Legal

Privacy policy

Last updated September 19, 2026

The short version: on the Free plan, Hammer never sees your data — it stays on your device. On Pro, the only thing that leaves your device is your journal itself, synced to your own account so your other devices can read it. Nobody else's.

What we collect

Free plan. Nothing. Free is local-only: your trades, accounts, tags and notes are stored in a database on your device, and Hammer does not talk to any server. We have no way to see, back up or recover a Free user's journal — that is by design, not a limitation we plan to remove.

Pro plan. To sync your journal across your devices, Pro creates an account (email, or Sign in with Apple, which may share a private relay address instead of your real one) and stores your journal — trades, executions, accounts, tags, attachments, daily notes and per-trade notes — on our database (Supabase, hosted in Singapore) so your other signed-in devices can read and write it. Rows are scoped to your account with row-level security, so no other user's app or browser can query your data through the API — and it is encrypted at rest.

Who can technically see synced data. Honestly: we can. Anything you sync — on Pro, or by using the web app — lives in a database we operate, and the people who run Hammer have administrator access to it, the way any hosted service's operators do. It is not end-to-end encrypted. What protects it is policy and access control, not cryptography: we do not open, read, analyse or export anyone's journal except to fix a problem you have asked us to fix, and then only the rows needed. If that guarantee isn't strong enough for you, the Free plan on iPhone, iPad and Mac exists for exactly that reason — it never leaves your device, and we cannot see it even if we wanted to.

Purchases. Subscriptions are handled by the App Store (Apple) and RevenueCat, who tell us your subscription status and entitlement — not your card number, which neither we nor RevenueCat ever see. If web checkout ships, the processor behind it (expected: RevenueCat's own web billing, backed by Stripe) will handle payment details the same way.

The web app. A browser has no private on-device database the way a phone does, so using the web app means creating an account, and every trade you log there is stored in that account — the same place Pro sync stores it, covered by the same paragraph above. Signed out, the web app shows a sample journal and stores only your appearance preference (light/dark/system) in your browser. Signing in uses a one-time code sent to your email; we keep your email address and nothing else about you.

What we don't do

• No ad networks, no ad IDs, no cross-app tracking.
• No third-party analytics or crash-reporting SDKs reading your journal's contents.
• We never sell or rent your data to anyone, for any reason.
• No human at Hammer reads your journal. Support requests are answered from what you choose to share in the email itself.

The written weekly review

On iPhone and Mac (Pro, iOS/macOS 26+), it runs entirely on your device using Apple's on-device model — it reads your local findings and notes to write the review and never sends them anywhere.

A browser has no on-device model to call, and not every Apple device supports one yet — for those two cases, the same review can instead be written by Anthropic's Claude. This is opt-in and disclosed before anything is sent, every time, until you turn it on: on the web via a one-time confirmation, on a native device without on-device support via a consent screen the first time you open the review there. When you do, we send last week's summary numbers, the same findings the Insights screen shows, and up to six of your own notes from that week, trimmed — never a raw trade, a price, or your full journal. Anthropic processes this request to generate the review and does not train on it; nothing is stored beyond what it takes to answer the request. Turning it on for one device never changes the on-device promise for any device that already has it.

Feedback

The feedback widget works with no account: whatever you type, and an email address only if you type one in (for a reply). If you're signed in, we also attach your account so we can look into account-specific bugs. Submissions go into a write-only store — nobody, including you, can read them back through the app or its API; only we can, from the dashboard, to act on them. Never sold, never used for anything besides improving Hammer.

Attachments

Screenshots you attach to a trade are stored the same way as the rest of your journal: on-device only on Free; in a private storage bucket keyed to your account on Pro. They are never scanned, indexed for search, or used for anything besides showing them back to you.

Your choices

• Export your entire journal as JSON or CSV at any time, on any plan.
• Delete any single trade yourself, any time, from its own page.
• Delete your account and its synced data yourself, from Settings in the app or on the web — it removes your rows and screenshots from our database immediately; anything already on your devices stays there until you delete it locally.
• Cancel a subscription through the App Store (or, once available, your web billing portal) at any time; your data is not deleted when Pro lapses.

Children

Hammer is not directed at, and we do not knowingly collect information from, anyone under 16. It is a tool for people trading their own money.

Changes

If this policy changes in a way that affects what leaves your device, we'll say so here and, for Pro users, in the app before the change takes effect.

Contact

Questions about this policy: privacy@tradinghammer.app.