The Wharf

Privacy Policy

Last updated: 24 October 2026

1. Who we are

The Wharf is operated by William Harford, trading as The Wharf (ABN 45 179 277 165), of Victoria, Australia ("we", "us", "our"). This policy explains how we collect, use, store and disclose personal information when you use thewharf.app and the installable app (the "Service").

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and we have chosen to do so whether or not the Act applies to us as a small business.

2. What we collect

• Account details: your email address and password (stored only in encrypted, hashed form). If you sign in with Google, we receive your name, email address and profile picture from Google.
• Profile details: any display name, username, nickname, country and profile picture you choose to add.
• Your journal: the trades, prices, results, notes, screenshots, chart snapshots, tags, moods, rules, prop account details (such as account sizes and balances), daily journals, reviews and settings you add or import.
• Community activity: posts, messages, reactions, friend connections and community memberships. Voice channel audio is not recorded or stored.
• Billing details: your plan, trial and subscription status, and the Stripe customer reference for your account. Your card number, expiry date and security code are collected and held by Stripe, not by us.
• Communications: emails, feedback and support requests you send us, and whether you have opted in to product updates.
• Technical information: your IP address, browser and device type, and logs of sign-ins and errors, collected automatically by our hosting providers to run and secure the Service.

We don't ask for sensitive information, such as health information or political or religious views. Please don't include it in your notes or posts.

3. How we collect it

We collect information directly from you when you sign up, use the Service, import trades, post in Communities or contact us. We receive some information from third parties: Google (if you sign in with Google) and Stripe (payment status). Technical information is collected automatically when you use the Service.

You can use a nickname rather than your real name in Communities. We need an email address to create an account, so we can't offer fully anonymous accounts.

4. How we use it

• To provide the Service: storing your journal, calculating statistics, reports, pattern alerts and prop rule tracking, and drawing chart snapshots.
• To manage your account, free trial, subscription and payments.
• To run Communities and show your shared content to the people you choose.
• To generate AI reviews when you ask for one (see section 6).
• To send service emails, such as confirming your email address, resetting your password and important notices about your account or these policies.
• To respond to your questions and complaints, and to enforce our Terms of Service.
• To keep the Service secure, prevent fraud and abuse, and fix problems.
• To improve the Service, using aggregated information that does not identify you.
• To measure which of our ads lead to sign-ups and trials (see section 12).
• To comply with our legal obligations, such as tax record-keeping.

We don't sell your personal information, and we don't use your trades or journal for advertising.

5. Product updates and marketing

We send product updates and news about The Wharf only if you opt in, for example by ticking "Send me updates". Every such email has an unsubscribe link, and you can also turn updates off in Settings. We comply with the Spam Act 2003 (Cth). Service emails about your account and billing are not marketing, and are sent whether or not you opt in.

6. Who we share it with

We share personal information only with service providers who help us run the Service, only to the extent they need it, and under terms that require them to protect it:

• Supabase: hosts our database, sign-in, file storage and real-time features.
• Stripe: processes payments and manages subscriptions.
• Cloudflare: delivers the website, forwards email sent to our address, and counts visits with Cloudflare Web Analytics, which uses no cookies and doesn't identify you or follow you across other sites.
• Resend: sends our account emails, such as sign-up confirmations and password resets.
• Anthropic: generates AI reviews. Only when you ask for a review, the details and screenshots of that trade (or that week's trades) are sent to Anthropic's API to produce it. Under its commercial terms, Anthropic does not use this data to train its models.
• Meta: measures our ads through the Meta pixel (see section 12). Meta receives your IP address, browser details, the pages you visit on our public site and events such as "signed up" or "started a trial", including the plan and its price. It does not receive your name, email address, trades or journal.
• Google: provides sign-in with Google (if you use it) and web fonts. Loading fonts shares your IP address with Google.
• TradingView: provides charts and widgets on some pages. They load from TradingView and may set its own cookies. None of your journal is sent to TradingView.
• Binance: provides crypto prices, which your browser requests directly, so Binance sees your IP address. None of your journal is sent to Binance.
• Voice channels: audio travels directly between the members in a channel (peer to peer), so those members' devices see your IP address. A public connection service (Google or Cloudflare) helps devices find each other.

Gold, forex and stock prices (Twelve Data), the economic calendar (ForexFactory) and news headlines are fetched by our server, so nothing about you is sent to those providers.

We may also disclose personal information where the law requires or authorises it (for example, to a court, regulator or law enforcement agency), to protect the safety of any person, or with your consent. If our business is sold or restructured, personal information may be transferred to the new owner, who must handle it in line with this policy.

7. Overseas disclosure

Several of the providers listed in section 6 store or process information outside Australia, including in the United States and other countries where they operate. Before we disclose personal information overseas, we take reasonable steps to make sure the recipient protects it in a way that is consistent with the Australian Privacy Principles. We do this by choosing established providers with published security and privacy commitments and contractual data-protection terms.

8. Who can see your journal

Your journal is private to your account. Our database's security rules lock every trade, note and screenshot to the account that created it.

If you use Communities, other members can see your username and display name, profile picture, whether you're online, your "Lifetime member" tag if you have one, and any trades or posts you share, either to everyone or to friends only, as you choose. Messages can be seen by the people in that conversation or channel.

We access your account data only to provide support you have asked for, to investigate a breach of our Terms or a security issue, or where the law requires it.

9. How we protect it

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure. These include:

• encryption in transit (HTTPS);
• hashed passwords;
• database rules that isolate each account's data;
• limits on sign-in attempts;
• restricted administrative access; and
• card payments handled entirely by Stripe, a PCI DSS Level 1 certified provider.

No online service can be completely secure. Please use a strong password that you don't use anywhere else.

10. Data breaches

If we become aware of a data breach that is likely to result in serious harm to you, we will tell you promptly, explain what happened and what you can do. Where the Notifiable Data Breaches scheme applies, we will also notify the Office of the Australian Information Commissioner.

11. How long we keep it

• We keep your account and journal while your account is open.
• If you ask us to delete your account, we delete your account and journal within 30 days. Copies in our hosting provider's backups are overwritten within a further 30 days.
• Billing and transaction records are kept for at least 5 years, as Australian tax law requires.
• Content you posted in Communities is deleted with your account. Copies other members already made, such as screenshots, are outside our control.

12. Cookies, browser storage and ad measurement

We use your browser's local storage, and similar technologies, to keep you signed in, remember your preferences (such as language, theme and your last open tab) and let the app work offline.

Meta pixel. We advertise on Instagram and Facebook. To see which ads lead to sign-ups and trials, our website loads the Meta pixel, which sets Meta cookies and sends Meta the information listed in section 6. Meta may also use it to show our ads to people similar to our users, and handles it under its own privacy policy. We never send Meta your trades, journal, notes, name or email address.

• If your browser sends a Global Privacy Control signal, the pixel stays off.
• In the UK, the EU and Switzerland, it only turns on if you choose "Allow".
• You can turn it off on this device at any time with the button below. You can also control ads from Meta in your Facebook or Instagram ad settings.

Turn off ad measurement

Third-party widgets, such as TradingView, may set their own cookies when you open the pages that use them. We count visits to our public website with Cloudflare Web Analytics, which sets no cookies and only reports totals (such as page views, countries and which site sent you). We will update this policy before we add any other analytics or advertising tools.

13. Accessing, correcting and deleting your information

• Download: you can download a full copy of your journal at any time from Settings → Backup.
• Access and correction: you can view and edit most of your information in the app. To request a copy of the personal information we hold about you, or to correct it, email us.
• Deletion: to delete your account and everything in it, email [email protected] from the email address on your account. Cancel any subscription first in Settings → Manage billing.

We respond to requests within 30 days and don't charge for them. If we have to refuse a request, for example where the law allows it, we will tell you why in writing.

14. Children

The Service is for people aged 18 and over. We don't knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it.

15. Complaints

If you have a concern about how we have handled your personal information, email [email protected]. We will acknowledge your complaint within 2 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

16. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new "last updated" date. If a change materially affects how we handle your personal information, we will email you before it takes effect.

17. Contact us

William Harford, trading as The Wharf
ABN 45 179 277 165
Victoria, Australia
[email protected]