App privacy notice

The controller of your data is Ombra Trading Ltd, a company registered in England and Wales, company number 17531482, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Ombra Trading Ltd is registered with the Information Commissioner’s Office (ICO): ICO registration number ZC276343. For any question about your data, or to use any of your rights, email craig@ombratrading.com.

• Your app account. Your email address, a securely hashed password (if you set one), your two-step sign-in settings, when you joined and your sign-in records (time, IP address and device type), used to keep your account secure.
• Google sign-in. If you choose “Continue with Google”, Google tells us your Google account identifier, your email address and whether it is verified. We do not get your Google password, contacts or anything else in your Google account.
• Broker logins you store. If you connect a trading account, the username and password or access token for it are encrypted before they are stored, with a key held in a separate key service. They are decrypted only to connect to your broker for you. Staff cannot read them, and they are never written to logs.
• Your settings and limits. Your own risk limits, layouts and preferences, so the app works the same on each device.
• Webhooks. If you set up a webhook (for example from a TradingView alert), we receive the message your alert sends to your private webhook address and act on it as you set up. We keep a short record of each message (time, result and any error) so you can see what happened.
• Shop purchases. If you buy an indicator or strategy in the Shop, Stripe takes the payment on our website and collects your TradingView username. We use the username only to give you access to the script on TradingView, and we record what you bought so it also unlocks in the app and the web app.
• Agreement signatures (OmbraProp section). If you sign an OmbraProp agreement or acknowledgement in the app, we keep a record of: which text and version you signed, a fingerprint (hash) of its exact text, the full name you typed, the date and time, the account it relates to, the app version you used and the IP address our server saw. The record is append-only: nobody at Ombra can change it, and it is kept for as long as OmbraProp account records (see below).
• Messages you send us, and our replies.

Kept on your device only: your trading journal and notes, the Ombra assistant’s chart descriptions (worked out on your device), and the Learn articles you have opened. Notifications are local: the app schedules them on your device, so we do not hold a push token for you.

Prices and market data never reach our servers. Market data goes from your broker or data provider straight to your device.

We send no marketing from the app. We make no automated decisions about you that have legal or similarly significant effects.

The Ombra app, the web app and OmbraProp share one Ombra account, held by Ombra Trading Ltd. OmbraProp is part of Ombra Trading Ltd. What is shared and what is not is set out in the main privacy notice. Other prop firms never get your data from us. To delete your account, see delete your account.

We do not sell or rent your data. These providers process it for us under contract:

• Cloudflare, Inc. hosts the web app and our servers (United States and worldwide, covered by the UK-US data bridge and its data processing addendum).
• A cloud key service holds the key that protects stored broker logins. We will name the provider here before the app is available to the public.
• Google, if you use Google sign-in, under its own privacy policy.
• Stripe processes Shop payments and also acts as a controller in its own right for payments and fraud prevention, under its own privacy policy.
• Resend sends sign-in and service emails (United States, under its data processing agreement).
• Your broker or trading platform (for example Rithmic) receives your login when you connect, under its own terms.
• Sumsub, for OmbraProp identity checks only, as described in the OmbraProp privacy notice.

• App account and settings: while your account is open, then deleted within 30 days of closing it.
• Stored broker logins: until you remove the connection or close your account, then deleted within 30 days.
• Sign-in and security records: 12 months.
• Webhook message records: 30 days.
• Shop purchases: 6 years after the tax year they relate to, as UK tax law requires.
• Agreement signature records: 6 years after your OmbraProp account closes (the time in which a legal claim can be brought), as for OmbraProp account records.
• Messages: up to 2 years after our last exchange, unless needed for a dispute.

The web app uses one essential sign-in cookie to keep you signed in. It is needed for the service, so it does not need your consent. There are no analytics, advertising or tracking cookies in the app or the web app.

You have the right to get a copy of your data, have it corrected, have it deleted (unless we must keep it, for example for tax or as a signature record), restrict or object to how we use it, and receive it in a common format. Email craig@ombratrading.com; we reply within one month, free of charge.

Please tell us first so we can put it right. You can also complain to the ICO: ico.org.uk/make-a-complaint, or call 0303 123 1113.

If we change how we use your data, we will update this page and its version number, and tell you in the app about any change that matters.