Privacy Policy

1. What this product is, architecturally

The core PropSurvival browser engine is a client-side web application: calculations, CSV parsing, charts, saved strategies and browser-generated reports run on your device. We do not require a user account. Separately, we operate narrowly scoped public endpoints for explicit AI/plugin and decision-API requests; those endpoints are described in §3.10.

2. Data we do NOT collect

• Your trade history or CSV files — parsed locally, and saved (if at all) only in your browser's own storage on your device.
• Your locally entered browser-engine simulation inputs and locally generated results — same local storage, same device. This does not include fields you explicitly submit to an AI/plugin or API request; see §3.10.
• Your name, email, or identity — the engine has no signup.

You can verify the browser engine itself offline: open the platform, disconnect from the internet, and use its local analysis features. Paid report tools must first be downloaded with a valid licence while online; once stored on your device, they follow the existing licence term and offline grace rules. AI/plugin and API calls are separate network features and naturally require a connection.

3. The requests that do leave your device

The browser engine does not silently upload your trade history, CSV files or locally generated reports. The requests below are either infrastructural, explicitly initiated, or a standard part of loading a web page; §3.10 describes the fields sent when you deliberately use the AI/plugin or decision API.

3.1 Licence activation, revalidation and paid report tools

If you activate a paid licence, your browser sends your licence key and the product identifier to Gumroad's licence API. The activation and validation calls also specify whether Gumroad should increment its licence-use counter. The licence is saved in your browser's own storage, so you do not need to enter the key again on every report. Validation can repeat in the background when you open the app online, under the existing expiry, refund and offline grace rules.

To download a paid report tool for the first time, your browser sends your licence key, product identifier, requested report-module names and a signed proof of a locally generated public key to this site's /api/paid-module/ endpoint, operated on Cloudflare Workers. The matching private key remains non-exportable in your browser storage. The endpoint checks the licence with Gumroad without incrementing its use counter and delivers only entitled modules. The published limit remains 2 devices per licence. It is enforced through browser-profile registrations: each browser profile counts as one device activation, including separate profiles on the same physical device. Cloudflare D1 stores only SHA-256 digests of the licence/product pair and the public key, together with enrolment time; it never stores your raw licence key, private key, hardware fingerprint, email, IP address, trades, inputs, balances or report results in that registry. The registry has no automatic expiry or background cleanup: entries remain until support resets the registrations or handles a verified erasure request. Cloudflare automatically keeps earlier versions of this small registry for up to 7 days so it can be recovered after an operational error. This recovery history does not shorten your licence term or apply to your reports: reports stay on your device and are not included in that server backup. Clearing browser storage or replacing a device may require support to release an old seat: contact support@propsurvival.com with your purchase details, never your private key. Free browsing and previously downloaded report use do not contact that endpoint or database. Report calculations still run on your device.

Downloaded report code is cached in your browser. Using an already available tool does not trigger another module verification or download. A new device, cleared browser storage, or an updated report tool needs an online download again. A provider or network failure does not grant paid access or delete saved work; cached tools remain subject to the existing licence and offline rules. If you do not activate a licence, these licence requests do not occur.

3.2 Web fonts

None are fetched from a third-party font host. Every typeface this product uses is served from this site itself (/fonts/), so Google or another font host receives no request when a page loads. Charting and report code is also served by this site. The free engine runs locally after loading; previously downloaded paid report tools can also run locally under the licence and offline rules described in §3.1.

3.3 Rule-change alerts — retired

An earlier version of the product carried a "rule-change alerts" form: entering an email address sent that address, plus a one-word tag naming the firm preset you were reading (or general), to our newsletter provider (Buttondown). No simulation data, trade history, balances, results, or name was ever part of what it sent. That form does not exist on the site today — there is no page where you can enter an address to request alerts, and using the product now adds nothing to that list. If you subscribed while it was live, that address remains on Buttondown's list under their own policy; you can remove it with one click in any email they send.

The pricing page carried a second form like this one until checkout opened in 2026-08, when it was deleted rather than left standing — every tier on sale there became a plain buy link. A capture returned to that page on 2026-08-04, for one card only: see §3.6.

3.4 Outbound links on the reading pages

Some articles carry "share this" links to X and Reddit. These are ordinary links: nothing is requested from either site while you read, and no script from either site runs on our pages. A request reaches them only if you click, at which point you are on their site under their policy — and what travels is the page address and a title we compose, never anything from the engine.

3.5 Checkout (only if you buy)

Checkout is open. Clicking a buy button on the pricing page navigates you to that tier's own product page at Gumroad (propsurvival.gumroad.com), our merchant of record. That is a navigation, not a data transfer from the engine: the engine sends nothing, the link carries nothing about you, and nothing is requested from Gumroad until you click. Until then, no request reaches them at all — there is no embedded checkout script, no button pixel and no prefetch on this site. What happens once you are on their page is covered by §4 and by their own policy.

3.6 Personal Case File — corrected, 2026-08-05

The Personal Case File went on sale on 2026-08-05. Its card on the pricing page is now a buy button like every other paid tier's, covered by §3.5, not the "Tell me when it opens" email field this section used to describe: clicking it navigates you to that tier's own product page at Gumroad, and nothing is sent from this site before you click. The notify-me form is retired — it no longer exists on the page, and no address typed into a since-removed field is retained or used for anything.

3.7 First-party UI counts (no Worker, no third party)

The app records which tabs and which named buttons were used in a session, so we can see which parts of the product people actually open. On leaving the page, the browser requests a handful of tiny files on this same site (/e/t/…, /e/b/…, /e/q/…) — one request per used control. Those files are static assets: they do not run our Worker, they do not go to Google or any other analytics company, and they do not carry your trades, inputs, results, or licence key. Names that look like a licence key are dropped before the request is made. Query names such as firm or src may be counted as present in these /e/ requests; for src and utm_* only, a short sanitized value may also ride as a v= query parameter on the same static request (so calculator landings that never hit the Worker still show which channel named them). Anything shaped like a licence or secret is still dropped. (The separate server-side page measurement described in §3.8 also records source and campaign values on Worker-served pages.) You can block it the same way you block any other request this site makes — it changes nothing about the engine.

3.8 An anonymous count of which pages open (no cookie, no profile, no way to know it's you)

So we can see which pages people find useful, and roughly where visitors arrive from, and improve the ones that matter, our own site keeps a light, anonymous count when a page opens. It sets no cookie, no tracking pixel and no identifier of any kind — so there is no profile, we cannot tell one visitor from another, and we cannot follow anyone from one visit to the next. It stays entirely on our own systems: nothing is handed to Google or to any other analytics company.

What that count can note is deliberately small: which page opened (and, if a link pointed at a particular firm or plan, which one); if you arrived through a campaign or a shared link, the plain source it names — a search engine, a newsletter, a community — and the domain, only the domain, of the site you came from; your country; and the ordinary technical details any browser sends with a request. What it never touches: your IP address, a device fingerprint, any cookie or visitor ID, and — as everywhere on this site — your trades, your inputs, your results, or your licence key. Anything shaped like a key is dropped before it is ever written down.

Because there is no identifier at all, this can only ever be a tally — "a page opened; a visit came from that source" — never a record about a person, and we could not connect it to you even if we tried. It is kept only as anonymous, aggregated counts. You can block it exactly as you block anything else this site loads, and either way it changes nothing about the engine.

3.9 First-party funnel counts (same Worker, no cookie, no profile)

When a free run finishes and a verdict is painted, when you download a share card, when the free calculator's mid-evaluation interceptor note renders or its Pricing link is used, when a Desk surface is opened, a day is logged, or tomorrow's budget is viewed, or when the calculator shell itself opens, the app may request a same-origin path such as /evt/free_run_completed, /evt/verdict_viewed, /evt/share_clicked, /evt/interceptor_shown, /evt/interceptor_cta, /evt/desk_opened, /evt/desk_logged_day, /evt/desk_budget_viewed, or /evt/app_view. Some of those paths carry a _personal or _prop suffix as part of the event name only. The same mechanism also counts which screen of the app was opened (for example /evt/tab_analysis) and, as a name-only category — home, calc, scenario, benchmarks, article, pricing, interceptor, direct, or other — which kind of page the visit started from (for example /evt/tab_analysis_from_calc); never the specific article, firm, or link itself. Those requests go to our own Worker and are counted the same way as the anonymous page tally in §3.8 — no cookie, no visitor id, no licence key, no trades, no inputs, no results. The path names the event; the same allow-listed query names already described in §3.8 (src, utm_*, firm, and a domain-only referrer as rh) may ride so a calculator opening that never hits the Worker still counts with its source. Never trades, inputs, results, licence, cookie, visitor id, or a full referrer URL. You can block these requests the same way you block any other request this site makes; it changes nothing about the engine.

3.10 AI/plugin and decision-API requests

If you explicitly use a PropSurvival ChatGPT/plugin integration, another MCP client, or the public decision API, your client sends the fields needed for that request to https://propsurvival.com/mcp or /api/decision. Depending on the request, those fields can include a firm/program slug, account size, win rate, payoff or average-win/average-loss values, risk per trade, trades per day, or a personal rule limit. Do not send raw trade-history files, credentials, payment data, or other information the tool does not request.

These endpoints are unauthenticated and stateless at the application layer: they do not create a PropSurvival account and the decision service does not persist the request body as a user record. Standard hosting and security infrastructure may process ordinary request metadata needed to deliver and protect the service. Our first-party traffic measurement does not record POST bodies or the trader-profile fields in an assessment request. A rules lookup made by GET may contribute only the same allow-listed page/source fields described above, such as the requested firm slug and source tag; it does not turn the request into a user profile.

When you invoke PropSurvival through ChatGPT or another client, that client may separately process the conversation and tool call under its own terms and privacy policy. PropSurvival controls only the data handling of our own endpoints.

4. Payments

Purchases are processed by Gumroad as merchant of record. They collect and process your payment details, billing address, and email under their own privacy policy and handle applicable VAT/sales tax. We receive the order metadata needed to support you (e.g., that a license key was issued) — never your card details.

5. Cookies and local storage

The engine uses your browser's own storage on your device — not cookies — to save your inputs, saved strategies, and license state. It may ask the browser to keep this data persistent, but the browser can decline; either way, clearing your browser storage for this site removes all of it permanently. We cannot recover it, because we never had it.

Because that storage belongs to your browser rather than to us, a few consequences follow. We would rather state them than have you discover them:

• Nothing is synced between devices. A licence covers 2 devices, but your data does not travel with it — each browser holds its own copy.
• Clearing site data, or using a private window, deletes it, and we cannot restore it.
• Safari may evict site storage after a period of inactivity under its own storage policy, which is not something we control.
• The in-app export is your backup. It writes your data to a file you keep, and it is the only safety net there is — the alternative would be us holding a copy, which is exactly what this product is built not to do.

The same commitments are stated in §7 of the Terms; if the two ever disagree, that is a defect — please tell us.

6. Your rights (GDPR / CCPA)

Access, rectification, erasure, and portability rights apply to personal data a controller holds. We do not hold your local browser-engine trades, inputs or report results. The licence registry described in §3.1 is a separate server record: its digests are pseudonymous identifiers, not a claim of anonymous data. To request access, correction or erasure of those registrations, email support@propsurvival.com; support verifies the purchase before matching or changing the licence registry. Clearing browser storage does not erase that server record. For purchase records, contact our checkout provider or email us and we will assist. Before clearing site data, export any local reports you want to keep. Clearing storage also removes the browser-held device key, so a later paid-tool download may require a purchase-verified activation reset. To erase local data, clear this site's browser storage.

7. Children

This product is intended for adults and is not directed at anyone under 18.

8. Changes

Material changes to this policy will be dated at the top of this page. The architecture commitment — computation on your device — is the product's core design; a change to that would be a different product, announced loudly, not a quiet policy edit.

9. Contact

Privacy questions: support@propsurvival.com