What GRENVX collects about you, why it collects it, who else touches it, how long it is kept, and what you can make GRENVX do with it. Your strategies and your trades are the most sensitive thing here, and this page treats them that way.
Draft dated 2026-09-17. This is the only version; there is no earlier one in force.
GRENVX is a trading-decision review product. The data controller — the party that decides why and how your personal data is processed, and the party you exercise your rights against — is identified below.
During the beta the controller is an individual rather than a company. There is no registered entity behind GRENVX yet, and this notice does not pretend otherwise.
Data controller
Mateusz Grendys
mati@grenvx.com
This notice covers the GRENVX web application and the grenvx.com website. It does not cover anything you do at your broker, your exchange, or any other service you use alongside GRENVX.
Three kinds of thing, and they are worth separating because they carry very different sensitivity.
Account and identity
| Data | Where it comes from |
|---|---|
| Email address | You, at registration |
| Password | You. Stored only as an Argon2 hash — the password itself is never written down and cannot be recovered from what is stored. |
| Display name and timezone | You, in your profile |
| Email preferences | You, including whether you want the weekday morning brief |
Your trading content
This is the substance of the product and the most sensitive material GRENVX holds. It is supplied entirely by you:
Security and operational records
| Data | Why it exists |
|---|---|
| Sign-in attempts, with the submitted email address and the source IP | Rate limiting. Without it, guessing a password is unlimited and free. |
| Session and refresh tokens | Keeping you signed in, and letting you sign out everywhere. |
| Password reset and email verification tokens | Stored as hashes, single use, time limited. |
| AI usage events | Counting model calls against your monthly allowance. |
| Email delivery records | Not sending you the same morning brief twice. |
GRENVX does not use advertising cookies, does not build an advertising profile of you, and does not sell personal data to anyone.
| Purpose | What it involves |
|---|---|
| Running the product | Reviewing your trades against your own strategy, producing your trader profile, memory and coaching. This is what you signed up for. |
| Market context | Attaching macro and market conditions to your decisions, and producing the daily read. |
| Account security | Authentication, rate limiting, password reset and email verification. |
| Service email | Password resets, address verification, and the morning brief if you have asked for it. |
| Operating limits | Metering model usage so one account cannot exhaust shared capacity. |
GRENVX does not use your trading content to train models, and does not use one trader's data to produce another trader's results.
GRENVX relies on outside services to function. The table below is what the running system actually calls, and what is sent to each.
| Processor | What reaches it | Why |
|---|---|---|
| Anthropic (Claude API) | The trade, strategy version and market context under review, plus the text of a coach session. | Producing trade reviews, the trader intelligence report and coach responses. This is the only processor that receives your trading content. |
| Email provider (SMTP) | Your email address and the content of the message sent to you. | Delivering password resets, verification mails and the morning brief. |
| Hosting and database provider | Everything GRENVX stores, as the infrastructure it runs on. | Running the application and its database. |
| Yahoo Finance | Nothing about you. Market prices are fetched; no user data is sent. | Market and sentiment series. |
| FRED (Federal Reserve Bank of St. Louis) | Nothing about you. Macro series are fetched; no user data is sent. | Macroeconomic data. |
The email provider, hosting provider and database provider are named by category rather than by name because the deployment is not yet fixed. They must be named specifically before this document is finalised.
GRENVX data lives in a PostgreSQL database and in file storage for the screenshots you upload. Both sit with the hosting provider.
Traffic between your browser and GRENVX is encrypted in transit. Passwords are stored only as Argon2 hashes; reset and verification tokens are stored only as hashes, so a copy of the database does not hand anyone a working credential.
The hosting region has not been fixed. Where the data physically rests, and whether it leaves your jurisdiction, must be stated here before this document is finalised — for European users this determines which transfer safeguards apply.
| Data | Kept for |
|---|---|
| Your account and everything in it | As long as the account exists. Deleting your account deletes it. |
| Sign-in attempt records | A short rolling window only — older rows are discarded automatically as the limiter cleans up after itself. |
| Password reset tokens | Kept after use, because that record is what stops the same link working twice. |
| Sessions | Until they expire or you sign out. |
| Email delivery records | Kept, so a brief is not sent to you twice. |
There is no soft delete and no restore window. When an account is deleted it is gone, and GRENVX cannot bring it back for you.
Backup retention has not been settled. How long deleted data survives in backups must be stated here before this document is finalised.
Two of these you can exercise yourself, right now, without asking anyone:
The rest are handled by writing to us:
Data requests go to support@grenvx.com, or through the contact form.
The date at the top of this page is when it last changed. If GRENVX starts collecting something materially different, or sends your data somewhere new, you will be told rather than left to notice a silently edited page.