Privacy Policy

1. Information We Collect

Account Information

When you register, we collect information such as your email address, username, and password (stored in hashed form). If you sign in with Google OAuth, we receive your email address, display name, and profile picture URL from Google, as permitted by your Google account settings and our OAuth configuration.

Trading & Journal Data

To provide analytics, we store trading data you import or sync into the Service, including trade history, symbols, timestamps, profit and loss figures, commissions, psychology tags, checklist responses, notes, and related metadata. If you connect an exchange API key, we store encrypted credentials and retrieve read-only trading data as configured by you.

Payment Information

If you pay via cryptocurrency, we record wallet addresses, transaction hashes, plan selections, and payment amounts on-chain metadata visible to us. If you pay through Lemon Squeezy or similar processors, payment card details are collected and processed directly by those providers—we do not store full credit card numbers on our servers.

Usage & Device Data

We automatically collect certain technical information, including IP address, browser type, operating system, referring URLs, pages viewed, and timestamps. We use cookies and similar technologies as described below.

2. How We Use Your Information

• Provide, operate, maintain, and improve the Service.
• Authenticate users and manage accounts, subscriptions, and access levels.
• Generate analytics, performance statistics, and AI-powered features such as the AI Tilt Report.
• Process payments and prevent fraud or abuse.
• Send service-related communications (e.g., account notices, security alerts).
• Measure marketing performance and optimize advertising campaigns.
• Comply with legal obligations and enforce our Terms of Service.

3. AI Processing

Certain features, including the AI Tilt Report, send aggregated, non-raw trade heuristics (such as win rate, net P&L summaries, psychology tag counts, and checklist failure rates) to third-party AI providers, currently OpenAI, to generate informational insights. We do not send your full raw trade ledger to AI providers unless explicitly stated in-product. AI outputs are automated and may be inaccurate; they are not financial advice. See our Terms of Service for additional AI disclaimers.

4. Third-Party Tracking & Advertising

We use the Meta Pixel (Facebook) and related technologies to measure conversions, build audiences, and deliver relevant advertising on Meta platforms and partner networks. Meta may collect or receive information from your browser or device, including cookies, pixel events (such as sign-ups and purchases), and hashed identifiers where applicable.

You can learn more about Meta's data practices at facebook.com/privacy/policy. You may also adjust ad preferences through your Meta account settings or browser controls.

5. Third-Party Service Providers

We share data with trusted processors only as needed to operate the Service:

• Google — OAuth authentication.
• Meta (Facebook) — advertising analytics via Meta Pixel and Conversions API.
• OpenAI — AI-generated analytics and tilt reports from aggregated heuristics.
• Lemon Squeezy — payment processing for eligible fiat checkout flows (we do not store card data).
• Hosting & infrastructure providers — e.g., Vercel, Render, Supabase, or equivalent vendors that host our application and database.
• Blockchain networks — public on-chain data when you pay with cryptocurrency.

These providers are authorized to use your information only as necessary to perform services on our behalf and subject to contractual or legal obligations.

6. Cookies & Similar Technologies

We use cookies and local storage for:

• Authentication sessions and security (e.g., JWT tokens).
• Remembering preferences and onboarding state.
• Marketing attribution and conversion measurement (Meta Pixel).
• Analytics and product improvement.

You can control cookies through your browser settings. Disabling essential cookies may limit your ability to use certain features, including staying signed in.

7. Exchange API Keys

If you choose to connect an exchange API key (e.g., Binance), you should grant read-only permissions unless a feature explicitly requires otherwise and is clearly disclosed. We encrypt API credentials at rest and use them solely to retrieve data needed for journaling and analytics. You are responsible for securing keys on the exchange side and rotating them if compromised.

8. Data Retention

We retain account and trading data for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. You may request account deletion by contacting us; some data may be retained where required by law or for legitimate business purposes (e.g., payment records).

9. Data Security

We implement administrative, technical, and organizational measures designed to protect your information, including encryption for sensitive credentials, access controls, and secure hosting. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

10. Your Rights & Choices

Depending on your jurisdiction, you may have rights to access, correct, delete, or port your personal data, or to object to or restrict certain processing. To exercise these rights, contact us at the email below. We may verify your identity before fulfilling requests.

If you are in the European Economic Area, UK, or similar regions, you may also lodge a complaint with your local data protection authority.

11. International Transfers

Your information may be processed in countries other than your own, including the United States, where data protection laws may differ. By using the Service, you consent to such transfers subject to applicable safeguards.

12. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will take steps to delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect revisions. Material changes may be communicated via the Service or email. Continued use after changes constitutes acceptance.

14. Contact Us

Questions about this Privacy Policy or our data practices: support@chartreact.com