Privacy Policy

We collect: (a) data you provide — name, email address, password (stored only as a secure hash), language preference, uploaded chart images, journal entries and imported trade history, chat and support messages, and affiliate payout details; (b) data generated by your use of the Service — analysis history, settings, usage counters, and subscription and order records; (c) technical data — IP address, approximate location, device and browser information, cookies, and log and security data; and (d) attribution data — referral codes and advertising identifiers (such as Google click IDs) when you arrive via a partner link or an ad. We do not intentionally collect sensitive categories of data and ask that you not include them in uploads or messages.

We use personal data to: provide and operate the Service (performance of contract); process payments, verify licenses, and prevent fraud and abuse (contract and legitimate interests); secure, debug, measure, and improve the Service (legitimate interests); send transactional messages such as receipts, security alerts, and subscription notices (contract); send marketing communications where permitted (consent or legitimate interest, with opt-out available at any time); and comply with legal obligations such as accounting and tax rules. Where processing is based on consent, you may withdraw it at any time with effect for the future. We do not sell personal data.

When you request a chart analysis, auto-draw, chat reply, or similar AI feature, the relevant inputs (for example a chart image, symbol data, or your message) are transmitted to our AI infrastructure providers solely to generate the output you requested. These providers process the data as service providers under their API data-processing terms; we do not authorize them to use your content for advertising. Results may be cached briefly to serve identical requests efficiently. Automated processing on the Service produces informational output only and is not used to make decisions that have legal or similarly significant effects on you.

Payments are processed by third-party providers (such as Lemon Squeezy — which may act as merchant of record — PayPal, PayOS, and NOWPayments). Your full card or wallet details are transmitted directly to those providers and are never stored on our servers; we receive only limited transaction data (such as order status, amount, and a payment reference) needed to activate and support your purchase. These providers handle your payment data under their own privacy policies and are PCI-DSS compliant where applicable.

We share personal data only with: payment providers (to process transactions); hosting, CDN, and infrastructure providers; media-storage providers for uploaded images; email-delivery providers for transactional and permitted marketing email; analytics and advertising platforms (in aggregated or pseudonymized form, for example to measure ad conversions); AI infrastructure providers (see section 3); error-monitoring services; and courts or authorities where disclosure is required by law or necessary to protect rights, safety, or the integrity of the Service. Our processors are bound by data-processing agreements. If we are involved in a merger, acquisition, or asset sale, data may be transferred as part of that transaction subject to this policy.

We use strictly necessary cookies for login sessions, security, and remembering preferences such as language and theme. With your consent where legally required, we also use analytics and advertising cookies or identifiers (for example, to measure Google Ads conversions). You can manage cookies in your browser settings and opt out of ad personalization with the relevant provider; blocking essential cookies may prevent login and core features from working.

We keep account data for as long as your account is active. If you delete your account, personal data is deleted or irreversibly anonymized within a reasonable period, except for data we must or may lawfully keep longer: transaction and tax records (for the period required by law, typically 5–10 years), fraud-prevention and security logs (kept for a limited period), and data subject to a legal hold. Anonymized, aggregated statistics that can no longer identify you may be retained.

Depending on your jurisdiction, you have the right to access, correct, delete, and receive a copy of your personal data; to restrict or object to its processing; to withdraw consent; and not to be discriminated against for exercising your rights. EEA/UK users may lodge a complaint with their supervisory authority. California residents may exercise their CCPA/CPRA rights — we do not "sell" or "share" personal data as defined by that law. Vietnamese users have the rights provided by Decree 13/2023/ND-CP, including consent withdrawal and data deletion. To exercise your rights, email [email protected]; we may verify your identity and will respond within the time required by law.

We apply industry-standard safeguards, including TLS encryption in transit, bcrypt password hashing, httpOnly authentication cookies, access controls, rate limiting, and security monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal-data breach occurs that is likely to result in a risk to you, we will notify you and the competent authorities as required by applicable law.

We operate globally, and your data may be processed in countries other than your own, including Vietnam, the European Union, and the United States. Where required, we rely on appropriate safeguards for cross-border transfers — such as the EU Standard Contractual Clauses or our providers' approved transfer mechanisms — and we follow Vietnam's requirements for transferring personal data abroad.

The Service is intended for adults and is not directed at anyone under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us personal data, contact us and we will delete it promptly.

With your permission, or where otherwise lawful, we may send product news, tips, and offers by email or in-product messages. Every marketing email contains an unsubscribe link, and you can also opt out in your profile settings. Transactional messages — receipts, security notices, and subscription reminders — are sent regardless of marketing preferences because they are part of operating the Service.

We may update this Privacy Policy as the Service or the law evolves. Material changes will be announced by email or an in-product notice before they take effect, and the "last updated" date above will change. Your continued use of the Service after the effective date constitutes acknowledgment of the updated policy.