Legal

Privacy policy

Last updated: 26 September 2026

1. Who is responsible

Replaybook is made by Theodor, based in Romania, who is the "controller" of the personal data described here under the EU General Data Protection Regulation (GDPR). Contact: theodorcont@gmail.com.

2. This website

The site sets no cookies and uses no analytics, ads or tracking tools. Its fonts and images are stored on the site itself, so your browser doesn't contact Google or any other outside service when you visit.

The site is hosted by Cloudflare. To deliver the pages and protect them from attacks, Cloudflare processes technical data such as your IP address, browser type and the pages requested, and keeps short-lived logs. We use this only to run the site safely (our "legitimate interest", GDPR Art. 6(1)(f)).

3. Buying a plan

Plans are sold through Lemon Squeezy, which acts as the seller ("merchant of record"). At checkout Lemon Squeezy collects your name, email, billing address, country, payment details and tax information, and is itself responsible for that data under its own privacy policy.

From Lemon Squeezy we receive your name, email address, country, which plan you have, your order and subscription status, and your license key. We never receive your card details. We use this to give you the plan you paid for, to check your license key, to answer support questions and for our tax and accounting records. The legal bases are our contract with you (GDPR Art. 6(1)(b)) and our legal obligations (Art. 6(1)(c)).

4. The app on your PC

Replaybook runs on your own computer. Everything you create in it (backtest sessions, trades, journal entries, notes, screenshots, drawings, settings, imported news and downloaded candles) is saved in a data folder on your PC. We don't receive any of it, and the app has no usage tracking or analytics.

The app connects to the internet only for these things:

• Checking your license key. When you sign in, and about once a day after that, the app sends your license key and a name for this PC ("Replaybook on" followed by your computer's name) to Lemon Squeezy's license service. Lemon Squeezy answers with your plan, your subscription status, and your name and email, which the app saves on your PC so it can show them on the account page. The PC name lets you see which PCs use your key, so you can sign one out. We can see this list in our Lemon Squeezy dashboard.
• Downloading market data you ask for. Forex and CFD candles are downloaded straight from Dukascopy, and futures candles straight from Databento using your own Databento account and API key. Your PC connects to them directly, so they see your IP address (and, for Databento, your account) under their own privacy policies: Dukascopy, Databento. Your Databento API key is stored only on your PC; we never see it.

5. Emails

If you email us, we use your email address and message to answer you. Our email is hosted by Google (Gmail). The legal basis is our legitimate interest in answering you, or our contract with you if you are a customer.

6. Creator program

The creator (affiliate) program runs on Lemon Squeezy, which handles sign-ups, referral tracking, tax forms and payouts under its own privacy policy. We see creators' names, email addresses and referral and commission figures, and use them to run the program.

7. Who else sees data

Only the services named above: Cloudflare (website hosting), Lemon Squeezy (sales, license keys, creator program) and Google (email), plus Dukascopy and Databento when you download data. We may also share data when the law requires it, for example with tax authorities. We never sell personal data.

8. Data outside the EU

Some of these services are based in the United States or process data there. They protect it with the safeguards the GDPR requires, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

9. How long we keep it

• Customer data: while your subscription is active, and afterwards for as long as tax and accounting law requires.
• Emails: as long as needed to help you, and normally no longer than 2 years after our last contact.
• Data on your PC: until you delete it. Uninstalling the app doesn't delete your data folder; you can delete it yourself.

10. Your rights

You can ask us to show you the personal data we have about you, correct it, delete it, limit how we use it, give it to you in a portable format, or stop using it where we rely on legitimate interest. Email us and we'll answer within one month. You can also complain to a data protection authority: in Romania that is ANSPDCP (dataprotection.ro), or the authority in the country where you live.

For the data Lemon Squeezy holds as the seller, you can also contact Lemon Squeezy directly.

11. Children

Replaybook is made for adults who trade. It is not meant for anyone under 18, and we don't knowingly collect data from children.

12. Changes

If we change this policy, we'll update the date at the top. If a change matters for customers, we'll also tell them by email.

See also our Terms and Refund policy.