How we collect, use, and protect your information across tilorah.co and intent: trade.
Plain-English summary. We collect what we need to run our products and public website. Your trade data is yours. We don't sell personal information and we don't use advertising trackers. For AI features, our policy is to use commercial provider settings/contracts that do not permit provider model training on your submitted content; the exact handling must match the active vendor contract and account configuration.
Tilorah is an independent product studio operated by TILORAH CORE LLC, a Florida limited liability company ("Tilorah", "we", "us"). We are the data controller for personal information processed through tilorah.co and intent: trade.
For privacy questions, contact hello@tilorah.co.
This Policy covers tilorah.co and the current public Tilorah service, including intent: trade the intent: trade app distributed via web, Apple App Store, and Google Play. Our Terms of Service govern your use of these services. Internal, local-only, draft, paused, or personal projects are outside this public customer-facing Policy unless Tilorah later publishes them under a separate notice.
| Property | Privacy position | Processors / responsibility |
|---|---|---|
| tilorah.co public pages | Public website pages may generate hosting/server logs such as IP address, request time, requested URL, referrer, and user agent. At this time, we do not use analytics cookies, advertising cookies, or cross-site tracking cookies on public Tilorah pages. | Hosting/CDN providers may process server logs for security, delivery, abuse prevention, and diagnostics. Some pages load Google Fonts, which causes your browser to request font assets from Google. |
| intent: trade | Cloud service controlled by Tilorah. We process account data, trade journal content, chart images, settings, subscription status, diagnostics, server logs, and optional AI/OCR requests to provide the service. | Processors include Supabase for hosting/auth/database/edge functions, AI providers only when you trigger AI/OCR, app stores/payment providers for purchases, and email providers for account/support messages. Retention, deletion/export, AI processing, and no-ad-tracking commitments are described below. |
Other internal, local-only, draft, or paused Tilorah tools are outside this public customer-facing Policy unless we later publish a product-specific privacy notice for them.
| Category | Examples | Where |
|---|---|---|
| Account info | Email address, password (hashed), display name (optional) | intent: trade sign-up |
| Profile / preferences | Time zone, currency, default lot size, theme | App settings |
| Trade entries | Symbol, direction, entry/exit, P/L, notes, tags, dates | Logged by you in-app |
| Uploaded images | Chart screenshots, broker statement screenshots | Attached to trade entries / submitted to OCR / AI features |
| Communications | Email content, support requests, feedback | When you email hello@tilorah.co |
| Payment info | Subscription status, transaction ID, plan tier | Via Apple, Google, or our payment processor — we do not store card numbers |
| Category | Examples | Source |
|---|---|---|
| Identifiers | User ID (UUID), session token | Generated on sign-up |
| Device / app info | OS version, app version, language, locale, device model | App runtime |
| Diagnostics | Crash logs, error traces (no trade data attached) | App runtime |
| Usage | Feature interactions (e.g. opened OCR, ran analysis), aggregated counts | App runtime |
| Server logs | IP address, request timestamps, requested URL, referrer, user agent | Public website hosting, CDN, backend, and Supabase |
| Purpose | What we use |
|---|---|
| Provide the Service (account, sync, journal) | Account info, trade entries, uploaded images, identifiers |
| Run the AI features you trigger | The specific image or text you submit |
| Process payments and manage subscriptions | Payment info, account info |
| Customer support | Communications, account info, diagnostics |
| Security, fraud prevention, abuse detection | Server logs, identifiers, device info |
| Improve product reliability | Diagnostics, aggregated usage |
| Comply with legal obligations | Whatever is necessary |
We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use your trade entries or screenshots to train third-party AI models.
If you are in the EU, UK, or other GDPR/UK GDPR jurisdictions, we rely on the following lawful bases under Article 6:
We share personal information only with the service providers we need to run the product. They process data on our instructions under written agreements.
| Provider | Role | Data shared | Region |
|---|---|---|---|
| Supabase | Hosting, authentication, database, file storage, edge functions | All account and product data | US / EU (configurable) |
| Anthropic, PBC (default when configured) | Chart analysis and OCR via Claude models | The image and prompt you submit when you trigger AI features. Training, logging, and retention commitments must match the active Anthropic contract, plan, and account settings. | US / as configured |
| Google LLC (alternate when configured) | Chart analysis and OCR via Gemini models | The image and prompt you submit when you trigger AI features. Training, logging, and retention commitments must match the active Google API contract, plan, and account settings. | US / as configured |
| OpenAI, L.L.C. (alternate when configured) | Chart analysis and OCR via GPT-class models | The image and prompt you submit when you trigger AI features. Training, logging, and retention commitments must match the active OpenAI API contract, project settings, and data controls. | US / as configured |
| Apple | App distribution, in-app purchases, App Store receipts | Subscription status, transaction IDs | Per Apple |
| App distribution, in-app billing | Subscription status, transaction IDs | Per Google | |
| Email provider (transactional) | Sending verification, password reset, receipt emails | Email address, message content | US / EU |
We may also disclose data when required by law, court order, or to protect the rights, property, or safety of Tilorah, our users, or others.
If Tilorah is involved in a merger, acquisition, or asset sale, personal information may be transferred to the successor entity, subject to this Policy.
intent: trade includes optional AI features (chart analysis, trade-entry OCR). When you trigger one of these:
AI is not advice. AI output may be wrong. Treat it as a starting point, not a recommendation. See our Terms of Service for the full disclaimer.
| Data | Retention |
|---|---|
| Active account data | Until you delete your account or request deletion |
| Backups | Up to 30 days after deletion |
| Server logs | Up to 90 days |
| Crash diagnostics | Up to 90 days |
| Billing / tax records | As required by Thai law and other applicable tax law (typically up to 7 years) |
| Support emails | Up to 24 months unless you ask us to delete sooner |
No system is perfectly secure. If we discover a breach affecting your data, we will notify you and the relevant authorities as required by law.
Tilorah operates from Thailand. Our service providers may process data in the United States, the European Union, and other regions. When personal data of EU/UK residents is transferred outside the EEA/UK, we rely on:
If you are in Thailand, the Personal Data Protection Act B.E. 2562 (2019) ("PDPA") gives you the following rights as a data subject:
To exercise these rights, email hello@tilorah.co with subject "PDPA Privacy Request". We will respond within 30 days.
If you are in the EU, UK, or another jurisdiction with similar law, you have the right to:
To exercise any of these rights, email hello@tilorah.co. We will respond within 30 days.
If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act give you the right to:
To submit a request, email hello@tilorah.co with subject "California Privacy Request". We may need to verify your identity before fulfilling the request. You may also designate an authorized agent to make a request on your behalf.
We do not knowingly collect "sensitive personal information" as defined by CPRA in any category that would trigger the right to limit, beyond credentials used to access your account. We do not use this data for inference about characteristics.
Our Services are not directed to children under 16. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact hello@tilorah.co and we will delete it.
For intent: trade, the data types we declare to Apple, the purposes, and whether linked to your identity:
| Data type | Purpose | Linked to you | Used for tracking |
|---|---|---|---|
| Email address | App functionality, account management | Yes | No |
| Name (optional) | App functionality | Yes | No |
| User ID | App functionality | Yes | No |
| Purchase history | App functionality, subscription management | Yes | No |
| User content (trade entries, photos) | App functionality (the journal itself) | Yes | No |
| Diagnostics (crash data, performance) | App functionality | No | No |
| Usage data (product interactions) | Analytics (aggregated only) | No | No |
We do not use any data for tracking across apps and websites owned by other companies.
| Data type | Collected | Shared | Purpose |
|---|---|---|---|
| Email address | Yes | No | Account management, app functionality |
| Name | Optional | No | Personalization |
| User IDs | Yes | No | Account management, app functionality |
| Photos | Yes (only those you upload) | To AI provider for the analysis you request | App functionality (chart analysis, OCR) |
| Files and docs | Yes (only what you upload, e.g. exports) | No | App functionality |
| App activity | Yes | No | Analytics, app functionality |
| Crash logs / diagnostics | Yes | No | App functionality |
| Purchase history | Yes | No | Subscription management |
Encryption in transit: yes. You can request data deletion: yes (in-app or via email).
tilorah.co uses minimal cookies and local storage:
You can clear cookies and local storage in your browser settings at any time.
We may update this Policy. Material changes will be announced via email or in-app notice at least 14 days before they take effect, except when changes are required by law. The "Last updated" date at the top reflects the most recent revision.
For privacy questions, requests, or complaints:
If you are in the EU and we appoint an Article 27 representative, we will list them here. Until then, please contact us at the email above.