Privacy
Last updated: October 27, 2026
Dojix is a free, open-source Mac app. It has no servers, no accounts and no analytics. Your trading data stays on your Mac. This page explains exactly what the app stores, what it can send over the network, and when. Because the source code is public, you can check every statement here yourself.
1. What stays on your Mac
- Your journal — your trades, notes, tags, emotions and checklists are kept in a local database in
~/Library/Application Support/Dojix/. It is encrypted on disk with AES-256-GCM, and so are your trade screenshots. The decrypted journal exists only in memory while Dojix runs. - The encryption key — kept in your macOS Keychain. With App Lock on, the key is sealed with your password (PBKDF2-SHA256, 600,000 iterations), so the journal can't be decrypted without it.
- API keys you add — for optional online features, stored in your macOS Keychain.
- Preferences — your watchlist, trading checklist and display settings are kept in Dojix's ordinary preferences file, which is not encrypted.
2. What Dojix does not do
- No account, no sign-up, no subscription
- No telemetry, usage analytics or crash reporting
- No cloud sync and no server that receives your data
- No ads, and nothing to sell
- No automatic update checks — new versions are published on GitHub Releases
3. Optional online features
Dojix works fully offline. The features below are off by default and run only if you add your own key in Settings. Any usage is billed by that provider to you. Data goes directly from your Mac to the provider over HTTPS; nothing passes through anyone else.
| Feature | Provider | What is sent |
|---|---|---|
| AI recommendations (Edge Report > Run Analysis) | Anthropic | A summary of your statistics, only when you click (see 3a) |
| Live prices | Twelve Data, Polygon.io or OANDA | The currency pairs on your watchlist, with your key |
| Live prices from MetaTrader 5 | None (local file) | Nothing; Dojix reads a price file on your Mac |
| OANDA import | OANDA | Your OANDA token and account ID, to fetch your own trade history |
3a. AI recommendations — what is sent to Anthropic
If you add your own Anthropic API key and click Run Analysis in the Edge Report, Dojix sends a summary of your statistics: totals, and P&L and win rate by session, hour, day, pair, bias and volatility.
Never sent: individual trades, ticket numbers, notes, screenshots, or your name. Nothing is sent without your key and your click. Anthropic's handling of API requests is covered by Anthropic's privacy policy.
3b. Economic calendar
The economic calendar in Pulse downloads the public weekly calendar from nfs.faireconomy.media. No key is used and nothing about you is sent beyond the ordinary web request.
4. Security
- Journal and trade screenshots encrypted on disk with AES-256-GCM
- Optional App Lock with idle auto-lock; it also locks when the Mac sleeps, the screen locks, or you hide or minimize Dojix
- Password-protected backups (AES-256-GCM, PBKDF2-SHA256 with 600,000 iterations); a backup without a password is not encrypted
- Every connection uses HTTPS
Exports you create (CSV, PDF, backups without a password) are not encrypted. The full security model is in SECURITY.md.
5. Your control
Your data is local, so you control it directly: export it (CSV/PDF), back it up and restore it, or delete everything at any time. Deleting your data on your Mac deletes it everywhere, because there is no other copy.
6. This website
dojix.app is a static site hosted on GitHub Pages. It uses no cookies, no analytics and no tracking scripts, and has no forms. Like any website, the host (GitHub) receives standard request data such as your IP address, and the page loads its fonts from Google Fonts, which receives the same. Downloads and the source code are on GitHub, where GitHub's own privacy statement applies.
7. Changes
If the app's behavior changes, this page and the repository's README will be updated, and the date at the top will change.
8. Contact
Questions: open an issue at github.com/djctwo/dojix/issues. Please never post real trades, account numbers or API keys there.
Security problems: report them privately through the repository's private vulnerability reporting.