WarRoom Terminal Privacy Policy

Last updated: October 20, 2026 Version: 2.6

WarRoom Terminal is operated by Generalist Appworks, a sole proprietorship ("WarRoom," "we," "us" or "our"). This policy explains what personal data we process when you use our website, applications, support channels and related services (the "Service").

For privacy questions or requests, contact support@warroomterminal.com.

1. Data We Process

Depending on how you use the Service, we may process:

Account information

Email address
Account and authentication identifiers
Display name or profile information supplied by your sign-in provider
Account status and setup status. Subscription information will be processed only if paid subscriptions are introduced.

Profile and preferences

Timezone
Preferred exchange and any custom exchange URL you provide
Trader-profile answers, such as trading horizon, market preference, preferred timeframes, market-universe preference, directional preference, signal-frequency preference and notification interests
Preset filters, interface settings, groups, watchlists and customization preferences

Forward-tracking and journal information

Symbols and setups you choose to track
Entry and closing information
Calculated MFE, MAE, PnL and related outcome measurements
Status, timestamps and personal notes

These are educational and decision-support records. They are not connected brokerage records unless you independently enter information reflecting an external trade.

Device and security information

A pseudonymous browser/device identifier generated using FingerprintJS
Account identifiers associated with that device identifier for abuse prevention
IP address, request information and security logs that may be processed by our infrastructure providers

Membership and payment information

When paid subscriptions are open and you start a trial or membership:

Your plan, billing period, trial dates, membership status and renewal date
Payment records such as amount, currency, taxes, date, payment status, refunds and the payment method type with limited details such as card brand and last four digits
Billing country or address where needed to calculate tax and issue invoices

Billing is not open and a payment processor has not been selected. Before billing begins, we will identify the provider and describe the payment methods it supports. When you pay, the selected processor handles the payment credentials you enter. We do not intend to receive or store complete payment credentials such as a full card number, card security code, account password or UPI PIN.

Support submissions

Members send support requests through the Contact and support form inside the app. A request includes:

The email address on your account, so we can reply (or one you enter if your account has none)
The type of request and your message
Page details added automatically to help us investigate: the page you were on, the app version, your browser and the time
A screenshot, if you choose to attach one
Any other information you voluntarily include in your message

Do not send us passwords, private keys, seed phrases or exchange credentials.

Public-site information

We do not use advertising trackers, and we do not sell or share visit data.

Visit counts. We count visits to our website with Umami, an analytics tool that we run on our own servers. It does not set cookies. For each page view it records the page and its title, the referring website, any campaign tags in the link (the "utm_" tags described below), your browser, operating system and device type, the screen size, your language and an approximate location (country, region and city) derived from your IP address. It turns your IP address and browser details into a visitor identifier using a salt that changes every month, and it does not store the IP address. Other parts of a page address are removed before a visit is recorded. If your browser sends a Do Not Track signal, no visit is recorded. The account-connection page for AI agents is never counted. Visit records are deleted after 13 months.

Where new members come from. Links we share in posts, profiles and listings may carry "utm_" campaign tags that name the channel, such as X or a software directory. When you arrive through such a link, or from another website, your browser keeps those tags, the name of the referring website (not the full page address) and the first page you opened, for up to 30 days. Nothing is kept for a visit with neither. If you create an account and complete setup in that time, they are sent once and stored with your account, so we can tell which channels bring new members. They are then removed from your browser, and nothing more is kept there for attribution once an account on that browser has completed setup. We do not record this for an account that existed before that visit.

2. Why We Process Data

We process data to:

Create and authenticate accounts.
Provide and synchronize product settings across devices.
Operate Forward Tracking, journals, watchlists and personalized views.
Secure the Service and investigate suspected misuse.
Enforce account and trial limits, including one free trial per person.
Run memberships: start trials, take payments, send renewal and pre-debit notices, give refunds and keep tax and invoice records.
Respond to support requests and product feedback.
Maintain, diagnose and improve reliability.
Understand, in aggregate, how visitors find WarRoom and which channels bring new members.
Send essential account, security, policy and service communications.
Send promotional messages only where permitted and subject to available opt-out controls.
Meet legal obligations and protect users, Generalist Appworks and third parties.

We do not sell personal data or share it with data brokers or advertisers.

3. Device Fingerprinting

WarRoom uses FingerprintJS to generate a pseudonymous visitor identifier from browser and device characteristics. We use it to detect repeat registrations, enforce trial limits and prevent registration abuse.

The identifier is pseudonymous, not anonymous. During an active account and the recovery period, it may be linked to an account ID and email address. We do not use it to follow your activity across unrelated websites or for advertising.

After the account-recovery period, we remove the direct email and account-ID association from the retained abuse-prevention record. We may retain the pseudonymous identifier and an abuse-prevention status for as long as the relevant free-access or trial restriction remains in operation, plus a limited period needed to resolve security disputes. It will be deleted when it is no longer reasonably needed for that purpose, unless law requires retention.

4. Service Providers

We use service providers to operate the Service. They process data on our behalf or under their own applicable terms.

Provider	Purpose	Data that may be involved
Google Cloud	Application hosting and infrastructure	IP address, request and server logs, technical data
PostgreSQL	Authoritative application database for profiles, onboarding state, preferences, alert records, Forward Tracker records and related product data	Account-linked profile data, preferences, alerts, tracked symbols, journal records and operational metadata
Google Firebase	Authentication and browser push-notification transport (Firebase Cloud Messaging)	Authentication identifiers, email-verification and sign-in state, notification tokens and delivery metadata
Google Sign-In	Optional account authentication	Email, display name, authentication identifiers and profile information you authorize
FingerprintJS	Generation of a browser/device identifier	Browser and device characteristics processed to generate the identifier
Umami (self-hosted by us)	Counting website visits; it runs on our own servers, so visit data is not sent to a third party	Pages viewed, referring website, campaign tags, browser, operating system, screen size, language and approximate location, as described in Section 1
Telegram	Delivering alerts you choose to receive on Telegram, and notifying us when a support request arrives	For alerts: your Telegram chat ID and the alert content. For support: your account email, message, page details and any screenshot
Hostinger	Domain registration and related domain services	Technical request information where applicable
Payment processor (to be named before subscriptions open)	Payment processing, renewals, refunds and fraud checks after a provider is selected and billing opens	Name, email, billing country, payment details you enter with the processor, transaction and membership records

We also retrieve public market data from exchanges and market-data sources. We do not provide those exchanges with your WarRoom account profile merely because their public market data appears in the Service. If you follow an external exchange link, your interaction is governed by that destination's policies.

Discord and X are independent services. Visiting them through our links is governed by their privacy practices.

AI agents you connect

If you connect an AI agent to WarRoom (Terms Section 9A), WarRoom sends that agent the data you authorise on the consent screen: market evidence, and, if you allow it, your own alert triggers, Forward Tracker trades and investigation history. Your private notes (trade thesis, exit notes, lessons and behaviour tags) are sent only if you tick "Include my notes". From that point the data is processed by the agent's provider under its own terms and privacy policy, which we do not control.

To operate agent access we keep: the connection record (agent name, the permissions you granted, your notes setting, and when it was created), short-lived access tokens and refresh tokens, monthly call counts and a last-used time, and an audit log of each call (your account identifier, the agent's client identifier, the tool used, a one-way hash of the request arguments, the number of records returned and the outcome). The audit log does not contain the data returned; it is kept in our server logs, which are rotated and deleted on a regular cycle. If you create a WarRoom Squire API token for use with a model API or your own tools, we keep its name, a one-way hash of the token (never the token itself), its last four characters, the permissions and notes setting you chose, when it was created and when it expires; it is used and logged like a connected agent. Revoking an agent or a token in Settings → WarRoom Squire deletes its tokens, connection record and usage counts immediately. When your account is deleted, every connected agent and API token is revoked as part of the deletion.

If you use Squire Chat inside WarRoom with your own model API key, the key is held in your browser (in memory, or in this browser's storage if you tick "Remember on this device") and sent to WarRoom with each question over an encrypted connection. WarRoom uses it only to send that question to the provider you chose, and does not store or log it. Your question, the earlier messages of that conversation, the page context you leave selected and the data Squire reads for the answer are sent to that provider and processed under its terms. WarRoom does not store your conversations. It keeps a one-hour session credential, per-question counts for usage limits, an audit line for each question (your account identifier, the session identifier, the provider, the number of steps and tools used, the outcome and the duration) and, like any agent, an audit line for each tool Squire uses (the tool, a one-way hash of its arguments, the number of records returned and the outcome), without the question, the answer or the key.

WarRoom does not use the data you send to agents, or agents' requests, to train AI models.

5. Browser Storage and Cookies

WarRoom and its authentication providers may use browser storage, authentication tokens and strictly necessary cookies to keep you signed in, preserve settings and secure the Service. Squire Chat keeps its settings in your browser's storage, and your model API key only if you choose "Remember on this device". The campaign tags, referring website and first page of your first visit are kept in your browser's storage for up to 30 days, as described in Section 1. Our visit counting sets no cookies. We do not use third-party advertising cookies.

Removing browser storage or blocking required storage may sign you out or prevent parts of the Service from working.

6. Cloud Synchronization

When you complete setup and use an authenticated account, selected settings and product records are synchronized through the Service and stored in PostgreSQL so they can be recovered and used across sessions or devices. This includes the profile, preferences, groups, alert records, tracked-symbol history and journal notes described above. Firebase Authentication remains the identity provider; it is not the authoritative application database.

Some settings may also be held locally in your browser for performance and continuity.

7. Retention and Account Deletion

We retain account data while your account remains active and as needed to provide the Service.

When you request account deletion:

Your account data, synchronized settings, forward-tracking history and notes enter a 30-day recovery period.
During that period, you may contact support to ask whether recovery remains available.
After 30 days, we delete or de-identify that account data unless retention is required for security, fraud prevention, dispute resolution or law.
Direct identity links in the retained device-abuse record are removed after the recovery period, while the pseudonymous identifier may be retained as described in Section 3.
The record of where you first came from (Section 1) is deleted with your account.

Payment, invoice and tax records are kept for as long as tax and accounting laws require, even after account deletion.

Requests sent through the in-app Contact and support form, including any screenshot, are deleted 30 days after they are sent. If your account is deleted sooner, they are deleted with it.

Other support correspondence may be retained for a reasonable period to resolve the request, maintain a record of our response and protect legal rights. Infrastructure and security logs may have separate limited retention cycles managed by the applicable provider.

Deletion from active systems may not immediately remove data from encrypted backups. Backup copies are isolated and expire through normal retention cycles.

8. Your Choices and Rights

You may contact support@warroomterminal.com to request:

Access to personal data associated with your account.
Correction of inaccurate account data.
Deletion of your account and associated data.
A portable copy of applicable information where reasonably available.
Withdrawal from promotional communications.
Information about or objection to particular processing, where applicable.

We may need to verify your identity before fulfilling a request. Rights vary by location and may be subject to lawful exceptions. We aim to respond within 30 days, although complex or legally constrained requests may take longer.

9. Security

We use reasonable technical and organizational safeguards designed to protect personal data. No service can guarantee absolute security. Protect your login credentials, use appropriate device security and notify us if you suspect unauthorized account access.

10. International Processing

Our providers may process or store data in more than one country. Data-protection standards may differ from those where you live. Where required, we and our providers use appropriate safeguards for international processing.

11. Legal and Safety Disclosures

We may preserve or disclose information where reasonably necessary to comply with law or a valid legal request; investigate fraud, abuse or security incidents; enforce our Terms; protect the rights and safety of users or others; or complete a business reorganization subject to appropriate protections.

12. Children's Privacy

The Service is for adults and is not directed to anyone under 18 or below the age of legal majority in their location. If we learn that a minor provided personal data, we will take reasonable steps to delete it.

13. Changes to This Policy

We may update this policy as the Service evolves, particularly before subscriptions, analytics or materially different data practices are introduced. We will provide reasonable notice of material changes through the Service, by email or both. Where required, we will request renewed consent.

14. Contact

Privacy questions and requests may be sent to support@warroomterminal.com.