email address on that Google account, your display name and the web address of your Google profile picture — the address, not a copy of the image; your browser fetches the picture from Google when it shows it. We do not receive or store anything else from your Google account, and we never gain access to it.
With an email code (accounts from before 20 September 2026)
Until 20 September 2026 the app also offered a six-digit email code, and it no longer does. If that address has a Google account, signing in with Google opens the same account; if it does not, write to hello@freebacktest.app. The records those sign-ins left are described here. You gave an address, we emailed a six-digit code. We store the address and a one-way hash of the code, never the code itself. The code is valid for ten minutes and dies after five wrong guesses. It is deleted the moment it is used. If you request a code and never use it, that row is not currently removed automatically — it holds your address and the hash, nothing else.
To limit abuse, we allow three code requests per address per hour and ten per IP address per hour.
What the account record contains
An internal identifier, your email address, your display name and profile-picture address if Google supplied them, which sign-in method you used, when the account was created, and when it was last used. That is the whole record.
04 What you create that reaches our server
Signed in, these kinds of your own content are stored server-side so they follow you between devices:
- Chart drawings, attached to your account, plus up to fifty undo/redo snapshots per chart.
- Your watchlists — the lists, their groups and the coins in them, so they follow you to another computer. When you sign out, this browser goes back to the default list.
- Trade notes — what you write in the Trading Diary about a trade: the note, its tags, and the names of your diaries and categories. The trade itself is not uploaded; each note carries only the trade's id.
- "Notify me" requests — if you ask to be told when a paid plan opens: which plan, which screen you asked from, and when. It is used to send you that one email and for nothing else.
- Rooms you create or join — the room's saved document (its chart, drawings and shared trades) and a record of which rooms you have visited.
Signed out, drawings are written to your browser instead and are never uploaded. Every write route on our server refuses an anonymous request.
What never reaches our server, signed in or out: your simulated balance, your positions and your closed trades, unless you deliberately take those trades inside a shared room. See section 7.
05 Server logs
The web server keeps a standard access log. For every request it records your IP address, the time, the address requested, the response status and size, the page you came from, and your browser's user-agent string. It does not record the body of a request, so login codes never appear in it, and your session token is deliberately kept out of web addresses so it cannot end up in a log line either.
One thing does end up there, and you should know it: the app asks for prices by putting the symbols in the address. That means your watchlist — which coins you follow — appears in the log next to your IP address, refreshed every few seconds while the tab is open. It is not linked to your account, and it ages out with the rest of the log, but it is not nothing.
These logs rotate daily and fourteen older files are kept, so a given line is deleted after roughly two weeks.
The application's own log records room identifiers, sizes and errors. We checked every line it can print: it contains no names, no email addresses and no tokens. It is capped by size rather than age and currently holds about three weeks.
06 Analytics and cookies
We use Google Analytics 4 to count visits and see which parts of the product get used — only if you allow it. Measurement is configured in Google's console and currently reports to two Analytics properties.
The first time you visit, a small panel asks. Until you click Allow, Analytics is not loaded at all: no request goes to Google and no Analytics cookie is set. Declining is exactly as easy as allowing, and the product works the same either way. If you allow it, Analytics sets cookies named _ga and _ga_…, which hold a random identifier for your browser.
You can change your mind at any time: Cookie settings is in the footer of every page and in the app's settings panel. Withdrawing deletes those cookies and reloads the page, so nothing that was already running keeps running.
Google Analytics automatically collects the page address and title, your screen size, language, browser and platform version, and derives an approximate location from your IP address. That is Google's behaviour, not something we send.
What we send is deliberately narrow. The app reports nine events — opening the app, using a backtest, seeing the sign-up panel, attempting and completing a sign-in, requesting an email code, creating and joining a room. Each may carry values from a fixed list of eight labels, and every value must be a short lowercase word matching the pattern ^[a-z0-9_]{1,24}$. An email address, a display name, a room identifier, a session token and even a symbol like BTCUSDT all fail that test and are dropped before anything is sent. This is enforced in code and covered by an automated test.
The landing page and its demo also report a handful of interface events — which theme you picked, whether you closed the demo and how many practice trades it played. These are fixed words and counters.
Separately from analytics, the app sends crash reports to Sentry when something breaks — described in full in section 08. The error report itself is sent whatever you choose: it stores nothing on your device and it is how a broken page gets fixed. The recording that can accompany it is made only if you clicked Allow. The same rule applies there: what may leave your browser is decided by code, not by us remembering, and it is covered by automated tests that feed it a real diary note, a real email address and a real sign-in token and check that none of them come out.
The legal pages — this one, Terms, Refunds, Contact and Open source — load neither Google Analytics nor crash reporting, whatever you choose.
Our own server sets no cookies. Your session is kept in browser storage instead, and so is your cookie choice, under the name fb-consent.
07 Rooms — what other people can see
A room is the one place where your activity is deliberately shown to other people. If you open or join one:
- Your display name is shown to everyone in the room. If your account has no display name, your email address is shown instead.
- Trades you take while in the room are shared live — symbol, direction, size, entry and exit price and time, and profit or loss. Your account balance is not shared.
- Drawings and the chart position are shared.
- Leaving removes your pending orders from the room. Trades you closed there stay in the room's journal.
A room link is effectively a public address. Anyone holding it can read that room's chart and drawings without an account, and can keep doing so after the room is closed. Joining the live room also shows them the participants and the shared trades. Only the host can delete a room. Treat a room link the way you would treat a public page.
Guests without an account can watch a room they were invited to. We record no visit for them.
08 Who else receives data
This is the complete list. It is not just a promise: every page carries a Content-Security-Policy naming the only outside hosts your browser is permitted to contact, and the browser itself blocks anything else. Adding a new recipient would mean changing that policy.
| Who | What they get, and when |
|---|---|
| Google Analytics | Only if you allowed it in the cookie panel: your IP address, browser and the page you are on — on the landing page, the learn pages and the app. Never on the legal pages. |
| Google Sign-In | When you click Sign in, the app loads Google's sign-in script and Google sees your IP address and browser. If you allowed it in the cookie panel, the app may also offer Google's one-tap suggestion on its own; without that permission it never does. Google may set a cookie recording that you dismissed its prompt. |
| Google user content | Your Google profile picture, fetched by your browser, if you signed in with Google. |
| Resend | Your email address and the six-digit code, when you ask for an email login code. Sent from our server, not your browser. We do not control how long Resend keeps its own sending records. |
| Netcup | Hosting. The server and the database run on a rented server in Germany. |
| Cloudflare R2 | Copies of our database backups — account records, drawings and their history, rooms, watchlists and diary notes — stored off the server so the site can be restored after a failure. Kept for thirty days (section 9). |
| Amazon Web Services | Our previous host. The old server is still switched on as a fallback and holds a full copy of the database as it was on 14 September 2026, plus one snapshot of the database from 30 July 2026 — see section 9. Nothing new is sent there. |
| Sentry | Crash reports from the app at /app — not from this page or the Terms page. When something breaks we send the error and where in the code it happened, and — only if you allowed it in the cookie panel — a recording of what the page looked like in the seconds before. The recording is masked: all text, every input and all images are replaced with blocks before it leaves your browser, and the labels of the buttons you click are stripped out too, so your diary notes, your email address and your trades are not in it. We strip the web address, the request body and your sign-in token as well. Servers are in the EU (Germany). Nothing is sent unless something actually goes wrong. |
| A payment processor | Only if you buy a paid plan, and only from the day the checkout opens — there is none today. It acts as the merchant of record, which means it is the seller of record: it collects your name, email and billing address and handles your card directly. We never see or store card details. It is named at checkout before you pay anything. |
Some of these providers are outside the EU. Where that is the case, the transfer relies on the safeguards that provider offers: the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
Nobody else. We do not sell data, we do not share it with advertisers or data brokers, and we do not use it to train any model. If we are ever legally compelled to hand something over, we will say so here unless we are forbidden to.
09 How long things are kept
| What | Kept for |
|---|---|
| Your account record | Until you ask us to delete it. There is no automatic expiry. |
| Email login codes | Ten minutes, and deleted the moment one is used. An unused one is not swept automatically. |
| Drawings and their undo history | Until you delete them. Undo history is capped at fifty steps per chart. |
| Trade notes | Until you delete them or your account. |
| Watchlists | Until you change them or delete your account. |
| "Notify me" requests | Until you delete your account. We mark the request when the email is sent, so it is sent once. |
| Rooms | Until the host deletes them. Closing a room does not always remove it — a closed room's chart and drawings are normally kept so its link still works, indefinitely. Only deleting it removes the contents. |
| Web-server access logs | About fifteen days. |
| Application logs | About three weeks, by size. |
| Database backups | Seven days on the server, and thirty days for the copies kept with Cloudflare R2. This is why deleted data can survive in backups for up to about a month. |
| Copies left from changing servers | Three copies of the database made when the site moved servers are still kept: the old server at our previous host (Amazon Web Services, Frankfurt), switched on as a fallback, with the database as it was on 14 September 2026; a snapshot there from 30 July 2026; and the transfer file from 14 September 2026 on the current server. All three will be deleted by 31 December 2026 at the latest; the old server is to be switched off sooner, now that the market data has its own off-site copy. Until then, accounts deleted after those dates can still be in them. |
| Crash reports and their recordings | Ninety days, then deleted by Sentry. That is longer than our own web-server logs are kept, and it is their schedule rather than ours. |
| Payment and invoice records | Held by the payment processor, not by us, for as long as tax law obliges it to keep them — typically several years, and outside our control because it is the seller of record. On our side we store only which plan an account has and when it expires. Nothing here exists yet: no payment has ever been taken. |
10 Getting your data out, or deleted
There is a download-my-data button. Sign in, open the account menu, and choose Download my data. It gives you a JSON file of everything this service holds for your account — your drawings, your undo history, your diary, your watchlists, your subscription state, any "Notify me" requests, and the record of which rooms you hosted or visited.
It does not include the contents of rooms you shared with other people. A room's document is written by everyone in it and cannot be split back apart without handing you somebody else's work; what you get instead is the fact that you were there.
You can delete your account yourself. Sign in, open the account menu and choose Delete my account: it shows what will be removed and asks you to type DELETE, so it cannot happen by accident. If you would rather, email privacy@freebacktest.app from the address on the account — we use the sending address to confirm the request is yours, aim to act within 30 days and will confirm when it is done.
Deleting your account removes the account record and, with it, your drawings, your undo history, your diary, your watchlists, any "Notify me" requests, the rooms you host and the record of rooms you visited. Three things survive it, and you should know which:
- Backups, for up to about a month afterwards (seven days on the server, thirty in the off-site copies), and the copies left from changing servers described in section 9 until they are deleted.
- Trades and drawings you contributed to someone else's room, which belong to that room and stay in it.
- Web-server log lines, which age out on their own within about fifteen days.
Some things you can do yourself, right now, without asking anyone:
- Delete individual drawings, delete rooms you host, and remove rooms from your visited list, inside the app.
- Sign out. This invalidates your session on every device at once, not just the one you are on.
- Clear your browser's site data. Everything described in section 2 disappears with it.
11 Security, honestly
What is true:
- Everything between your browser and us travels over TLS, with a certificate from Let's Encrypt. A plain unencrypted request is redirected to the encrypted one before anything is served.
- The database accepts connections only from the server itself. It is not exposed to the internet.
- Login codes are stored as one-way hashes. Passwords do not exist here.
- Signing out invalidates every session token issued to your account.
What is also true, and you should weigh it:
- We do not encrypt individual records in the database on top of the encryption in transit. Anyone with access to the server can read them.
- Your session lasts 30 days and is stored in your browser, where any script running on this site could in principle read it. We cannot currently revoke one leaked session on its own — signing out revokes all of them, which is the remedy if you are worried.
- This is one server run by one person. It is maintained carefully, but it does not have the staff or the certifications of a large provider.
12 Children
There is no age check anywhere in the product, and we would rather not pretend otherwise. The service is not intended for children, and we do not knowingly keep data about them. If you believe a child's data is here, email us and we will remove it.
13 Changes
If this page changes, the date at the top changes with it. We do not keep a version history, so if a detail matters to you, save a copy.