Backups and privacy

Export and restore

Export a JSON backup in Settings and save it through system sharing. Current schemaVersion=3 includes trades, notes, weekly reviews, original images, version histories for rules/plans/execution/reports/actions, and pending images with quick notes. v1/v2 backups remain restorable. Restore merges and rolls back the entire batch on conflict, preserving existing differing reviews. Backups are limited to 80 MiB including base64 overhead. Verify recovery before clearing the original device.

Protect your backup

Exported JSON is not additionally encrypted and may contain trading records, notes and images. Store it somewhere you trust. It does not contain workspace credentials or language preferences.

Uninstalling or clearing app data may remove local records. Production accounts, cloud sync and remote recovery are not available yet. A successful connection check is not a completed backup.

Test and production

Environment switching currently remains available in all builds, including release. Confirmation is required. Each environment has a separate ledger; switching does not copy records.

The help center and line tests do not send trades, screenshots, notes or workspace tokens. Manually refreshing an online document requests only public HTML.

Opt-in public market data

Quotes are disabled by default. Enabling sends public symbols and intervals to the market provider; it does not automatically upload trades, returns, journals or screenshots. Subscriptions run only in the foreground for visible market consumers, without background price notifications. Market cache is separate from the ledger and isolated by environment. It is excluded from trading JSON backups; clearing it does not remove trades, notes or original images.

Separate spot and futures markets

Tap or swipe the Spot / Futures tabs in Watchlist. Each market has its own symbols, quotes, candles, connection and cache. The home card changes market directly through visible segments. Earlier watchlists and cache remain spot data.

Perpetual trade details open a futures reference; expanded and current charts preserve market identity. The provider may differ from your trading venue. Missing futures history never falls back to spot candles. Reference data never changes saved profit or fees.

Home market table and historical candles

Home and More markets share three columns: pair/24h turnover, last price/USDT or connection status, and a change badge. Coin logos and full names are hidden for now. More markets has no reserved star column. The top + opens a bottom sheet to select a pair and confirm Follow or Unfollow. Unknown values remain unavailable; base volume is not quote turnover, and USDT is not assumed equal to USD.

Charts load real historical candles and merge current WebSocket updates separately for each market. Each request is bounded to 1500 candles and four pages. Use a larger period for long trades. Missing intervals remain explicit; current prices or the other market never fill history. Requests send symbols, periods and chart time windows, not journal profit, notes or images.

Local cache directory

Settings → Clear cache now lists Market cache and Local cache directory separately. The local option clears temporary files and regenerable images after confirmation, keeps active files and never deletes persistent records or originals. Read Privacy terms and Privacy policy from About or Help center. Documents open online in your app language, with a bundled fallback when offline.

Optional online assistance

Organization, accounting and reconciliation run on this device by default. Turning online assistance on does not give ongoing permission: preview and approve each transmission. The development online tasks produce weekly-report and text-table mapping candidates and never adopts a claim or changes a trade automatically.

For weekly reports, the gateway receives selected exact metrics and fixed summaries with randomized evidence references. Original CSV files, screenshots, account aliases, exchange order IDs, paths and private notes are excluded. The send preview identifies the supplier, model and operator-reviewed policy. Only explicitly accepted claims become a new local report version.

Gateway content is held in memory for at most one hour. Minimal task-status and quota metadata is retained for thirty days. Supplier processing follows the displayed policy; zero retention is not promised. Cancellation of already sent work is best effort; failed work may consume a reservation. Generation requests are not automatically resubmitted. Full accounts and automatic cloud sync remain unavailable.

Mapping tasks separately share approved headers, fixed type profiles and sample counts, never raw cells. Up to the first 200 rows are profiled locally. Common sensitive columns start excluded; automatic masking cannot cover every personal detail, so review each request. Model proposals never import trades automatically.

Automatic screenshot recognition (development build)

Edit or redact images in the preview. Confirming opens Images to review. If intelligent assistance is effectively enabled and available, edited compressed screenshots are sent automatically to DeepSeek for recognition. Disabled or unavailable assistance creates no AI task; on-device recognition remains. Cancelling the preview sends nothing.

Results appear as separate records on the same page. Tap a record to select its source and review direction, time and fees; only explicit saving books it. The standalone Screenshot AI page and button are removed. Manual edits are preserved. Leaving or backgrounding cancels unfinished recognition without automatically resending.

Anonymous installation and activity statistics

On first connection and foreground use, TradeNote sends a random installation ID, a SHA-256 digest of an app-scoped device identifier, model, OS version, app version, language and network type to its own service. It does not send IMEI, MAC, serial number, location, Wi-Fi name, contacts, trades, screenshots or notes. These identifiers are not sent to market or AI providers. Connection IP is used for transport and rate limiting; the installation database does not store raw IP addresses.

The installation ID lives in non-backed-up app storage and normally changes on reinstall. Ledger backup, cache clearing and clearing trading records do not move or reset it. The device digest may change with OS, signing, user or vendor-app changes; neither ID is a cross-device account or an authentication credential.

Statistics use Asia/Shanghai calendar dates. Daily activity counts distinct foreground installations; background heartbeats stop. A new installation is counted at its first successful registration, so old-version and never-online installs cannot be reconstructed. Daily deduplication records are kept for 400 days; first/last activity and minimal metadata are retained for long-term installation statistics and future customization. Only authenticated administrators can view this list. No ledger data is collected.