Privacy Policy & Cookie Statement

Last updated: 11 August 2026

This policy explains what personal data Vink (“Vink”, “we”, “us”) collects when you use vinkjournal.com and the Vink trading-journal application (the “Service”), why we collect it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Who we are (data controller)

The controller responsible for your personal data is:

Vinkesteijn Trading
Chamber of Commerce (KvK) number: 99781956
VAT (BTW) number: NL005410553B66
Address: Jan Steenstraat 6, 5143 GR Waalwijk, Nederland
Privacy contact: privacy@vinkjournal.com

2. What data we collect

Account data — your email address, an optional display name, and a securely hashed password. Your password is never stored in plain text.
Content you create — the trades, accounts, tags, notes, mental-state entries, reviews, portfolio holdings, and screenshots you add to your journal.
Settings you choose — your theme, your timezone, your review-reminder schedule, your daily loss limit, and what an accountability peer is allowed to see.
Accountability connections — if you invite someone, the email address you invited and, once they accept, the link between your two accounts and any messages they send you. See section 5.
Survey answers — if you answer one of our occasional surveys, what you answered, stored against your account so that each person answers once. Answering is always optional, and your answers are deleted with your account.
Payment data — none. Vink is in free beta, we take no card details and we use no payment provider. If paid plans launch, billing will be handled by a third-party payment provider and we will receive only limited details such as subscription status and the last digits of your card; we would not store full card numbers.
Technical & usage data — data needed to run the Service securely, such as your IP address (for rate-limiting and abuse prevention), plus anonymised performance and page-visit metrics that carry no cookie and no persistent identifier.
Cookies — see the Cookie Statement below.

3. How we use your data and our legal basis

To provide the Service (create your account, store and display your journal, run analytics) — legal basis: performance of our contract with you.
To process screenshots with AI (see section 4) — legal basis: performance of our contract.
To keep the Service secure (authentication, rate-limiting, preventing abuse) — legal basis: our legitimate interests.
To take payment, if and when paid plans launch, and to meet the tax/accounting obligations that follow — legal basis: performance of our contract and legal obligation.
To send account emails (email verification, password resets, important service notices) — legal basis: performance of our contract.
To ask you how Vink is working — occasional short surveys or research requests about your use of the Service — legal basis: our legitimate interests in understanding and improving it. Answering is always optional, and every such message carries a way to opt out. Opting out never affects the account emails above. If you object to this processing, tell us and we will stop.
To tell you what has changed in Vink — occasional short product-update notes — legal basis: our legitimate interests in keeping the people who use the Service informed about it. Every such message carries an unsubscribe link, and you can turn them off in Settings; doing so never affects the account emails above, and it is a separate switch from the surveys. We also record which of these notes you have already been shown, so you are not told the same thing twice.
Marketing email — we do not send it unless you have asked us to. If that ever changes it will be on the basis of your consent, opt-in and withdrawable.

4. Automatic extraction from your screenshots

When you upload a screenshot for automatic extraction, the image is sent to a third-party AI provider that reads the chart to pre-fill the trade details. That provider processes the image on our behalf as a data processor and, under its terms, does not use data submitted through its API to train its models. This processing may take place on servers located outside the EU (see section 6). If you prefer not to use AI extraction, you can enter trades manually.

We do not sell your personal data. It goes to two kinds of recipient: the service providers that help us run Vink, and — only if you choose it — an accountability peer you invite.

Service providers (sub-processors)

These act as our processors under a data-processing agreement, and fall into the following categories:

cloud hosting and infrastructure;
database hosting (your journal data);
file storage (your screenshots);
AI processing (screenshot extraction);
email delivery (account emails); and
payment processing — not in use during the free beta.

A current list of the specific providers we use is available on request — just email us at privacy@vinkjournal.com.

Accountability peers (people you invite)

Vink lets you invite someone to keep you accountable. Nothing is shared until you send an invitation and they accept it, and you can end the connection at any time from Accountability. While a connection is active, that person gets a read-only view which includes:

your name and the email address on your account;
whether you are within your daily loss limit today, and your run of days within it;
summary statistics for the period — number of trades, win rate, profit factor, net R;
a performance curve over time. The instrument names are removed, but the curve is drawn from your individual trades, so it shows the timing and relative size of each result;
discipline signals — how often you followed your plan, which risk-related emotions you tagged, and how recently you reviewed;
and, only if you switch it on, a short list of recent trades showing the instrument, date and time, direction, and outcome.

You control two further things per peer: whether they see cash amounts (with this off, they see R-multiples and percentages but no monetary figures), and the time period their view covers. A peer can send you short written messages. If you and that peer have both opted in, we email them when you reach your daily loss limit. We never show a peer your screenshots, your written notes, or your reviews.

6. International transfers

Some of the providers above process data in the United States or other countries outside the European Economic Area. Where that happens, the transfer is safeguarded by the European Commission’s Standard Contractual Clauses and/or the provider’s certification under the EU-US Data Privacy Framework.

7. How long we keep your data

We keep your account and journal data for as long as your account is active. When you delete your account, your journal is permanently deleted — your trades, screenshots (including the image files themselves), tags, accounts, reviews, portfolio, any accountability connections, any survey answers you gave, and the record of which product updates you were shown. This happens immediately, not on a queue.

Two things deliberately outlive your account, and you should know which. If you have emailed our support address, that correspondence is kept as a record of the exchange, with your account no longer linked to it. And we keep a log of the emails we have sent you — things like password resets and verification links — so we can investigate delivery problems and abuse. If you want either removed as well, email us at privacy@vinkjournal.com and we will do it unless we are required to keep them.

If paid plans launch, invoices and related accounting records will be retained for as long as Dutch tax law requires. Backups are rotated and expire on a routine schedule, so a deleted account can persist in a backup until that backup ages out.

8. How we protect your data

Passwords are hashed with bcrypt; connections are encrypted in transit (TLS). Your screenshots are private to your account and served only through an authenticated, owner-scoped proxy — never via public links. Access to production systems is limited.

9. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
correct inaccurate data;
erase your data (“right to be forgotten”);
receive a portable copy of your data;
restrict or object to certain processing; and
withdraw consent where processing is based on consent.

You can exercise two of these directly in the app at any time: Settings → Export my data (portability) and Settings → Delete account (erasure). The export is a JSON file containing your account details and settings, every trade with its notes and mental-state entries, your tags, accounts, reviews and portfolio; screenshot image files are not in it, so ask us if you want those too. For any other request, contact us at privacy@vinkjournal.com. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

10. Cookies

We use only a few essential first-party cookies — to keep you signed in, to remember your settings (such as your theme and privacy preferences), and to record your browser’s timezone so that “today” means your day rather than ours. We don’t use advertising or cross-site tracking cookies, so there’s no consent banner. We measure how the site performs and how many people visit which pages using privacy-friendly analytics that set no cookies, build no profile of you, and do not follow you to other sites. You can control or delete cookies in your browser settings, though disabling the essential sign-in cookie will stop you logging in.

11. Children

Vink is not intended for anyone under 18, and not for children under 16. We do not knowingly collect data from children.

12. Changes to this policy

We may update this policy from time to time. We’ll change the “last updated” date above and, for material changes, notify you by email or in the app.

13. Contact

Questions about this policy or your data? Email us at privacy@vinkjournal.com.