Privacy Policy

Last updated September 14, 2026

Chart Ding ("we", "us", or "the App") respects user privacy and is committed to protecting personal information. This Privacy Policy explains how data is collected, used, stored and protected.

1. Information we collect

1.1 Account information

• Email address, for account creation and authentication
• Account credentials — passwords are hashed, and we do not hold them in readable form
• Subscription and purchase status, and billing information processed by Stripe

1.2 Settings and content

• Alarm configurations and settings
• Custom sounds uploaded by the user
• Clock display preferences
• Profile configurations

1.3 Usage and device data

• App usage patterns, used to improve the service
• Device type and operating system
• Browser type and version
• IP address, for security purposes
• App version and error logs

1.4 Session and device records

• Device identifiers, including browser fingerprint and device ID
• Active session information, such as login times and last activity
• IP addresses and approximate geographic location
• The number of devices associated with an account

This information is used to prevent unauthorized account sharing, detect suspicious activity, and enforce license restrictions as set out in our Terms of Service.

2. How we use information

• To provide and maintain the App's functionality
• To process a subscription or purchase
• To sync settings across devices, on the Pro tier
• To send service notifications
• To improve and optimize the App
• To provide customer support
• To detect and prevent fraud or abuse
• To enforce license restrictions and prevent unauthorized account sharing
• To monitor device and session usage for compliance with the Terms of Service
• To comply with legal obligations

3. Where data is stored

Alarm settings, custom sounds and preferences are stored locally in the browser's localStorage. That data stays on the device and is not transmitted to our servers unless cloud sync is used.

With a Pro subscription and cloud sync enabled, settings are stored in our Supabase database, which allows access from multiple devices.

3.1 Imported trades

Trade files imported into the trade analysis dashboard, and everything calculated from them, are held on the device only. They are not uploaded, and we hold no copy of them. If they are lost, they can be exported again from the broker they came from. The one exception is a file a user chooses to send us, described in section 3.4.

3.2 Journal notes

Notes and tags written in the journal are stored on the device, in the same way as other settings. We do not currently hold a copy.

Should an optional backup for journal notes be offered in future, it would be off unless switched on, and this policy would be updated to describe it before it was.

3.3 Which broker a file came from

After a trade file has been read, the App asks which broker it came from. Answering is optional, and declining changes nothing about the import.

If the question is answered, we record the names of the columns in that file — headings such as Date, Action, Symbol, Quantity — together with the broker named, whether the format was recognized, how many rows the file held, and how many of those became trades. This is stored in our Supabase database.

What is not recorded: nothing from inside the file. No prices, no quantities, no symbols, no dates, no account names, and not the file's name. Only the headings at the top of the columns and a count of the rows beneath them.

This exists so that formats we handle badly can be found and fixed. A file we failed to read is more useful to us than one we read correctly, because it is the one that shows what needs work.

3.4 Files sent to us for import support

When the App cannot read a trade file, it offers to send that file to us so we can add support for the broker it came from. The Import screen also lets anyone send us a sample file from a broker we do not read yet. Sending a file is optional, does not require an account, and happens only after the user ticks a box confirming they want to send it.

What we receive: the file itself, the email address entered so we can reply, and the optional note written with it. If the sender is signed in, we also record which account sent it. A broker file can contain account numbers and a trade history.

• Why — we use the file only to build and test import support for its format.
• Where it is held — in private storage in our Supabase project. It is not public, and only Chart Ding staff can open it.
• How long — the file is deleted within 30 days of being sent, and its file name and note are deleted with it. We keep a record that a file was sent — the date, the email address, and the file's size and type — in the same way as other support communications.
• Deleting it sooner — ask by replying to any email from us about the file, or through the App's support feature, and we will delete it before then.

To limit how many files can be sent, we also store a salted hash of the sender's IP address, which cannot be read back as the address itself. It is deleted with the file.

3.5 Beta tester applications and check-ins

People can apply to test Chart Ding at www.chartding.com/testers, or be invited by email. Testers receive a year of Pro Plus, and are asked for a short check-in after two weeks.

What we receive: the name and email address entered, and the answers to the application — where and what the person trades, how they track trades today, roughly how many trades a month, whether they would send us a file that does not import, and their computer and browser. For testers we later also record when their year of Pro Plus was claimed and which account claimed it, and the answers to the two-week check-in, including whether we may quote them.

• Why — only to run the tester program: choosing testers, knowing which broker files to expect, sending the invitation, approval and check-in emails, and deciding what to fix.
• Where it is held — in our Supabase project, readable only by Chart Ding staff through the admin panel. It is not public, and it is not sold or shared.
• How long — for as long as the tester program runs. It is deleted sooner on request: reply to any email from us about the program, or use the App's support feature.
• Quotes — a tester is only quoted if they said yes in the check-in, and any quote we use says that the person received a free year of Pro Plus as a tester.

To limit repeated applications, we also store a salted hash of the IP address an application came from, which cannot be read back as the address itself. It is cleared once the application has been approved or declined.

Payment processing is handled by Stripe and, where applicable, an app store. We do not store credit card numbers.

4. Third-party services

We share information only with the services below, each of which processes it on our behalf.

We do not sell, rent or trade personal information to third parties for marketing purposes.

4.1 Product analytics — PostHog

We use PostHog to understand how the App is used. It records which pages and tabs a user opens, clicks on buttons and controls, and a small number of specific events: starting and stopping alarms, reaching the trial limit, completing signup, starting checkout, and completing a purchase.

PostHog also records the path taken through the App — which controls were used, in what order, and where a page was scrolled. It is a list of actions with times against them. Nothing on the screen is captured, and text typed into the App is hidden before it leaves the browser, so passwords and email addresses are never part of it. The record carries no name and no email address.

For a signed-in user this activity is linked to the account by an internal account identifier rather than an email address. Data is sent by way of chartding.com rather than to PostHog's own domain, and is stored in PostHog's United States region. Related preferences are kept in the browser's local storage and in a cookie.

4.2 Traffic measurement — StatCounter

StatCounter counts page visits so that overall traffic levels can be measured, including the page visited, the referring page, and general browser and location information. It is not linked to an account.

4.3 Email delivery — Resend

Transactional messages, such as account notifications, replies to contact-form enquiries and tester program emails, are delivered by Resend. To send a message, Resend receives the recipient's email address and the contents of that message.

4.4 Dictation — browser speech recognition

The journal includes a Dictate button that converts speech to text using the browser's own speech recognition service. In Chrome and Edge, the audio is sent to Google to be transcribed; it is not processed on the device.

This happens only while that button is switched on. No audio recording is stored by us or by the page, and none is transmitted at any other time. Only the resulting text is kept, in the browser's local storage on the user's own machine, with the rest of their notes. Browsers that do not provide speech recognition, such as Firefox, do not display the button.

Audio handled this way is subject to the speech provider's own privacy policy while it is being transcribed.

4.5 Reading an unrecognized trade file — Anthropic

The Import screen can offer to work out the columns of a trade file the App does not recognize. It appears only after our own reader has failed, it is never used on a file we already understand, and it does nothing unless the button is pressed.

When it is used, part of the file is sent to Anthropic, which provides the service that reads it. What is sent is:

• The column headings of every table in the file, with two sample rows from each, so the correct table can be identified.
• About thirty rows of the table being read, sampled across the whole file rather than taken from the top.
• The repeated values from columns that hold only a few different ones — the kind that read "buy" or "sell". Columns where nearly every row differs, which is what price, quantity, amount and time columns look like, are not sent this way.

What is not sent: the file itself, the file's name, and no account name or identifier that we hold.

The result is a suggested mapping of columns, which appears in the same table on the Import screen that is used for mapping a file by hand. Nothing is imported from it until the trades have been reviewed and confirmed.

Anthropic processes the request in order to return that answer. Data sent through the interface we use is not used to train their models. Anthropic's handling of it is subject to their own privacy policy and terms.

This feature is off unless we have switched it on. While it is off, no part of any file is sent anywhere, and the option does not appear.

4.6 Affiliate referrals — PromoteKit

We run an affiliate program in which partners are paid a commission on subscriptions from customers they refer. PromoteKit tracks those referrals and calculates the commissions.

• On our pages. PromoteKit's script is loaded on the site so it can notice when someone arrives through a partner's link. When that happens it sets a cookie recording the referral. We also keep the partner's code in the browser's local storage for up to 60 days and, if an account is created, record it against that account.
• When a referred visitor creates an account. If the account is created in the browser that followed the partner's link, PromoteKit is told the account's email address, so a later payment made from another device can still be credited to that partner.
• When a referred customer pays. The referral is passed to Stripe with the payment, and PromoteKit reads it from our Stripe account. PromoteKit then receives the customer's email address and the amounts paid and refunded, so the commission can be worked out.
• What the partner sees. The partner who referred a customer can see, in PromoteKit's partner dashboard, the commission earned and currently that customer's email address.

Someone who did not arrive through a partner's link is not linked to any partner. PromoteKit's handling of this information is subject to its own privacy policy and terms.

5. Custom sound files

Custom sound files are available on the plans that include them (currently Pro and Pro Plus). They are:

• Stored in the browser on the device they were uploaded from
• Not uploaded by cloud sync — a sound's name is included in synced settings, but the audio itself stays on that device
• Used solely for alarm functionality
• Not shared with other users or third parties

Users are responsible for holding the rights to any audio they upload.

6. Security

We apply industry-standard security measures, including:

• Encryption of data in transit, using HTTPS and TLS
• Encryption of sensitive data at rest
• Authentication through Supabase Auth
• Row Level Security, so an account can reach only its own records
• Regular security updates
• Limited employee access to user data

No method of transmission or storage is completely secure. While we work to protect personal information, absolute security cannot be guaranteed.

7. Rights and choices

Users have the right to:

• Access — request a copy of their personal data
• Correction — update or correct their information
• Deletion — request deletion of the account and its data
• Portability — export settings and data
• Opt out — disable cloud sync at any time, on the Pro tier
• Object — object to certain processing activities

To exercise any of these, contact us through the App's support feature or through the relevant app store.

7.1 Deleting an account

1. Open the Chart Ding app, or visit www.chartding.com
2. Go to Settings, then Account Management
3. Select Delete Account
4. Confirm the deletion — this is permanent and cannot be undone

Account data is removed from our servers within 30 days of a deletion request. Payment records are retained as described in section 8.

8. Data retention

• Active accounts — for the life of the account, plus 90 days after cancellation
• Deleted accounts — purged within 30 days of the deletion request
• Inactive accounts — deleted after 2 years of inactivity
• Payment records — retained for 7 years, for tax and legal compliance
• Support communications — retained for 3 years
• Files sent to us for import support — deleted within 30 days of being sent, as described in section 3.4
• Beta tester applications and check-ins — kept while the tester program runs, and deleted sooner on request, as described in section 3.5

9. Children's privacy

The App is not intended for children under 13 years of age, and we do not knowingly collect personal information from them. A parent or guardian who believes a child has provided personal information should contact us.

10. International users

The App is operated from the United States. Information from users outside the United States may be transferred to, stored in, and processed in the United States, where our servers are located. Using the App constitutes consent to that transfer.

11. California privacy rights

California residents have additional rights under the California Consumer Privacy Act:

• The right to know what personal information is collected
• The right to know whether personal information is sold or disclosed
• The right to opt out of the sale of personal information, which we do not do
• The right to deletion of personal information
• The right not to be discriminated against for exercising these rights

12. European users

Users in the European Economic Area have rights under the General Data Protection Regulation, including those described in section 7. Our lawful bases for processing are:

• Contract performance — providing the App service
• Legitimate interests — improving the App, and security
• Consent — cloud sync features

13. Cookies and tracking

The App uses:

• Authentication cookies — required to stay signed in
• Session cookies — required for the App to function
• localStorage — for settings persistence
• Analytics cookies and local storage — used by PostHog, as described in section 4.1
• A referral cookie and local storage — only after arriving through an affiliate partner's link, as described in section 4.6

We do not use advertising cookies, and we do not use tracking for advertising purposes.

14. Changes to this policy

We may update this Privacy Policy from time to time, and will notify users of material changes by email or in-app notification. The "Last updated" date at the top of this page reflects when the policy was last revised.

15. Contact

Questions about this Privacy Policy or our privacy practices can be sent through the App's support feature, or through the relevant app store's support channel.

Summary

• We collect the information needed to provide the service
• Data is stored securely, and encrypted in transit and at rest
• We do not sell personal information
• Users can export or delete their data
• Payment processing is handled by Stripe, and card numbers are not stored by us
• Free tier users have minimal data held on our servers

Nothing on this website is trading or investment advice. Chart Ding is a market clock and alarm tool — it does not recommend trades, evaluate strategies, or take account of anyone's circumstances. Nothing here should be construed as a recommendation or relied on as the basis for a trading decision. Consult a licensed professional before placing real money at risk. Trading involves risk of loss.