Privacy Policy

Proplysis ("Proplysis", "we", "us", or "our") is the trading journal and analytics platform at proplysis.com, operated from Türkiye. Proplysis is the data controller responsible for your personal information and can be reached at info@proplysis.com. This Privacy Policy explains what information we collect, how and why we use it, who we share it with, the legal bases we rely on, and the choices and rights you have. We handle personal data in line with Turkey’s Personal Data Protection Law (KVKK, Law No. 6698) and, where they apply, other data-protection laws.

Proplysis is operated from Türkiye and is intended for users outside the European Union and the United Kingdom. It is not directed to, and we do not knowingly market to or onboard, residents of the EU or UK. If you nonetheless use Proplysis from those regions, we still honor the data rights described in this policy.

Account information. When you create an account we collect your name, email address, and a password (or, if you sign in with Google, the basic profile information Google shares - your name, email, and avatar). We never receive or store your Google password.

Purchase verification. To unlock the dashboard you forward your prop-firm order-confirmation email to our verification address. We process the contents of that email to confirm your purchase, including the firm, account size, and price you paid.

Connected trading-account data. If you link a trading account (for example Tradovate, cTrader, TradeLocker, Match-Trader, DXtrade, or Rithmic), we access - on a read-only basis - your account number, account balance, equity, open positions, and trade history through the platform's API. We never have the ability to place, modify, or close trades on your behalf. Some platforms (such as DXtrade and Rithmic) do not issue a renewable access token, so to keep your data in sync we store the password you provide for that platform encrypted at rest, use it only to re-establish the read-only connection, and delete it when you disconnect the account.

MetaTrader 5. MetaTrader 5 connects through the Proplysis Expert Advisor (ProplysisSync), which you attach in your own MetaTrader 5 terminal. It only reads the account - account number, broker name and server, currency, margin mode, balance, equity, deals, open positions, and stop and target changes - and sends them to us. It never places, modifies, or closes a trade. The Expert Advisor keeps the account's connection token in a small file in your own MetaTrader 5 data folder (MQL5/Files/Proplysis), so attaching it again to the same account needs no paste.

MetaTrader 5 investor password. Separately, where your firm allows it, you can give us the account's investor (read-only) password. We store it encrypted at rest, never show it again, and decrypt it only inside a daily check. Once a day that check logs in from our own server to read the account's deal and order history and confirm the trades the Expert Advisor sent. An investor login cannot trade, and the password is never sent anywhere except to your own broker's server to log in. Trades that match the broker get a Verified tag. Trades that do not match lose it, and we tell you and our admin team. When you disconnect the account, the Expert Advisor's token stops working, the daily check stops, and we delete the stored password. Some firms do not allow investor logins. For those the account connects with the Expert Advisor only, without the Verified tag. Check your firm's rules on investor logins yourself; we take no responsibility for how a firm treats the login.

Support and messaging. If you contact us - by email, through our contact form, or via our Telegram support bot - we collect the information you provide, such as your name, email address, and the contents of your message. If you reach us or link with us through Telegram, we also collect your Telegram username and chat ID so we can reply to you and, according to your notification settings, send you alerts.

Usage information. We collect technical and usage data such as your IP address, browser and device type, pages viewed, clicks and other interactions, page performance, and error reports, to operate and improve the platform and to keep it secure. We collect this with PostHog, a product-analytics service, through our own domain. We do not record your sessions or keystrokes.

We use your information to: create and secure your account; verify your prop-firm purchase and grant dashboard access; sync, compute, and display your trading analytics and rule-compliance metrics; send you transactional messages (such as verification, password reset, and account alerts); respond to your support requests; operate, maintain, and improve the platform; and comply with our legal obligations.

We use Anthropic, an AI provider located in the United States, for a small set of features: reading the order-confirmation emails you forward so we can verify your purchase, writing your optional weekly journal insight, suggesting tags for your trades, and moderating and summarizing firm reviews. Only the data each feature needs is sent, it is not used to train Anthropic's models, and the output is informational only - none of it is an automated decision that produces legal or similarly significant effects for you.

Under the KVKK and, where it applies, the GDPR, we process your information only where we have a legal basis to do so:

Performance of our contract with you - to create and secure your account, verify your purchase and grant dashboard access, and sync, compute, and display your trading analytics and rule-compliance metrics. This is the core service you sign up for, and we cannot provide it without this data.

Our legitimate interests - to keep the platform secure, prevent fraud and abuse, respond to support requests, and operate and improve our services, balanced against your rights and freedoms.

Your consent - for optional processing, including certain cross-border data transfers (see “International data transfers” below) and any future marketing. Where we rely on consent, you can withdraw it at any time.

Legal obligations - to meet our accounting, tax, and other legal requirements.

We do not sell your personal information. We share it only with service providers who process it on our behalf and only as needed to run the platform: Netcup (server hosting in Germany - our database and sign-in system run on our own servers there), Mailgun (sending email), PostHog (product analytics and error reports), Anthropic (the AI features described above), Telegram (support messaging and, if you opt in, notifications), Brandfetch (when we have no logo on file for a firm, your browser loads it from Brandfetch's image service), and the trading platforms you choose to connect. Each processes your data under our instructions and is bound to protect it and use it only for the services they provide to us.

Some partner links on our site are tracked by the partner's affiliate network. For example, the NinjaTrader card on our homepage loads a small tracking image from Impact, NinjaTrader's affiliate network, which can record that the card was shown together with your IP address and browser details.

When you purchase a challenge through one of our affiliate links, the prop firm processes your purchase directly under its own privacy policy; we receive a commission record but not your payment-card details. We may also disclose information where required by law or to protect the rights, safety, and security of Proplysis and its users.

Proplysis publishes its own short videos to its own YouTube channel and its own TikTok account (@proplysis). To do that, our private admin panel connects to YouTube through the YouTube API Services and to TikTok through TikTok's Login Kit and Content Posting API. An administrator connects each account once and approves each video before it is sent.

These connections are used only for our own accounts. We do not ask visitors or users to connect a YouTube or TikTok account, and we do not access, collect, or store any YouTube or TikTok data about you. From YouTube and TikTok we keep only what we need to upload our own videos: a sign-in token for each of our own accounts, kept on our servers and readable only by our backend, and the ID of each video we upload. Videos go to YouTube as private uploads and to TikTok as drafts in our own inbox, which we finish in the TikTok app.

By using YouTube content published through these features you are bound by the YouTube Terms of Service, and Google processes data under the Google Privacy Policy. TikTok processes data under the TikTok Privacy Policy. Access given to Proplysis can be revoked at any time from Google's security settings or from Settings and privacy - Security - Apps and services permissions in the TikTok app. Revoking access stops any further uploads.

Proplysis is operated from Türkiye and our servers are in Germany. Some of our service providers, including PostHog, Anthropic, and Mailgun, process data in the United States, and others may process it elsewhere, so your personal information may be processed outside your country of residence. Where the law requires a safeguard for these transfers, we rely on Standard Contractual Clauses (or the equivalent standard contract recognized under the KVKK) and, where appropriate, on your explicit consent. You can request a copy of the safeguards we use by emailing us at the address below.

We use cookies and browser local storage for three purposes.

Strictly necessary - to keep you signed in and to secure the authentication flow.

Analytics - PostHog stores an identifier in a cookie and in local storage so we can count visits and understand how the product is used. When you sign in, it is linked to your account ID, never to your email address.

Affiliate tracking - the partner links and tracking image described in section 5 may let the partner's affiliate network set its own cookies, so it can credit us with a referral.

We do not use cookies for retargeting or advertising profiles, and we do not sell this data. You can block or delete cookies and local storage in your browser settings; the site keeps working without the analytics and affiliate cookies, but you need the strictly necessary ones to stay signed in.

We keep your information only for as long as we need it. We retain your account information for as long as your account is active. If you disconnect a trading account, we soft-hide it and delete the platform credentials we stored for it; your persisted trades and equity history are retained so your records remain intact if you reconnect, unless you ask us to delete them. If you delete your account, we keep it for a 7-day grace period in which you can restore it, then delete your personal information, trades, journal, and uploaded files. We keep purchase and commission records that we are required to keep for legal, tax, or accounting purposes, with your name, email address, and IP address removed, and only for the period those laws require. Reviews you published stay up without your name, shown as Anonymous.

We protect your information with industry-standard measures including encryption in transit, encryption at rest for any stored trading-platform credentials, scoped database access controls, and read-only trading-platform connections. No method of transmission or storage is completely secure, but we work to safeguard your data and to promptly address any vulnerability we become aware of. If a data breach affects your personal information, we will notify you and the relevant supervisory authority without undue delay, as required by law.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and - where we rely on consent - to withdraw that consent at any time. You can download a copy of your data, or delete your account, yourself under Account → Settings → Your data. A deletion takes effect 7 days after you request it, and until then you can sign in to restore your account. For any other request, contact us using the details below; we will respond within 30 days. If you are in the United States, you may have additional rights under your state's privacy law, including the right to opt out of the sale or sharing of personal information, which we do not do.

If you believe we have mishandled your data, you have the right to lodge a complaint with a supervisory authority - in Türkiye, the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) - or with your local data-protection authority.

Proplysis is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide a more prominent notice. We encourage you to review this policy periodically.

If you have questions about this Privacy Policy or how we handle your information, or you wish to exercise your rights, email us at info@proplysis.com.