Privacy Policy

Last updated: October 2026

Shugo ("we", "our", "us") is an AI-powered trading coach that helps you validate trade ideas. This policy explains what data we collect, why, where it goes, and how you can control it.

Shugo is not a financial advisor, broker, or signal service. We do not execute trades on your behalf.

1. Information You Provide

• Account data: email address, password (hashed, never stored in plain text). If you sign in with Google or Apple, we receive your email and profile name from those providers.
• Trading account balance (optional) — entered by you for position sizing and risk calculations.
• Referral code — automatically generated for your account. If you were referred by another user, we record that relationship.

2. Trade and Chart Data

• Chart screenshots you upload for AI analysis.
• Trade parameters: instrument, direction (long/short), entry price, stop loss, take profit, position size, and timeframe.
• Your notes and reasoning — optional text you provide explaining your trade idea.
• Selected indicators — the technical indicators you configure in your account.
• Custom trading rules — personal rules you create (e.g., "never trade against the daily trend").
• AI validation results — the verdict and analysis returned by the AI for each trade idea.

3. Behavioral and Performance Data

Shugo tracks your trading behavior to provide coaching insights:

• Composure zone: an emotional state indicator (calm, focused, active, heated, tilted) derived from your recent validation results.
• Overtrading detection: we count consecutive weak setups and may send you a coaching push notification suggesting you take a break.
• Trade journal: if you mark a trade as taken, we record the outcome (win/loss/breakeven), exit price, profit/loss, and any post-trade notes you write.
• Performance statistics: win rate, average R:R, instrument-level patterns, and session behavior — all derived from your trade history.

4. Information Collected Automatically

• Device identifier: a random ID generated on your device, used to track your anonymous session before you sign up.
• Push notification token: a device-specific token used to deliver push notifications.
• IP address: collected by our analytics provider for approximate geolocation.
• App version, platform (iOS/Android), language, and timezone.
• Usage events: we track actions such as screens viewed, validations started/completed/abandoned, subscription events, and feature interactions. These events are sent to our analytics provider (see Section 8).

5. How We Use Your Information

• Provide and operate the trade validation service.
• Generate AI-powered analysis of your trade ideas.
• Track subscription status and usage limits.
• Detect overtrading patterns and send coaching notifications.
• Calculate position sizing and risk metrics.
• Analyze product usage to improve the app experience.
• Send transactional emails (verification codes, password resets).
• Measure app install attribution for marketing campaigns.

We do not sell your personal data. We do not use your chart images or trade data to train AI models.

6. AI Processing

When you submit a trade idea for validation, the following data is sent to our AI provider for analysis:

• Your chart screenshots
• Trade parameters (direction, entry, stop loss, take profit, risk/reward)
• Your position sizing details and account balance (if provided)
• Your custom trading rules and selected indicators
• Your notes and reasoning

What is NOT sent to the AI: your email, user ID, name, or any account identifiers. The AI provider cannot identify you personally.

AI requests are routed through Vercel AI Gateway to Anthropic (Claude) for processing. Chart images are processed in real time and are not stored by the AI provider beyond the duration of the request.

We do not use your data to train AI models. Anthropic's API data usage policy applies to data processed by their service.

7. Chart Images

• Chart images are stored securely in private cloud storage (Supabase, hosted in the EU) and are used only for your trade validation.
• Images are resized for processing efficiency before being sent to the AI provider.
• When you delete your account, all chart images are permanently deleted from storage.
• We do not sell, share, or use your chart images for training AI models.

8. Analytics

• PostHog (EU cloud, eu.i.posthog.com) — our primary analytics provider. We use PostHog to track product usage events, measure feature adoption, and improve the app. PostHog may capture anonymized screen recordings with all text inputs masked and all images masked to help us diagnose issues. Your email and subscription status are linked to your analytics profile when you are logged in.
• Firebase Analytics (Google) — used solely for measuring app install attribution and a small number of conversion events (registration, validation, subscription) to optimize our marketing campaigns. Your user ID is linked to Firebase events. Firebase may collect your device's advertising identifier (see Section 12).

9. Authentication Providers

• Google Sign-In: if you sign in with Google, we receive your email address and profile name from Google. We do not access any other Google account data.
• Apple Sign-In: if you sign in with Apple, we receive your Apple user identifier and, optionally, your email and name (depending on what you choose to share with Apple).
• Email/password: your password is hashed with bcrypt before storage. We never store or transmit plain text passwords. Email verification uses a one-time 6-digit code sent to your email.

10. Subscriptions and Payments

• Subscriptions are managed entirely through the Apple App Store (iOS) and Google Play Store (Android).
• We receive: subscription status, tier, transaction ID, and expiry date.
• We do not receive or store your credit card number, billing address, or payment method details. All payment processing is handled by Apple and Google.
• Subscriptions auto-renew unless cancelled 24 hours before the period ends. Manage or cancel in your device's subscription settings.

11. Push Notifications

• Used for overtrading coaching alerts and motivational content.
• Push notification content may be derived from your recent trading behavior (e.g., a suggestion to take a break after several weak setups).
• Your push token is stored on our servers and shared with Expo (our push delivery provider).
• You can disable push notifications at any time through your device's system settings.

12. Data Sharing and Service Providers

We share data with the following service providers, solely to operate the Shugo service:

• Anthropic — AI trade validation (chart images, trade parameters). No user identifiers sent.
• Vercel AI Gateway — routes AI requests to Anthropic.
• Supabase — database and chart image storage (EU region).
• PostHog — product analytics and session replay (EU region).
• Firebase / Google Analytics — app install attribution and conversion tracking.
• Google — authentication (if you use Google Sign-In).
• Apple — authentication and subscription validation (iOS).
• Google Play — subscription validation (Android).
• Gmail / Google Workspace — transactional email delivery (verification codes, password resets).
• Expo — push notification delivery.
• Railway — backend hosting.

We do not sell your personal data to anyone.

13. Advertising Identifiers

• On Android, the app may collect your device's Google Advertising ID (AD_ID) for the purpose of measuring app install attribution via Firebase Analytics and Google Ads.
• This identifier is not used for personalized advertising within the app.

14. Data Retention

• Your account data, trade history, and chart images are retained until you delete your account.
• Email verification and password reset codes expire automatically after 15 minutes.
• Analytics data is retained according to our analytics providers' retention policies.
• We do not have automatic data expiration — your data persists until you choose to delete your account.

15. Data Security

• All data is transmitted over HTTPS/TLS encryption.
• Passwords are hashed with bcrypt before storage.
• Authentication uses signed JWT tokens with short expiration periods.
• Our primary database is hosted in the EU (AWS eu-west-1).
• Chart images are stored in private cloud storage with access controls.
• API endpoints are rate-limited to prevent abuse.
• No system is 100% secure. We take reasonable measures to protect your data but cannot guarantee absolute security.

16. International Data Transfers

Our database and analytics are hosted in the EU. However, some data processing may involve servers in other regions:

• AI processing (Vercel AI Gateway / Anthropic) may occur on servers in the United States.
• Our backend is hosted across multiple regions including the US, EU, and Asia.
• Push notifications are delivered through Expo's global infrastructure.

17. Your Rights and Choices

• Delete your account: Settings → Delete Account. This permanently removes your account, trade history, chart images, custom rules, and push tokens.
• Export your data: contact privacy@shugo.pro and we will provide your data within 30 days.
• Push notifications: disable through your device's system settings.
• If you are in the EU, you may have additional rights under GDPR including the right to access, rectify, restrict, or port your data. Contact us to exercise these rights.

18. Account and Data Deletion

• You can delete your account at any time: Settings → Delete Account.
• What is deleted: your account record, all trade ideas and validation results, all uploaded chart images (from both database and file storage), custom rules, indicator preferences, reviews, and push notification tokens.
• What may persist: anonymized analytics events in PostHog and Firebase. We make best-effort requests to delete your analytics identity.
• Subscriptions: deleting your account does not cancel your subscription. Cancel separately through Apple App Store or Google Play Store settings.
• If you cannot access the app, email support@shugo.pro and we will delete your account within 48 hours.

19. Children's Privacy

Shugo is not intended for users under 18 years of age. We do not knowingly collect data from minors. If we learn that we have collected data from a user under 18, we will delete their account promptly.

20. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via the app or email. Continued use after changes constitutes acceptance of the updated policy.

21. Shugo Browser Extension

The Shugo extension for Chrome lets you check trades from your desktop. It works with the same Shugo account as the app.

• Connecting: you connect the extension with a 6-digit code from the app. The extension stores its own sign-in tokens in Chrome's local extension storage. You can disconnect a browser at any time in the app (Settings → Connect browser) or in the extension.
• Chart screenshots: the extension captures the visible tab only when you press Capture chart or use its keyboard shortcut. The screenshot is sent to Shugo for your trade validation and handled like any chart you upload (sections 2, 6 and 7). You can also upload an image instead.
• Chart details: to pre-fill your trade, the extension reads the active tab's title and address only on TradingView chart pages, and only when Chrome has given it access to that tab. It uses them to read the instrument, price and timeframe, and does not send the page address to us.
• Optional permission: if you choose to allow chart capture on all sites, the extension still captures only when you ask it to. It does not read or change page content, and it does not collect your browsing history.
• Local settings: your language choice, recent instruments and similar preferences are stored only in your browser.
• Reminders: after a check, the extension may show a Chrome notification asking whether you took the trade. It reads that trade's status from your Shugo account to decide.
• Analytics: usage events (for example: extension connected, check started or completed, chart captured) go to PostHog (EU) and are linked to your Shugo account. They never include chart images, prices or your notes.
• Limited Use: Shugo's use of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use it only to provide and improve Shugo's trade validation features. We do not sell it, use it for advertising, or use it to determine creditworthiness.

Contact

For privacy questions: privacy@shugo.pro
For general support: support@shugo.pro