Privacy policy
Last updated: 13 November 2026 (version 2)
This policy explains what personal data Dojiwave collects, why, and what you can do about it. It covers the website dojiwave.com and RiskDeck, our panel for MetaTrader 5.
1. Who we are
Dojiwave is run by Tomasz Krygowski, Northern Lights Tomasz Krygowski, ul. Chmielna 73B lok. 14, 00-801 Warszawa, NIP 6842525717, Poland (“we”, “us”). We are the controller of the personal data described below. Contact: [email protected].
2. The short version
- RiskDeck keeps your trading data on your computer. We don’t receive your trades, logs or settings.
- We receive personal data only when you write to us (contact form, e-mail), for example when you send a Diagnostics report to support, or when you use the AI assistant on our home page.
- This website sets no cookies and runs no analytics scripts in your browser. Our server counts visits in a way that doesn't identify you (see “Visit counts”).
- We never ask for the password to your trading account, and we never sell your data.
3. This website
dojiwave.com is hosted on Cloudflare Pages. To deliver and protect the site, Cloudflare processes technical data about each visit, such as your IP address, browser and the page you asked for. The website itself:
- sets no cookies and stores nothing on your device;
- uses no analytics scripts, no cookies and no advertising, and doesn't track you across sites or visits;
- loads its fonts and scripts from dojiwave.com, with one exception: Cloudflare Turnstile, the bot check, which loads from Cloudflare when you start filling in the contact form or send your first question to the AI assistant.
Links to the MQL5 Market take you to MetaQuotes’ website, which has its own privacy policy.
Visit counts. To see which pages people read, where they come from and which buttons work, our server counts each page request. It records the page address, the domain of the site that sent you (not the full address), the campaign tags in the link (utm_source, utm_medium, utm_campaign), your country and whether you use a phone or a computer. When you click a button that leads to another site, such as MQL5 or the Tapebook app, it records which button and on which page. It doesn't record your IP address, a cookie, any identifier or your full browser details, so we can't recognise you or link your visits. Cloudflare, our hosting provider, works out your country from your IP address and keeps these counts for us for up to 3 months. Legal basis: our legitimate interest in knowing how the site is used (GDPR Art. 6(1)(f)). You can object by writing to us; because the counts don't identify you, we usually can't pick out your data.
4. Our former waiting list
We no longer run a waiting list. If you joined it, we'll use your address once more, to tell you that sales have started, as you agreed when you signed up. Within 30 days of that e-mail we close the list and delete the addresses. If you'd rather not get it, use the link in any of our e-mails or write to us, and we'll delete your address straight away. To show that we had your consent, we keep a code made from your e-mail address with a secret key (pseudonymised data), the dates of sign-up, confirmation and leaving, and the consent wording, as described in the table below.
5. AI assistant
The home page of dojiwave.com has an AI sales assistant that answers questions about RiskDeck and Tapebook. It starts only when you open the chat window. You are talking to an automated system, not a person.
What we process. The questions you type and the assistant's answers. The conversation is kept only in the memory of the open browser tab and disappears when you close or reload it. We do not store it on our server or in logs.
Where it goes. Each question, together with the conversation so far, is sent to the language model provider, Anthropic, which processes it on our behalf, including in the United States, under standard contractual clauses. Anthropic deletes the content of requests within 30 days. It may keep content it considers a violation of its usage policy for longer.
Limits and abuse protection. So that one person or a bot cannot overload the assistant, we count conversations and messages. We store the daily number of conversations and the number of messages linked to a code made from your IP address, the date and a secret key. We do not store the IP address itself, and these entries are deleted after 48 hours. Before the assistant answers your first question, Cloudflare Turnstile checks that you are not a bot. For this, Cloudflare, as our processor, processes your IP address and technical signals from your browser; it doesn't count or follow visitors. It runs only because you use the assistant, so it doesn't ask for consent.
Legal basis. Article 6(1)(f) GDPR, our legitimate interest: answering your questions about our products and protecting the site from abuse.
Please do not enter personal or confidential data in the conversation. The assistant answers only from published product information and can be wrong: the product pages and the terms of sale are binding, not the automated answers. It does not give trading or investment advice.
6. Contact form
If you write to us through the contact form, we process your e-mail address, your name if you give it, and your message, to reply to you. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in answering the questions sent to us; when you write about a purchase you made or want to make, Art. 6(1)(b) GDPR. When you start filling in the form, Cloudflare Turnstile checks that you are not a bot; for this, Cloudflare, as our processor, processes your IP address and technical signals from your browser. It runs only because you use the form, so it doesn't ask for consent. Your message is delivered to our mailbox by dHosting.pl, our e-mail hosting provider in Poland, which processes it on our behalf. We keep the correspondence for 12 months after our last reply, to answer follow-up questions and to defend against claims, and then delete it. Please don't send passwords or your trading account number through the form.
7. RiskDeck
- RiskDeck stores its settings, event log and journal on your computer, in your MetaTrader data folder (
MQL5\Files\RiskDeck). These files include your trading account number, broker and server. They are not sent to us. - RiskDeck uses no DLLs and no web requests. The only things that leave your computer are the orders MetaTrader sends to your broker and, if you turn them on, notifications (push and e-mail).
- Notifications. RiskDeck can tell you about events: a limit breached, positions closed after a breach, break-even set, a partial close and a position closed. Each event can go to your phone as a push notification, by e-mail, or both. Both channels are off by default and work only while your terminal is running. A notification contains the event and the details of the position concerned, such as the symbol and volume.
- Two safety alerts are always on and go to your phone if you have set up push notifications in MetaTrader: a position RiskDeck could not put a stop on, and positions that
Close all on breachcould not close. Push notifications go through MetaQuotes’ servers to the MetaQuotes ID set in MetaTrader, under MetaQuotes’ privacy policy. E-mails are sent by MetaTrader through the mailbox and mail server you set in MetaTrader (Tools → Options → Email), to the address you set there. We don’t receive either. - RiskDeck is sold through the MQL5 Market. MetaQuotes processes your purchase, your MQL5 account and your activations under its own privacy policy.
8. The Diagnostics report
If something doesn’t work, support may ask you for a Diagnostics report. You create it yourself and you decide whether to send it.
- How it is made: in RiskDeck’s Settings, the row
Diagnostics report, presssave. RiskDeck writes one text file toMQL5\Files\RiskDeck\diagnosticson your computer. The file name has the date, time and version, never your account number. Saving it sends nothing and changes nothing, and RiskDeck deletes its reports from your computer after 90 days. - What is inside: the version, your RiskDeck settings, the environment (terminal, broker, server, account type) and the last lines of the log. Your account number appears only masked (for example
47****18), and your Windows user name is replaced with<user>. It never contains your name. - How to send it: a private message on MQL5, or an e-mail to [email protected]. Please send it privately, never in a public comment, because it contains details of your account (broker, server, settings).
- What we do with it: we use it only to handle your request. We keep it for 90 days after your request is closed, and you can ask us to delete it sooner at any time.
9. What we collect, why, and on what legal basis
| What | When | Why | Legal basis (GDPR) | How long |
|---|---|---|---|---|
| E-mail address of a person on our former waiting list, with the record of their consent | Until we close the list | To tell you once that sales have started | Consent, Art. 6(1)(a) | Until 30 days after that e-mail, or until you withdraw consent, whichever comes first |
| A code made from your e-mail address with a secret key (HMAC-SHA-256; pseudonymised data), dates of sign-up, confirmation and leaving, the consent wording, the form's address | You leave the list or we close it | To show that we had your consent and defend ourselves against claims | Legitimate interest, Art. 6(1)(f) | 5 years from leaving or from our last e-mail to you, whichever is later |
| Your message, contact details and attachments, including a Diagnostics report | You contact support | To answer you and fix the problem | Contract, Art. 6(1)(b), if you bought or rent RiskDeck; legitimate interest, Art. 6(1)(f), for other questions (answering you) | 24 months after the last message in the case; a Diagnostics report 90 days after the case is closed |
| Technical data: IP address, browser, page requested | You visit dojiwave.com | To deliver and secure the website | Legitimate interest, Art. 6(1)(f) | We don’t keep it ourselves. Cloudflare processes it for us for a limited time. |
| Visit counts | Each page request and outbound button click | Site statistics | Art. 6(1)(f) | Up to 3 months |
When you write to us. If you e-mail us, for example about a custom tool, we process your e-mail address, your name if you give it, and what you write, to answer you, prepare a quote and, if we agree, to conclude and perform the contract. Legal basis: Article 6(1)(b) GDPR (steps at your request before a contract, and the contract) and Article 6(1)(f) GDPR (our legitimate interest in handling correspondence and defending claims). We keep the correspondence while we discuss your project and, if no contract follows, for no longer than 12 months after the last message. If we work together, we keep it for the duration of the contract and until claims become time-barred, and invoices for 5 years from the end of the tax year, as tax law requires.
10. Who processes data for us
- Cloudflare hosts dojiwave.com, stores the addresses of our former waiting list until we delete them, checks with Turnstile that a person, not a bot, is using the contact form and the AI assistant, provides the assistant's usage limits, processes the technical data above on our behalf, and counts visits for us.
Cloudflare delivers this site and, as part of that, counts requests to it. We see only totals: number of requests, approximate number of unique visitors, and the countries traffic comes from. We do not see IP addresses or any information about individual visitors, and nothing is read from or stored on your device for this purpose. Cloudflare keeps these totals for about one month. Legal basis: our legitimate interest in knowing how much the site is used (Art. 6(1)(f) GDPR).
- dHosting.pl (dhosting.pl Sp. z o.o., Warsaw, Poland): hosts our mailbox and delivers the messages from the contact form.
- Anthropic (provider of the language model behind the AI assistant). It receives the content of your conversation with the assistant and processes it on our behalf, including in the United States, under standard contractual clauses.
- MetaQuotes runs the MQL5 Market, MQL5 messages and the push notifications you enable, under its own privacy policy.
Cloudflare, Inc. is based in the United States. Where it processes data there, the transfer relies on the EU-U.S. Data Privacy Framework; where the Framework doesn’t apply, on the EU Standard Contractual Clauses in Cloudflare’s data processing addendum.
11. Your rights
You can ask us for access to your data, correction, deletion, restriction and portability, and you can object to processing based on legitimate interest. You can withdraw your consent at any time, without affecting what we did before. Write to [email protected]. You can also complain to the Polish supervisory authority, the President of the Personal Data Protection Office (uodo.gov.pl).
Data kept only on your computer, such as RiskDeck’s files, is under your control. We can’t access, correct or delete it, and you don’t need to ask us to.
12. Age
RiskDeck and our other products are for adults. We don't knowingly collect data from anyone under 18.
13. Changes
If we change this policy, we'll update the date at the top.
Earlier versions: 13 November 2026