Privacy

This privacy note is a placeholder. A lawyer needs to review it before the product collects customer data in production.

The account stores your name, email, the time you accepted the risk disclaimer, a referral code, trading limits, and subscription status. Broker API keys, secrets, and access tokens are encrypted per account. They are not shown back in full and are not shared with other customers.

Sign-in uses an email code, a magic link, or Google. In local development the code can be shown on screen when ALLOW_DEV_OTP is true. That switch must be off in production, and a real email provider must send the code instead.

Payments, if enabled, are created in Razorpay test mode. The webhook stores the payment id, amount, and signature result. Do not commit Razorpay secrets.

Audit records keep owner actions such as plan edits, kill-switch changes, and day-limit resets. Say who you share them with, how long you keep them, and how a person can ask for a copy or deletion. Those answers are not in this draft.