This Privacy Policy explains how Stedwatch handles data. The short version: your monitoring data stays on your own machine. There is no cloud that collects your system metrics or trading activity, and no monitoring or trading telemetry. If you buy Pro, you also get a customer account at my.stedwatch.com; that account holds your email, your licence key and your purchase record, plus the sign-in and licence-activation details listed in section 5, and is entirely separate from your local monitoring data.
1. Who is responsible
The controller for any personal data described here is tomventures GmbH (Switzerland). Contact: hello@stedwatch.com. Provider details are in the Impressum.
The relevant supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC). If you are in the EU/EEA, you also have the rights described in section 10 and may lodge a complaint with your local data-protection authority.
EU representative (GDPR Art. 27). tomventures GmbH is a Swiss-based controller. Where Art. 27 GDPR applies, we will designate a representative in the EU; until that representative is published here, EU data subjects can reach us for any data-protection matter at hello@stedwatch.com.
2. Data the desktop software handles (locally)
To do its job, the Software reads and stores the following on your machine:
- System metrics & history, CPU, RAM, disk, drive SMART health, network latency, and Windows security signals over time.
- MetaTrader 5 terminal status, process state, AutoTrading state, connection status, and information derived from each terminal's own log files. The Software reads these logs read-only; it does not transmit them.
- Your configuration, thresholds, quiet hours, and the notification channel you set up. Secrets such as a Telegram bot token are stored on your machine and protected by file-system access controls; they are redacted from any diagnostics export.
This data is not sent to tomventures. It stays in the Software's local data folder on the machine where it runs.
3. Notifications you choose to enable
If you enable push alerts, the Software sends alert messages directly from your machine to the channel you configured, Telegram, or the Stedwatch mobile app (native push). Those messages travel to that provider, not through tomventures. The content is the alert itself (for example, "Terminal 3: AutoTrading disabled"). Your use of those services is subject to their own privacy policies. If you don't enable a channel, no alerts are sent anywhere.
The Stedwatch mobile app channel delivers push notifications through Expo's push service and the platform push infrastructure operated by Apple (APNs) and Google (FCM). The alert text therefore transits Expo and Apple/Google on its way to your phone. This is the alert-delivery path only; it is distinct from, and does not change, our promise that your monitoring data is never sent to a Stedwatch cloud. Your use of those services is subject to their respective privacy policies.
4. The mobile app and local API
The optional mobile app connects directly to the read-only API on your own machine to display your dashboard. That connection is between your devices; it is not routed through a Stedwatch server, and the API is read-only.
5. Your Stedwatch account & purchases (my.stedwatch.com)
If you buy Pro, we operate a customer account for you at my.stedwatch.com. This is the only place we hold your personal data on a server. We keep it deliberately small:
- Your email address, to identify your account and send you a passwordless sign-in link and your licence key. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
- Your licence key(s) and their dates/status, so you can view and re-download them. Keys are stored encrypted at rest. Legal basis: performance of the contract.
- Sign-in session data, including your IP address and browser user-agent, kept for the duration of a session to secure your account against abuse. Legal basis: our legitimate interest in account security (Art. 6(1)(f)).
- A reference linking your account to your Lemon Squeezy order/customer, so we can show your invoices and licence. We do not store your card or payment details, those stay with Lemon Squeezy and its underlying payment processor.
We use the following processors for this account:
- Lemon Squeezy, LLC (United States), our merchant of record and seller of record. When you check out, your name, billing address, payment details and email are processed by Lemon Squeezy to take payment, handle tax, and issue invoices; Stripe (which owns Lemon Squeezy) is Lemon Squeezy's underlying payment sub-processor. International transfer to the United States is covered by their data-processing terms and standard contractual safeguards (Standard Contractual Clauses or the EU-US Data Privacy Framework). See Lemon Squeezy's privacy policy.
- Our email (SMTP) provider, which transmits your sign-in link and licence-key emails to you.
- Hetzner Online GmbH (Germany, EU/EEA), our hosting provider, on whose dedicated server the portal and its database run and which may keep standard server access logs (containing IP addresses) for security and operation; the server is administered through the RunCloud management panel.
For the full register of the sub-processors we use, including their roles, the data they receive and the applicable transfer mechanisms, see our sub-processor register.
Licence activation (paid Pro keys and trials). A paid Pro licence (and the time-limited trial) covers your whole personal fleet under fair use, up to five machines. To enforce that fairly, each machine on which you install the Software activates online once against our activation endpoint and then re-checks periodically. In that request the Software sends only: your licence key, and a one-way, salted machine hash (a SHA-256 derived from stable machine identifiers - not reversible to your hardware and not usable to identify you). Our server additionally records, per activation, the IP address and browser user-agent of the request and first-seen and last-seen timestamps, as proof of the seat and for anti-sharing (legal basis: Art. 6(1)(f), our legitimate interest in enforcing the fair-use seat limit). We never receive your monitoring or trading data, or any other hardware detail, through activation. A seat auto-releases after thirty days of no re-check; you can also free a machine yourself in your account, and when you do we clear that seat's IP and user-agent right away. The free tier performs no activation at all and sends nothing. Activation records are deleted when you delete your account.
Retention. We keep your account data for as long as you have an account. You can delete your account and its data at any time from my.stedwatch.com → Account → Delete account, or by emailing us. Payment and invoice records held by Lemon Squeezy (and its underlying payment processor) are retained as required by accounting and tax law (in Switzerland, up to ten years) and are not deleted by an account deletion.
6. Marketing emails and newsletter
If you ask to receive product news or our newsletter, we send those emails only after you confirm your subscription. We use double opt-in: you enter your email, we send you a confirmation link, and we add you to the list only once you click it.
For this we store your email address, the IP address and user-agent used to subscribe, the timestamp of your subscription and confirmation, and the source (where you signed up). We keep these consent details so we can prove that you asked to be added. Legal basis: your consent (Art. 6(1)(a) GDPR).
You can withdraw your consent at any time by clicking the unsubscribe link in any marketing email, or by emailing hello@stedwatch.com. Withdrawing consent does not affect the lawfulness of processing before you withdrew it, and it does not stop the essential service emails (such as your sign-in link or licence key) that we send to run your account.
7. This website
This marketing website is intentionally minimal. It self-hosts its web font (no third-party font service) and is served from a dedicated server operated by Hetzner Online GmbH in Germany (EU/EEA), which may keep standard server access logs (which include IP addresses) for security and operation. We do not set advertising or cross-site tracking cookies. If analytics are added later, this policy will be updated to say what, and on what basis.
Cookies. The customer account at my.stedwatch.com sets one strictly-necessary session cookie (our Better Auth sign-in session) so you stay logged in; we set no advertising, analytics, or cross-site tracking cookies.
8. Email support
If you email hello@stedwatch.com, we process the contents of your message and your email address to answer you. A diagnostics export, if you choose to send one, has secrets redacted by the Software before it is created.
9. Legal bases (where GDPR/Swiss FADP applies)
- Performance of the contract, operating the Software you installed and providing your Pro account, licence and purchases.
- Your consent, enabling an optional notification channel and receiving marketing emails or our newsletter.
- Our legitimate interests, securing your account, answering support requests and keeping our services secure.
- Legal obligation, retaining payment/invoice records for accounting and tax.
10. Retention
Locally stored monitoring data lives on your machine for as long as you keep it; you control it and can delete it, and uninstalling removes the Software's local data. Your my.stedwatch.com account data is kept until you delete your account (see section 5); deleting it removes your email, licence keys and sign-in data from our systems, while invoice records held by Lemon Squeezy (and its underlying payment processor) are retained as required by law. Support emails are kept only as long as needed to handle your request and any follow-up.
11. Your rights
Subject to applicable law, you may have rights to access, correct, delete, or restrict processing of your personal data, to data portability, and to object or lodge a complaint with a supervisory authority. Where processing is based on your consent (marketing emails, an optional notification channel), you can withdraw that consent at any time. Because most data never leaves your machine, you exercise much of this directly by managing or deleting your local data. For your Pro account, you can delete everything we hold yourself from my.stedwatch.com → Account → Delete account. For anything else we hold (e.g. support emails), contact hello@stedwatch.com and we will action your request. If you are in Switzerland you may also contact the Federal Data Protection and Information Commissioner (FDPIC); if you are in the EU/EEA, your local data-protection authority.
12. Children
Stedwatch is a professional tool not directed at children and is not intended for use by anyone under 18.
13. Changes
We may update this policy as the product develops. Material changes will be reflected here with a new "last updated" date.