Short version: we collect the minimum needed to run your account and send you the alerts you asked for. We don't sell your data, we don't connect to your broker, and you can ask us to delete your account at any time.
1. What we collect
- Account details — your name, email address, username, password (stored only as a one-way hash), timezone and any avatar you upload. These come from the sign-up form, or from us if we set the account up for you. When you sign up we also record that you accepted this policy and the Terms, and when you confirmed your email address.
- Portfolio data you enter — portfolio names, tickers, quantities, cost basis and notes. This is optional; the scanner works without it.
- Sign-in records — date, time, IP address and browser/device string of each sign-in. We use these to warn you about sign-ins from a new location.
- Notification history — which alerts we sent you, when, and to which address, so problems can be traced.
- Android app — if you use the TradeBot app, a push-notification address for your phone (a random token issued by Google Firebase) and the platform ("android"), so alerts can reach that phone. It is removed when you sign out of the app. Fingerprint or face unlock is handled entirely by your phone: we never receive or store any fingerprint, face or screen-lock data.
- Contact form submissions — the name, email, topic and message you send, plus the IP address it came from (for abuse prevention).
- Usage analytics — we use Google Analytics to understand which pages are used. It only runs if you click Accept on the cookie banner; it then sets cookies and records anonymised page-view data. See Google's own privacy policy for details.
- Bot protection — public forms use Google reCAPTCHA, which may collect device and interaction data to tell people from bots, under Google's privacy policy and terms.
2. What we do not collect
- We never ask for, store or access brokerage logins, account numbers, card details or bank details.
- We do not place trades, hold funds or see your real positions unless you type them into the portfolio tracker yourself.
3. Why we use it
- To run your account: sign you in, show your portfolios, remember your settings.
- Your portfolios are private to your login: no other member can see your holdings, values or dividends. The site operator can view account data only to run the service, fix problems or answer a request you make.
- To send the alerts you have turned on (new trades, trades closed, password and security notices). You can switch email alerts off in your Profile.
- To keep the service safe: rate limiting, bot detection, new-device sign-in warnings, tracing delivery problems.
- To answer your messages.
- To improve the site using aggregate analytics.
4. Who we share it with
We do not sell or rent personal data. We share it only with services needed to operate the site: our hosting provider (Oracle Cloud), our email provider for outgoing mail, Google (Analytics, reCAPTCHA and, for the Android app, Firebase Cloud Messaging to deliver phone notifications) and, if you use it, the "Open on TradingView" link, which takes you to TradingView's site. Market data comes from public sources and never includes anything about you. We may disclose data if required by law.
5. Cookies
The portal sets a session cookie and a CSRF token cookie so you stay signed in and forms can be submitted safely; a "keep me signed in" cookie if you tick that box; a small preferences store in your browser (chosen tab, sort order, market) that never leaves your device; reCAPTCHA cookies on public forms; and Google Analytics cookies only if you accept them on the cookie banner. You can change that choice any time from the Cookie Settings link in the footer. Blocking the sign-in cookies will stop you signing in.
6. How long we keep it
- Account and portfolio data: for as long as your account exists. You can wipe your portfolio data yourself from Profile › Clear Portfolio Data.
- Sign-in and notification history: kept for security and support, kept for up to 12 months, then deleted.
- Contact messages: kept for up to 2 years after we reply, then deleted.
- Server logs: rotated automatically, typically within a few weeks.
7. Where it lives and how it is protected
Data is stored on a server in the United States, served over HTTPS. Passwords are hashed, never stored in clear text. Access to the server is limited to the operator. No system is perfectly secure; if we learn of a breach affecting your data we will tell you, and any data-protection authority the law requires us to tell (for India, the Data Protection Board of India), without undue delay — saying what happened, what data was involved and what you can do.
8. Emails we send
- Service emails — alerts you have switched on (new signals, signals closed), sign-in warnings, email-address confirmation links, password resets and notices about outages. Alerts can be switched off in Profile › Notifications; security and account emails cannot, because they exist to protect you.
- Phone notifications (Android app) — the same alerts you see under the bell, sent to your phone. Turn them off any time in your phone's settings for the TradeBot app, or sign out of the app.
- Updates about the Service — occasional notes about new features or changes to these documents. Every such email carries a way to stop receiving them.
- We do not send promotional email on behalf of anyone else, and we do not pass your address to other companies for their marketing — whether or not you hold an account.
9. Your choices and rights
- Update your name, email, timezone and password at any time in your Profile.
- Turn email alerts on or off in your Profile; bell notices can be cleared from the bell menu.
- Ask us to export or delete your account and all associated data — email us (below) and we will do it within 30 days.
- If you are in the EU/UK or another region with data-protection rights (access, correction, deletion, objection, portability), those rights apply and you can exercise them by contacting us.
- India (Digital Personal Data Protection Act, 2023): you can access, correct, complete or erase your data, withdraw your consent at any time (as easily as you gave it — switch alerts off, decline cookies, or ask us to close your account), and name another person to exercise these rights for you if you die or become unable to. Withdrawing consent does not affect what was done before.
- California residents: we do not sell or share personal information for cross-context advertising, so there is nothing to opt out of; the access and deletion rights above apply to you as well, and we will not treat you differently for using them.
- Your browser's "Do Not Track" setting is not something the portal reads — we do not track you across other sites in the first place.
10. When your account closes
If you close your account or we close it for you, we delete your portfolio data and profile promptly and keep only what we need for a short while afterwards: sign-in and notification records for security, and any messages you sent us. Once those have served their purpose they are removed too. Anything already folded into anonymous statistics stays anonymous and cannot be traced back to you.
11. Legal requests and ownership changes
We may hand over personal data if a court, regulator or law-enforcement request obliges us to, or if it is needed to protect the safety of a person or the integrity of the Service. If the Service is ever transferred to a new operator, your data would move with it under this same policy and you would be told beforehand.
12. Other sites
The portal links out to third-party sites (for example TradingView charts). Once you leave, their privacy practices apply, not ours — we do not control what they collect and are not responsible for it. Have a look at their policies if that matters to you.
13. Children
The service is not intended for anyone under 18, and we do not knowingly collect data from them. If you believe a minor has an account, tell us and we will remove it.
14. Changes
If this policy changes in a meaningful way we will update the date at the top and, for material changes, tell signed-in users on their next visit. Continuing to use the Service after a change means you accept the updated policy.
15. Contact
Questions or requests about your data: info@tasteofmoksha.com. Our grievance officer (the site operator) answers privacy questions and complaints and will respond within 30 days. If you are not satisfied with our answer and you are in India, you can complain to the Data Protection Board of India. This policy is part of our Terms & Conditions.