Privacy Policy
The Catalyst is a desktop trading-behavior monitor that runs locally on your own PC, operated by The Catalyst Advantage LLC (“we”, “us”). This policy explains what information we handle across our three surfaces — the marketing website (thecatalystapp.trade), the account portal (account.thecatalystapp.trade), and the desktop application — and, just as importantly, what we deliberately never collect.
The short version: your trading data and your TopstepX API key live on your PC and never reach our servers. The only things we store are your account email, your subscription state, and support messages you choose to send. We don't sell data, we don't run ads, and we don't track you across the web.
What stays on your PC
The desktop application is local-first by design. The following are stored only in the application's own files on your computer and are never transmitted to us:
- Your TopstepX / ProjectX API key and username
- Your trades, fills, balances, journal entries, notes, tags, and every derived statistic
- Your behavior settings, blueprints, and all other in-app configuration
The application talks to TopstepX's API directly from your machine using your own key. We are never in that path. If you uninstall the application, that data remains in its folder on your machine under your control; deleting it deletes the only copy.
What the desktop application sends us
- License checks: the application periodically sends your license key (and nothing else) to our licensing service to confirm your subscription or trial is active.
- Update checks: the application asks our server for the latest published version number. No personal information is included.
- Support requests you submit: the in-app support widget sends the message you write, the category you choose, and — only if you tick the option — a recent excerpt of the application's error log. These are stored so we can respond, and are also delivered to our support inbox by email.
What the account portal collects
- Email address and password. Passwords are stored only as bcrypt hashes — we cannot read them. Password-reset tokens are stored hashed and expire within one hour.
- Session cookie. A single, essential, HttpOnly login cookie. It exists so you stay signed in; it is not used for tracking, which is why the site has no cookie banner.
- Subscription and billing state. Your subscription status, billing history, and license key. Payments are processed by Stripe; we never see or store your card number — Stripe sends us only the subscription state and invoice records (amount, date, status, and a link to Stripe's own receipt).
What the website collects
The marketing site uses Cloudflare Web Analytics — a privacy-first, cookieless counter. We see aggregate numbers (visits, referrer sites, countries, popular pages) and nothing about you as an individual. No advertising identifiers, no fingerprinting, no cross-site tracking.
Service providers
We use a small set of infrastructure providers, each receiving only what its role requires:
- Stripe — payment processing and subscription billing
- Render — hosting for the account and licensing service
- Cloudflare — website hosting, DNS, email routing, and the cookieless analytics described above
- Resend — delivery of transactional email (password resets, support messages)
We do not sell or rent personal information to anyone, and we do not share it with any third party except the providers above or where required by law.
We send transactional email only: password resets and replies to support requests. We do not send marketing email. Messages to support@thecatalystapp.trade are received in our support inbox and used solely to help you.
Data retention and deletion
Account data is kept for as long as your account exists. To delete your account and its associated data (email, subscription history, license key, support messages), email support@thecatalystapp.trade from your account address and we will remove it. Records we are legally required to keep (for example, invoice records for tax purposes) are retained for the required period. Your local trading data is yours — it lives on your machine and its deletion is entirely in your hands.
Security
All connections to our services use HTTPS. Passwords are bcrypt-hashed; session and reset tokens are stored only as hashes; the licensing service holds no trading data at all, so a breach of it could not expose your trades or API key — they were never there.
Children
The Catalyst is intended for adults and is not directed at anyone under 18. We do not knowingly collect information from minors.
Changes
If this policy changes materially, we will update this page and its date above. Continued use of the service after a change constitutes acceptance of the updated policy.
Contact
Questions about this policy or your data: support@thecatalystapp.trade.