Last updated: 5 September 2026

Privacy policy

Stefano Falasca, Italy, is the data controller for the processing described here. This notice explains which data the service uses, why it uses them and the choices available to you.

Data we process

We process your name, verified email address, language and, when selected, your Google or Facebook identifier. Authentication data include session hashes and the public identifiers and public keys of passkeys; biometric data and private keys never reach Pip Coaster. When you connect a terminal, we process the account number, broker server, currency, balance, equity, margin, positions, deals, cash movements and related technical data. Push subscriptions contain the endpoint and public encryption keys required for delivery.

Purposes and legal bases

We use data to create and secure your account, connect MetaTrader accounts, calculate and display performance, manage portfolios and sharing, deliver requested notifications, diagnose faults and prevent abuse. Processing needed to provide the service is based on performance of the service requested by you; security is also based on our legitimate interest, legal obligations are processed when applicable, and optional notifications can be withdrawn at any time.

Recipients and transfers

Data are visible to the people with whom an account owner chooses to share access. We may use providers for hosting, databases, backups, transactional email and Web Push. Google or Meta receives data only when you choose its sign-in method. Providers act under their own terms or as processors, as applicable. Where data leave the European Economic Area, we use an applicable lawful transfer mechanism.

Retention

Authentication sessions normally expire after 90 days, one-time authentication challenges after about 5 minutes, raw equity samples after 90 days and production backups after 30 days. Trading history and daily aggregates are kept while the connected account remains in the service and are deleted when its owner removes it, subject to legal, security or backup retention requirements.

Your rights

You may request access, correction, deletion, restriction, portability or objection where applicable, and may withdraw consent without affecting earlier processing. You may also complain to your competent data protection authority. We use access controls, hashed tokens, encrypted transport and read-only terminal access, but no online system can guarantee absolute security.

Contact

For questions, privacy requests or complaints: