Your Data. Your Trades. Your Control.

1. Scope & summary

This policy describes how MAKETZO, operated by Abinic, LLC ("we", "us", "our"), collects, uses, stores, shares, and protects information when you visit maketzo.co, use our applications, or subscribe to our services. Abinic, LLC is the controller of the personal information described here.

2. What we collect

We collect the following categories of information, most of which you provide or create by using the Service:

• Account and identity. Your name and email, and either a password (stored only as an argon2id hash, never in plain text) or, if you sign in with Google, your Google account identifier and profile photo. We also record whether your email is verified, when you last changed your password, and whether your password has appeared in a known data breach (see Section 9).
• Sign-in security settings. If you turn on two-step sign-in, the secret your authenticator app uses to make codes (stored encrypted) and your recovery codes (stored only as one-way hashes). If you add a passkey, its public key and identifier, a usage counter, the name you give it, which passkey provider created it (for example Windows Hello or iCloud Keychain), whether it is synced across your devices, and the browser and operating system you added it from. The private part of a passkey never leaves your device, and we never receive your face, fingerprint, or device PIN. Your device checks those itself and tells us only that the check passed.
• Profile and self-reported details. Information you choose to add to tailor your experience, such as trading experience, trading style, markets traded, discipline challenge, and goals, plus any optional details you enter such as location, birthday, or a short bio. If you request indicator access, your TradingView username.
• Trading and financial data. The trades, profit and loss, sessions, notes, and statistics you log, and data you import from your broker (for example a DAS Trader export), which can include a broker account number, per-trade fills, commissions, and fees. This data exists because you create or import it.
• Behavioral data. Signals the discipline engine uses on your behalf, such as strike events, max-loss adherence, COACH SAYS triggers, lockout history, streaks, your Discipline Score, and reset and anchor events.
• Uploads and content. Images you upload (for example Focus Room anchor photos and journal pin images), journal entries, notes, and any file you attach when you use a share or email feature.
• Billing information. Your plan, subscription status, Stripe customer and subscription identifiers, and any account credit balance. We never see, store, or process your card details. Those are entered into and held by Stripe.
• Communications and consent. Emails you send us, contact-form submissions (including the consent choices you make on that form), your newsletter status, and, when you use a share or email feature, the recipient address you choose and the content you send.
• Referral data. Your referral code and, if you were referred or refer others, the connection between the accounts, which may include a referred person's email address.
• Technical, security, and audit data. IP address, browser and device type, pages viewed, and error logs needed to run and secure the Service. For security-sensitive actions, such as signing in, changing your password, turning two-step sign-in on or off, and adding or removing a passkey, we keep an audit record that includes IP address and browser user agent. Some anti-abuse and analytics processes use a one-way hashed form of your email rather than the address itself.

3. How we use your information

We use the information described above to:

• Operate the product. Authenticate your login, run the state machine, fire COACH SAYS, apply the strikes and lockouts you configure, deliver Edge and Pulse access, and store the data you log.
• Provide account features. Generate your own scores, insights, and coaching prompts from the data you log, using rule-based logic that runs on your data. See Section 5 on AI.
• Handle billing. Process subscriptions, trials, upgrades, refunds, and credits through Stripe.
• Communicate with you. Send service messages (welcome, verification, receipts, trial reminders, security and account notices) and, if you opted in, the newsletter. Every newsletter has a one-click unsubscribe. Service messages are required for account function and cannot be unsubscribed.
• Secure and improve the Service. Prevent fraud and abuse, debug, and understand which features work using aggregated, de-identified analytics. We do not publish individual data.
• Comply with law. Meet legal, tax, and regulatory obligations and respond to lawful requests.

4. Legal bases for processing (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we process your personal data on these legal bases:

• Performance of a contract. To create your account and provide the Service you subscribe to.
• Legitimate interests. To secure the Service, prevent fraud and abuse, understand usage in aggregate, and improve the product, balanced against your rights.
• Consent. For the newsletter and for non-essential analytics and cookies, where required. You can withdraw consent at any time.
• Legal obligation. To keep tax, billing, and other records the law requires us to keep.

5. AI and your data

The scores, prompts, and insights you see about your own trading are produced by our own rule-based logic running on the data you log. They are not generated by a third-party AI model. We do not currently offer AI-driven personal coaching. If we introduce a feature that would send your data to an AI model, it will be optional, clearly described, and off unless you turn it on.

6. Who we share with (service providers)

We do not sell your personal information. We share it only with service providers that help us run the Service, under contracts that limit their use of it to providing services to us. Our main providers are:

• Hosting and database. Our hosting provider stores the primary database that holds your account and trading data.
• Stripe. Payment processing. Stripe holds your card details; we hold only customer and subscription identifiers and status.
• Resend. Delivery of transactional and newsletter email, which includes the recipient address and message content.
• Google. Sign-in, if you choose Google. We request only your basic profile and email, and we never see your Google password.
• PostHog. Product and marketing analytics. Depending on your consent, this may include a device or anonymous identifier, events, and approximate location. On the public website only, it may also record how a visit moves through our pages, such as scrolling, clicks, and the pages opened, so we can see where visitors get stuck. Anything typed into a form is hidden from these recordings, and we never make them inside the app. It does not receive your trading data or your email address in plain text.
• Cloudflare. Storage of uploaded images and media, bot protection on sign-up and login (which receives your IP address), and content delivery, including reading an approximate country from your IP address so we can show the correct consent options.
• TradingView. To grant indicator access, we provide the TradingView username you give us so your account can be added to our invite-only indicators.
• Off-site backups. Encrypted database backups are stored with a cloud storage provider on a short retention schedule.

Some providers we use for editorial content, market data, or publishing (for example our AI model provider, our stock-image provider, our market-data provider, and our code host) do not receive your personal information. The same is true of the breach check described in Section 9: when we check a password against the Have I Been Pwned database, we send only the first five characters of a one-way hash of it, never the password itself and nothing that identifies you. We may also disclose information to comply with law, enforce our Terms, protect our rights and the safety of others, or in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this policy.

7. Cookies, analytics & tracking

We use the following cookies and similar technologies:

• Essential. First-party cookies required to run the Service: a secure, httpOnly session cookie (mkt_sess, up to seven days) and a CSRF-protection cookie (mkt_csrf). These keep you logged in securely and are not used for advertising.
• Sign-in security. If you tick “Trust this device for 30 days” on the two-step code screen, a first-party httpOnly cookie (mkt_trust, 30 days) remembers that this device passed the check. It holds no password and no code, and it stops working the moment you turn two-step sign-in off or set it up again. While you add a passkey or sign in with one, a first-party httpOnly cookie (mkt_pk, five minutes) holds the one-time challenge your device signs; it is cleared as soon as it is used.
• Referral. A first-party cookie (mkt_ref) that remembers who referred you so a referral can be credited.
• Analytics. We use PostHog to understand usage. This may set an analytics cookie or store an anonymous identifier. Analytics are subject to your consent choice where required.
• Stripe. Stripe sets its own cookies in the billing flow, governed by Stripe's privacy policy.

Consent. Visitors in regions that require it see a consent banner with a choice between "Accept all" and "Essential only". If you choose essential only, we do not persist an analytics identifier for you.

Newsletter emails. When we send the newsletter, we record whether each issue was delivered and opened, and which links you clicked. Opens are counted by a small image in the email, and each link passes through our own server on the way to the page. When a newsletter link brings you to our site, we connect that visit to your subscription, so we can tell which issues help readers. Where we ask before using analytics, we connect it only after you agree. We use this only to improve the newsletter. Turning off images in your mail app stops open counting, a Global Privacy Control or Do Not Track signal stops us connecting the visit, and unsubscribing, one click in every issue, ends all of it.

No advertising. We do not use advertising pixels, ad-network tags, retargeting, or data brokers. We honor a recognized Global Privacy Control or Do Not Track signal as a request to opt out of non-essential analytics and of any "sale" or "sharing" as those terms are defined by applicable law.

8. International data transfers

We and our service providers may process and store your information in the United States and other countries whose data-protection laws may differ from those where you live. Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or another lawful transfer mechanism. You may contact us for more information about these safeguards.

9. Security

We use commercially reasonable technical and organizational measures to protect your information, including encryption of data in transit, httpOnly session cookies with CSRF protection, access controls, and encrypted off-site backups. Your sign-in is protected in these specific ways:

• Passwords. We store your MAKETZO password only as an argon2id hash, so no one at MAKETZO can read it. A new password must be at least 12 characters and include an upper-case letter, a lower-case letter, a number, and a symbol. When you set a password, and each time you sign in with one, we check it against the Have I Been Pwned database of passwords exposed in public data breaches, using the privacy-preserving method described in Section 6. If your password appears there, we refuse it when you set it, or ask you to change it after you sign in. We do not force password changes on a schedule.
• Google sign-in. If you sign in with Google, Google confirms who you are and shares only your name, email address, and profile photo with us. We never see or store your Google password. Your MAKETZO password, if you set one, is separate and unaffected by any change to your Google account.
• Two-step sign-in (optional). When it is on, every sign-in also needs a six-digit code from an authenticator app on your phone, whichever way you signed in. The secret behind those codes is encrypted at rest (AES-256-GCM), and recovery codes are stored only as one-way hashes and work once each. A copy of our database alone is therefore not enough to pass this step.
• Passkeys (optional). A passkey signs you in with your device’s own face, fingerprint, or PIN check. We hold only the public key, which cannot be used to sign in on its own. Because your device has already confirmed it is you, a passkey sign-in does not also ask for a two-step code. Adding a passkey never removes your password or Google sign-in, so losing a device never locks you out.
• Sessions and limits. Changing or resetting your password signs you out on every other device, and you can do the same at any time from your account security settings. We limit repeated sign-in, code, and passkey attempts from the same address or for the same account.
• Notices and support. We email you when a passkey is added to your account. Our support staff cannot see your password or your two-step secret. If you lose both your phone and your recovery codes, support can turn two-step sign-in off for you; that action is logged with a written reason, signs you out everywhere, and is confirmed to you by email. We will never ask you for your password or a sign-in code.
• Exports. A data export never includes your password hash, your two-step secret, your recovery codes, or your Google account identifier.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. You are responsible for keeping your password, devices, and recovery codes secure.

Breach notification. If a breach affecting your personal data occurs, we will notify you and the relevant authorities as, and within the time, required by applicable law.

10. Automated processing and the behavioral engine

MAKETZO's discipline features (including strikes, gates, lockouts, and the Discipline Score) process the data you log automatically, measured against limits and rules you set for yourself. These features produce behavioral prompts inside the application. They are overridable by you, do not connect to your broker, and do not make decisions that produce legal or similarly significant effects about you, such as decisions about credit, employment, or eligibility. We do not use your data for automated decision-making of that kind.

11. Data retention

We retain your account data for as long as your account is active. When you delete your account, we delete or de-identify your personal data within 30 days, except for information we need to retain for legal, tax, security, fraud-prevention, dispute-resolution, or record-integrity purposes. Retained records may include billing and transaction records (typically up to 7 years), audit logs, edit-history records, and limited records needed to enforce our Terms or defend legal claims. We are working to narrow the categories retained after deletion.

Aggregated and fully de-identified data, which cannot reasonably be linked back to you, may be retained indefinitely for analytics and product improvement.

12. Your choices & controls

You have meaningful control over your information:

• Export. Download a copy of your account and trading data from your account page.
• Delete. Delete your account from your account page. Deletion follows the schedule and exceptions in Section 11.
• Correct. Update your information directly in the app, or email us for anything the interface does not expose.
• Unsubscribe. Use the one-click link in any newsletter. Service messages are required for account function.
• Manage analytics. Use the consent banner where offered, or a Global Privacy Control signal, to limit non-essential analytics.
• Secure your sign-in. From your account security settings, change your password, turn two-step sign-in on or off, add, rename, or remove passkeys, disconnect Google, and sign out every other device.

To make any request, use your account settings or email info@maketzo.co. We may need to verify your identity before acting on a request.

13. Your rights in the EEA and UK

If you are in the EEA or the UK, you have the right to access, correct, delete, restrict, or object to our processing of your personal data, to data portability, and to withdraw consent at any time without affecting processing already carried out. To exercise these rights, email info@maketzo.co. You also have the right to lodge a complaint with your local data-protection supervisory authority, though we ask that you contact us first so we can try to resolve your concern. The controller is Abinic, LLC.

14. Your rights in California and other US states

Depending on your state of residence (including California under the CCPA as amended by the CPRA, and similar laws in states such as Virginia, Colorado, and Connecticut), you may have the right to know or access the personal information we hold about you, to have it corrected or deleted, to obtain a portable copy, and to opt out of the "sale" or "sharing" of personal information and of certain targeted advertising and profiling.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by these laws. The categories of personal information we collect, the purposes for which we use them, and the categories of providers we disclose them to are described in Sections 2, 3, and 6. We will not discriminate against you for exercising any of these rights. To exercise a right, email info@maketzo.co. You may use an authorized agent, and we may need to verify your identity or your agent's authority.

15. Children & age

MAKETZO is intended for adults 18 years or older. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us with information, contact us and we will delete it.

16. Changes to this policy

We may update this policy as the product and the law evolve. When we make material changes, we will update the "Last updated" date at the top and notify you by reasonable means, which may include an in-product notice or an email to active subscribers. Where a change requires your consent under applicable law, we will obtain it. We will not retroactively reduce your privacy rights without your consent.

17. Contact us

For privacy questions, data requests, or complaints, contact the controller, Abinic, LLC:

• Email: info@maketzo.co
• Form: maketzo.co/contact
• Mail: Abinic, LLC, Attn: Privacy, 2110 Town Center Way #1094, Livingston, NJ 07039

We will respond as soon as we reasonably can, and within any timeframe required by applicable law.