Privacy

Privacy policy · Tapebook, the trading journal

Last updated: 28 October 2026

This policy covers the Tapebook website (tapebook.dojiwave.com) and the Tapebook app (tapebookapp.dojiwave.com): the waiting list, creating and using your Tapebook account, your trading journal and screenshots, and buying a Tapebook subscription. Tapebook, the trading journal, is made by Dojiwave.

1. Who we are

Dojiwave is run by Tomasz Krygowski, Northern Lights Tomasz Krygowski, ul. Chmielna 73B lok. 14, 00-801 Warszawa, NIP 6842525717, Poland (“we”, “us”). We are the controller of the personal data described here. Contact: [email protected].

2. This website

tapebook.dojiwave.com is hosted on Cloudflare Pages. To deliver and protect the site, Cloudflare processes technical data about each visit, such as your IP address, browser and the page you asked for (legitimate interest, GDPR Art. 6(1)(f)).The website sets no cookies and uses no analytics, advertising or tracking. It loads its fonts and scripts from its own domain, except the waiting list form's bot check, which loads from Cloudflare when you start using the form. Until you click "Buy", the website does not load Paddle Checkout or set Paddle cookies. When you click "Buy", Paddle Checkout opens and may use cookies strictly necessary to process and secure the payment. More information is available in section 5 and Paddle's Privacy Notice. Everything shown in the journal previews is demo data, generated in your browser. How prices reach our page, and what Paddle does when you press "Buy", is in section 5.

The bot check is Cloudflare Turnstile. It protects the forms and the assistant window from automated sign-ups and doesn't count or follow visitors. For this, Cloudflare, as our processor, processes your IP address and technical signals from your browser. Legal basis: our legitimate interest in keeping the form secure (Art. 6(1)(f) GDPR). It runs only because you use the form, so it doesn't ask for consent.

3. The waiting list

Our trading tools are not on sale yet. If you join the waiting list, we e-mail you when they are, and after that when there's something new. The waiting list is for adults.

• Voluntary: giving your e-mail address and your consent is voluntary, but without them we can't put you on the list.
• What we keep: your e-mail address, the page you signed up on, when you signed up and confirmed, and the wording of the consent you gave. We don't store your IP address in the list.
• What we send: commercial information and direct marketing by e-mail about Tapebook and other Dojiwave trading tools: launches, product updates and offers. We write only when there's something new, never a countdown, nothing about products outside trading and nothing from other companies. We send them only with your consent (GDPR Art. 6(1)(a)), which you give by ticking the box on the form.
• Confirmation first: after you sign up, we send one e-mail with a link to confirm. Until you confirm, you're not on the list. The link works for 7 days; if you don't confirm, we delete the address when the link expires.
• Leaving: every e-mail after the confirmation has an unsubscribe link. It opens a page with one button; press it and we delete your address from the list straight away. Your e-mail app may also show its own unsubscribe button, which does the same. You can also write to [email protected]. Withdrawing your consent doesn't affect the e-mails we sent before.
• Proof of consent: when you leave, we keep a short record that you had consented: a code made from your e-mail address with a secret key (HMAC-SHA-256) instead of the address itself, the dates you signed up, confirmed and left, the wording of the consent you gave, and the address of the form. This is pseudonymised data, not anonymous: with the key, we can check whether a given address is in the record. We keep it for 5 years from when you left or from our last e-mail to you, whichever is later, only to show that we had your consent and to defend ourselves against claims. Legal basis: our legitimate interest, Art. 6(1)(f).
• How long: until you withdraw your consent, until we close the list, or 12 months after the last e-mail we sent to the list, whichever comes first.
• No tracking: our e-mails contain no tracking pixels and no tracked links. We don't profile you. We don't sell your data or pass it to anyone else for their own marketing.
• Bot protection: the form is protected by Cloudflare Turnstile, which loads from Cloudflare only when you start using the form. To tell people from bots, your browser sends technical data about itself and your connection, including your IP address, directly to Cloudflare. Turnstile sets no cookie on your device. We rely on our legitimate interest in keeping the form free of spam and abuse, Art. 6(1)(f). We don't store your IP address in the list.
• Where it's kept and who sends: the list is stored by Cloudflare. Our e-mails come from [email protected] and go out through the mail servers of dHosting, our e-mail provider in Poland. Replies go to [email protected].
• Transfers outside the EEA: Cloudflare, Inc. is based in the United States and may process this data there. The transfer relies on the EU-U.S. Data Privacy Framework; where the Framework doesn't apply, on the EU Standard Contractual Clauses in Cloudflare's data processing addendum.

4. Your Tapebook account and your journal

Tapebook is an online service: you sign in to your account, and your journal is stored on our servers. We are the controller of this data.

• Your account: your e-mail address, your password (we keep only a one-way hash of it, never the password itself), the versions of our Terms and this policy you accepted, with the date and time, and the state of your subscription. If you turn on the second sign-in step, also its secret.
• Signing in: when you sign in, we set one session cookie, only for tapebookapp.dojiwave.com, and keep a record of the session on our server: your account, when the session started and when it runs out, and the name of your browser and operating system, so that you can see which devices are signed in. We don't keep your IP address with the session. A session ends after 30 days without use. To protect accounts, we keep a security log for 30 days: the kind of event (for example a sign-in or a failed attempt), the account or a one-way code of the e-mail address that was entered, the IP address and the time.
• Bot protection: We use Cloudflare Turnstile to protect sign-up and password reset from bots. For this purpose Cloudflare, as our processor, processes your IP address and technical signals from your browser. Legal basis: our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).
• Accounts that are never paid for: if you create an account and don't subscribe, we delete it after 14 days.
• Your journal: everything you enter or import: your trades, your trading accounts (account login, broker, server and balance), notes, the mood you choose from a list, plans, cash flow, files you import and your trade screenshots. Your entries and screenshots are kept until you delete them or delete your account.
• Free-text notes and your consent: notes you write in your own words (before a session and on your trades) can reveal information about your health, even by accident. We store them only with your explicit consent, which we ask for the first time you write such a note (Art. 9(2)(a) GDPR). Without it, the free-text fields are off and the rest of Tapebook works as usual. The mood scale and the tags you choose from a list don't need this consent. You can withdraw it at any time in Settings > Account and plan, without affecting what we did before: Tapebook first lets you download your notes, then deletes them and turns the free-text fields off until you consent again; they are removed from backups within 30 days. We keep a record of when you gave and withdrew consent and of the wording you accepted, for as long as your account exists. We don't analyse your notes, and we read them only when you ask us to or the law requires it (see “We don't look through your journal”).
• Prop ledger and capital goals: if you use them, the prop firm accounts you enter (the firm's name as you type it, the account type, the starting balance, fees, attempts, payouts, and why an account was closed and what it cost) and your capital goals (milestones, how you split a payout, your monthly prop budget). You enter everything yourself; Tapebook doesn't connect to prop firms or banks. Purpose, legal basis and how long: as for your journal. You can download them with the rest of your journal.
• What we never ask for: the passwords to your trading accounts. Don't enter them anywhere in Tapebook. Tapebook isn't meant for information about your health or for other people's personal data; please don't put it in your notes.
• We don't look through your journal or your screenshots. To run your account we use only your e-mail address, your subscription and how much storage you use. We access what is in a journal only when its owner asks us for help, when it is strictly necessary to keep Tapebook and its users secure (for example to stop an attack or to investigate a breach), or when the law requires it (for example a lawful order from a court or authority). We keep a record of every such access for 12 months. We don't analyse journals and don't make statistics from them.
• On your device: Tapebook keeps a copy of your journal, including your screenshots, in your browser's storage so that it works when your connection drops. Signing out removes that copy from the device. If your session runs out instead, the copy stays in the browser, hidden, until you sign in again or remove it; changes not yet sent are sent when you sign in. If someone signs in to a different account in that browser, Tapebook shows them nothing from your journal and asks them to clear the device or sign out. You can remove the copy without signing in, with Remove data from this device on the sign-in page; changes not yet sent are then lost. On a shared or public computer, always sign out when you finish. Tapebook uses no analytics. The only script from another company is Cloudflare Turnstile, on the two forms named above and in the assistant window on the website. Tapebook keeps in your browser only what it needs to work, so it doesn't ask for cookie consent.
• E-mails. We send you service e-mails only: address confirmation, password reset, e-mail change, and security and access notices. No marketing. Data: your e-mail address, the content of the message and technical delivery data. Purpose: providing the service you signed up for (Art. 6(1)(b) GDPR). The e-mails are sent by Cloudflare, Inc. as our processor. We do not track whether you open the e-mails or click links in them. Cloudflare keeps delivery records of our service e-mails (sender, recipient, subject and status) for up to about 31 days, according to its documentation; it doesn't keep their content.
• AI assistant. Help in the app and the assistant window on our website answer your questions with an AI assistant. Questions you type in the assistant are sent to Anthropic Ireland, Limited, which generates the answers as our processor. Anthropic does not use them to train its models and deletes them within 30 days, except content flagged for misuse, which may be kept up to 2 years. Data may be processed in the United States under the EU Standard Contractual Clauses. With a question asked in Help, the app also sends technical details so that the assistant can help: the app version, your type of browser and system, the sync state and the number of changes not yet sent, the number of your trading accounts and trades, the screen you are on, and your plan and the date your access runs until. It never sends your e-mail address, your name, your account's identifier or the content of your journal. We don't store the conversations; to keep daily limits, we count questions per account or per IP address, without their content, and delete these counts within 2 days. Before the first question on the website, Cloudflare Turnstile checks that you are not a bot. Please don't type personal data or trade details in the assistant. Purpose: answering your questions and technical help. Legal basis: in the app, the contract (Art. 6(1)(b) GDPR); on the website, steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); question limits and Turnstile, our legitimate interest in protecting the service (Art. 6(1)(f) GDPR).
• Why: to provide the service you subscribed to. Legal basis: contract, Art. 6(1)(b). The sign-in log and the record we keep after an account is deleted: legitimate interest, Art. 6(1)(f), in keeping accounts secure and in being able to show what was agreed.
• Where. Account and journal data and screenshots are stored in the European Union. The app runs on Cloudflare's global network, so data may also be processed by Cloudflare, Inc. in the USA; section 6 says how transfers are protected.
• Backups: we back up the database and files daily and keep each backup for 30 days.
• How long: your account and journal, for as long as you have a subscription. When it ends, your account becomes read-only and we keep your journal for 90 days, then delete it; we e-mail you before we do. If you have started buying Tapebook again when that date comes, we wait up to 33 more days before deleting it, or up to 47 days if your payment is already in progress at Paddle. If you ask us to delete your account, we do it at once.
• Deleting your account: you can do it at any time in Settings > Account and plan ("Delete account"). We delete your journal, screenshots and sign-in data from our systems straight away, and from backups within 30 days. If you have paid for Tapebook at least once, we keep only your e-mail address, the dates your account was created and deleted, the versions of the Terms and this policy you accepted, and your subscription periods, payments and refunds, to defend ourselves against claims under your contract, refunds or complaints. We keep them for 6 years from the last billing event (the end of your last paid period, your last payment or refund, or the closing of a complaint), to the end of that calendar year. If you have never paid, nothing of this is kept; only the security log stays until its 30 days run out. Legal basis: legitimate interest, Art. 6(1)(f).
• Taking your data with you: you can download your whole journal at any time, in read-only mode too: your journal as a JSON file, your trades as CSV and your screenshots, in parts.

5. Buying Tapebook

Tapebook is sold by Paddle.com Market Limited, 30 Old Bailey, London, EC4M 7AU ("Paddle"), our reseller and Merchant of Record. Paddle is a separate controller, under its own privacy policy, for your payment, tax, invoices, refunds and subscription. We never see your card details. This section says what we receive from Paddle, why and for how long.

• Prices on our page. To show you the price in your currency, with the right tax, our server asks Paddle for the price for your country. It tells Paddle only the country, which Cloudflare works out from your connection, never your IP address. Nothing from Paddle loads on our page until you press "Buy". Then Paddle's checkout opens, and Paddle and its payment providers use their own cookies for the payment, under Paddle's privacy policy. Paddle's checkout sends Paddle its own technical and usage data. Buying and renewing always happen on our sales page, never inside Tapebook itself.
• What we give Paddle: a one-time purchase token that links the payment to your Tapebook account, and your account e-mail address. We do not give Paddle your journal data.
• What we receive from Paddle: Paddle's IDs for the transaction, your subscription and you as its customer, your plan and billing period, and the state of the subscription: paid, cancelled or refunded. We don't receive your card details or your postal address. We link your subscription to your account by the account's identifier. Your account shows the date your subscription is paid until.
• Managing your subscription: cancelling, changing your card and your invoices are in Paddle's customer portal. You reach it through "Invoices and payment method" in Settings > Account and plan, which asks Paddle for a one-time sign-in link and sends you there; we don't keep or log that link. You can turn off renewal at any time in Settings > Account and plan, or in Paddle's customer portal (Invoices and payment method). You keep access until the end of the period you have paid for. Deleting your account also turns renewal off and ends your access at once. If you delete your account before the end of the period you have paid for, you can ask us to refund the unused part; see section 10 of the Terms. You can also sign in to Paddle directly with the link from Paddle's e-mail.
• E-mails about payment: receipts and subscription e-mails come from Paddle.
• Why: to run your subscription and support you if something goes wrong. Legal basis: contract, Art. 6(1)(b).
• How long: as long as your account exists; after that, your subscription periods stay in the record described in section 4. After your account is deleted, Paddle still keeps its own payment records as a separate controller. Records of Paddle's messages to us about payments (webhooks): 90 days. A complaint or a payment dispute (chargeback): until it is closed. Documents the law requires us to keep: as long as the law says. After your account is deleted, we keep Paddle's ID of your subscription for 30 days after the subscription ends, so that a deleted account isn't charged and a late payment can be refunded. Only if Paddle hasn't confirmed the cancellation do we keep it longer, up to 400 days, while we resolve that case; we review such cases every month. A refund from Paddle that we can't yet match to a payment waits up to 13 months: with a yearly plan a refund of the unused part can come at any time during the paid year, and Paddle may need about a month to process it.

6. Who processes data for us

Cloudflare hosts the website, runs the form and Turnstile, and stores the list. dHosting (Poland) handles our e-mail: we send from [email protected], and replies go to [email protected]. Cloudflare, Inc. is based in the United States. Where it processes data there, the transfer relies on the EU-U.S. Data Privacy Framework; where the Framework doesn’t apply, on the EU Standard Contractual Clauses in Cloudflare’s data processing addendum.

• Cloudflare, Inc. (USA) hosts the app, stores account and journal data in the EU, protects sign-up from bots and sends our service e-mails.
• Anthropic Ireland, Limited (Ireland) generates the AI assistant's answers (section 4). Transfers to the USA: the EU Standard Contractual Clauses.
• Paddle is a separate controller for payments, invoices, tax and the customer portal.
• Transfers: as in the policy (EU-U.S. Data Privacy Framework; where it doesn't apply, the EU Standard Contractual Clauses).
• Courts, the police, prosecutors and other authorities, when the law requires us to give them data (for example under the EU Digital Services Act). Legal basis: legal obligation, Art. 6(1)(c) GDPR.

7. Your rights

You can ask us for access to your data, correction, deletion, restriction and portability, and you can object to processing based on legitimate interest. You can withdraw your consent at any time, without affecting what we did before. Write to[email protected]. You can also complain to the Polish supervisory authority, the President of the Personal Data Protection Office (uodo.gov.pl). We don't make decisions about you by automated means alone. If you write to our support, we keep the correspondence for 12 months after the last message about that matter. Correspondence about a complaint we keep for 6 years from when the complaint is closed, to the end of that calendar year, to defend ourselves against claims.

8. Age

Tapebook, its waiting list and its sale are for adults. We don't knowingly collect data from anyone under 18.

9. Changes

If we change this policy, we'll update the date at the top. If a change affects the waiting list, we'll tell you by e-mail.

Tapebook