Privacy Policy

Last updated 21 August 2026

Takumi Systems ("Takumi", "we", "us") is an independently operated software business based in the Philippines. This policy explains what personal data we collect when you use our websites and applications, why we collect it, who we share it with, and what you can do about it.

It covers takumisystems.com and the Takumi Journal, Takumi Copier and Takumi Ledger applications.

We never store your broker password. Takumi Journal reads trade history from a MetaTrader 5 terminal that is already open and logged in on your own computer — it is never given your login credentials. Takumi Copier authenticates using an API key that Takumi itself issues, stored only as a SHA-256 hash. Nothing we hold can be used to log in to your broker or move your money.

1. What we collect

Account information

Your email address, and a display name if you provide one.
Either a password, stored only as a bcrypt hash that cannot be reversed, or a Google account identifier if you choose to sign in with Google. If you use Google, we receive your email address, name and Google account ID — never your Google password.
If you enable two-factor authentication, an encrypted authenticator secret and hashed recovery codes.
Timestamps for account creation, email confirmation and last sign-in.

Data you create in the applications

Journal: trades, notes, strategies, tags, screenshots you upload, and conversations with the AI coach.
Copier: trading account labels, account numbers, broker server names, balance and equity figures reported by your terminal, copy settings, and an activity log of commands issued.
Ledger: transactions, categories and any files you import.

Technical data

IP address, used to rate-limit sign-in attempts and block abuse. Retained in server logs for a short period.
Aggregate analytics on the public marketing site only: page views, referrer and approximate country. We use a self-hosted Umami instance which sets no cookies and does not fingerprint or track you across sites. The applications themselves carry no analytics.

Support and payments

Messages and attachments you send us through the in-app support form.
If you buy a paid plan, payment is handled by our payment provider. We receive confirmation of your subscription status and never see or store your full card details.

2. Why we use it

Purpose	Basis
Creating and securing your account; signing you in	Necessary to provide the service you asked for
Storing and displaying the trades, transactions and notes you enter	Necessary to provide the service
Generating AI coaching and weekly reviews	Necessary to provide the feature you chose to use
Rate-limiting, abuse prevention and fraud protection	Our legitimate interest in keeping the service available and secure
Sending service email (confirmation, password reset, support replies)	Necessary to provide the service
Aggregate, cookieless analytics on the marketing site	Our legitimate interest in understanding what the site is used for
Billing and subscription management	Necessary to perform our contract with you

We do not sell your personal data. We do not share it for advertising, and we do not use your trading data to train AI models.

3. The AI coach

When you use the AI coach or receive a weekly review, the relevant content — your question and the trade statistics needed to answer it — is sent to our AI provider to generate a response. That provider processes it to return the answer and does not use it to train their models.

If you would rather no trading data left our servers at all, simply do not use the AI coach. Every other part of Takumi works without it.

4. Who processes data on our behalf

We keep the list short deliberately. Each of these is a service provider acting on our instructions, not a party we sell data to.

Provider	Purpose	Data involved
Contabo	Server hosting	All application data, stored in the EU
Cloudflare	CDN, DDoS protection, encrypted offsite backups	Traffic metadata; encrypted database backups
Resend	Transactional email delivery	Email address and message content
OpenRouter / Anthropic	AI coach and weekly reviews	Only the content of the specific request
Google	Sign in with Google, if you use it	Email, name, Google account ID
Lemon Squeezy	Payments and subscriptions	Billing details, handled entirely by them

5. Retention and backups

Your account data is kept for as long as your account exists.
Encrypted database backups are held for 30 days and then automatically deleted. Data you delete may persist in those backups until they expire.
Server access logs are kept briefly for security and troubleshooting.
Support tickets are retained so we have a history of your requests. Product feedback is anonymised rather than deleted when an account is erased.

6. Your rights

Under the Philippine Data Privacy Act of 2012 (RA 10173), and under the GDPR if you are in the UK or EU, you have the right to:

Access the personal data we hold about you
Correct anything inaccurate — most of it you can edit yourself in the app
Delete your account and the data in it
Object to processing based on legitimate interests
Receive your data in a portable format
Complain to the National Privacy Commission, or your local supervisory authority

Deleting your account removes your identity record and the data held by each product. Email [email protected] and we will action it. Bear in mind deletion is permanent and your trading history cannot be recovered afterwards, so export anything you want to keep first.

7. Security

All traffic is served over HTTPS; the applications are not reachable over plain HTTP.
Passwords are stored as bcrypt hashes. We cannot see or recover them.
Optional two-factor authentication, with the secret encrypted at rest.
Administrative access requires a second factor beyond the normal session.
Database servers are not exposed to the internet; only the web layer is public.
Backups are encrypted in transit and at rest, and restores are tested.

No system is perfectly secure. If you believe your account has been accessed by someone else, change your password immediately and contact us.

8. Cookies

We use one essential cookie to keep you signed in across the Takumi applications, plus a short-lived cookie during Google sign-in to protect that flow against cross-site request forgery. Both are HttpOnly, meaning page scripts cannot read them.

We set no advertising or third-party tracking cookies. Our analytics are cookieless.

9. Children

Takumi is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.

10. International transfers

Our servers are in the EU. Some providers listed above operate in other countries, including the United States. Where data leaves the EEA it is transferred under appropriate safeguards, such as Standard Contractual Clauses.

11. Changes to this policy

If we make a material change we will update the date at the top and, where the change meaningfully affects you, notify you by email. Continuing to use Takumi after a change means you accept the updated policy.

12. Contact

Questions, requests or complaints about privacy: [email protected]