1. Who we are
Chart GT (“we”, “us”) runs this website and service and is the controller of the personal data described here. This policy covers the website, the chart, the community library and the emails and webhooks we send. If you have a question about it, write to [email protected].
2. What we collect
We collect only what the service needs to work:
| Data | What it is | Where it comes from |
|---|---|---|
| Account | Email address, display name, handle, and if you set a password, a salted scrypt hash of it (never the password itself). | You, when you sign up. |
| Google sign-in | Your Google account ID, email address and name. | Google, if you choose Continue with Google. |
| Your workspace | Scripts, layouts, drawings, watchlists, chart settings and favorite indicators. | You, as you use the chart. |
| Alerts | Alert conditions, the email address and webhook URLs you give us, and a history of when alerts fired and whether delivery worked. | You, and our alert servers. |
| Community | Published scripts and versions, ratings, reviews, invites, and which scripts you use (to count uses). | You, when you publish, rate or use scripts. |
| Referrals | Your referral code, who referred you (if anyone), the friends who signed up with your link and whether each earned a reward. | You, when you share or use a referral link. |
| Payments | Your plan, subscription status, orders, and for sellers a payout account ID. Card details stay with Stripe; we never see or store them. | You and Stripe. |
| Messages | What you write to us and our replies. | You, when you contact us. |
| Technical | IP address, browser and request details, used to keep sessions working, limit abuse (such as repeated failed logins) and fix errors. | Your browser, automatically. |
What we don't do: we don't run advertising or third-party analytics trackers, we don't sell or share your personal data for advertising, and we don't ask for sensitive data such as your brokerage logins, account balances or positions. Don't put personal data in scripts you publish.
3. How we use it, and our legal bases
If you are in the European Economic Area or the United Kingdom, the GDPR requires a legal basis for each use:
| Purpose | Legal basis |
|---|---|
| Provide the service: your account, charts, scripts, backtests, alerts and the community library | Contract |
| Take payments for plans and scripts, and pay sellers | Contract |
| Send service emails: alerts you set up, receipts, security notices and changes to these policies | Contract |
| Keep the service secure: prevent fraud, abuse and attacks, and fix bugs | Legitimate interests |
| Improve the product, using aggregate counts such as how many people use a script | Legitimate interests |
| Keep tax and accounting records, and answer lawful requests | Legal obligation |
We don't make decisions about you based solely on automated processing.
6. How long we keep it
- Account and workspace data: while your account is open.
- When you delete your account (in Settings): removed at once from the service, and from backups as they roll over within 30 days.
- Payment, invoice and payout records: kept by Stripe, our payment processor, as long as tax and accounting law requires (usually up to 10 years).
- While other people have access to scripts you sell or share, the account can't be deleted from Settings; write to us and we will close it once their access ends.
- Technical logs: a few weeks, unless we need them to investigate abuse.
7. Security
Traffic is encrypted in transit. Passwords are stored as salted scrypt hashes, session tokens only as hashes, and hidden-source scripts never leave our servers. Pine scripts run in a sandbox. No system is perfectly secure; if we learn of a breach that affects your data, we will tell you and the authorities as the law requires. Report vulnerabilities to [email protected].
8. Your rights
Wherever you live, you can ask us for a copy of your data, to correct it, or to delete your account. Depending on where you live you may also have these rights:
European Economic Area and United Kingdom
Access, correction, deletion, restriction, objection to processing based on legitimate interests, data portability, and withdrawing consent at any time. You can also complain to your data protection authority (in the UK, the ICO).
California and other US states
The right to know what personal information we collect and how we use it, to delete and correct it, and not to be treated differently for using these rights. We don't sell or share personal information as those laws define it.
You can correct your profile and delete your account yourself in Settings. For anything else, write to [email protected] from the email on your account. We will confirm we received it, may ask you to verify that you own the account, and will answer within 30 days (45 where state law allows).
9. International transfers
We and our service providers may process data in the United States and other countries whose data protection laws differ from yours. When we transfer data out of the EEA or the UK, we rely on adequacy decisions or the European Commission's standard contractual clauses (and the UK addendum).
10. Children
Chart GT is not for anyone under 18. We don't knowingly collect data from children; if we learn that we have, we delete it. If you think a child has an account, tell us at [email protected].
11. Changes to this policy
We will post any changes here with a new date. If a change materially affects how we use your data, we will email you or tell you in the app before it takes effect.
12. Contact
Privacy questions and requests: [email protected]. More ways to get help are on the Contact us page. Using the service is also governed by our Terms of use.