Privacy Policy
Last updated and effective: September 3, 2026
ChartChest ("we", "us", or "our") operates chartchest.com (the "Service"). This policy explains what data we collect, how we use it, and your rights.
1. Information We Collect
Account data
When you create an account, we collect your email address and, if provided, a display name. Authentication credentials are processed by Supabase Auth. ChartChest does not store a readable copy of your password.
Usage data
Our hosting, edge-routing, analytics, and application providers may process standard request and device information such as IP address, browser and device type, requested pages or API routes, timestamps, and error or security events. We use this information to operate, secure, troubleshoot, and understand use of the Service.
Payment data
Payments are processed by Stripe. ChartChest does not receive or store your full card number or CVV. We store your subscription tier and Stripe customer identifier so we can provide and reconcile Pro access. Stripe stores and processes payment, subscription, and transaction information under Stripe's Privacy Policy.
Watchlist and analysis data
Symbols you save to a watchlist are associated with your account. When an analysis is requested, the requested symbol and generated symbol-level output may be cached or retained to operate the Service, populate current research views, troubleshoot results, and evaluate model behavior. These shared symbol records are not maintained as a personalized investment profile.
Functional cookies and browser storage
We use browser storage required to keep sessions and product state working:
- Supabase session storage keeps you signed in and refreshes your session.
- cc_anon and cc_free_daily retain daily free-usage counts for up to 2 days.
- Chart drawings are stored only in your browser's local storage by symbol and interval. They are not sent to ChartChest servers by the drawing tool and remain until you remove or overwrite them or clear site data in your browser.
Clearing functional cookies or session storage may sign you out or reset usage state. Clearing local site data removes locally saved chart drawings.
Cookies and analytics
We use Google Analytics 4 (measurement ID G-L8F1VKSYN3) on several website and account-facing pages. Google Analytics may process IP address, browser and device information, pages visited, timestamps, and a pseudonymous analytics identifier. We use this information to understand website traffic and improve the Service. You can opt out using the Google Analytics Opt-out Browser Add-on or controls provided by your browser.
Google Analytics may set persistent cookies on your device. Our use of this service means Google may also collect and process data in accordance with Google's Privacy Policy.
2. How We Use Your Data
- To create and manage your account
- To process subscription payments via Stripe
- To deliver analysis results, scanner data, watchlists, and in-app model-change alerts
- To maintain service uptime, debug issues, and prevent abuse
- To send essential account or billing-related communications when required for service operation
We do not sell your personal data or use account credentials, payment data, or chart drawings to train our models. Model development uses market data and deidentified model-performance records. Requested symbols and generated model outputs may contribute to shared caches and model evaluation without being used as a personalized financial profile.
3. Data Retention
Account profile and saved-watchlist data are retained while your account is active or until the relevant data is removed. Under our current operational cleanup policy, shared on-demand analysis caches are generally retained for up to 14 days, signal-history records for up to 45 days, and prediction-horizon records and unseen in-app alerts for up to 90 days; seen alerts may be removed after 30 days. These periods may be shorter when records are replaced or manually cleared.
Application and security logs are generally retained for up to 90 days, subject to provider settings and longer retention where reasonably necessary to investigate abuse, meet legal obligations, resolve disputes, or enforce agreements. Stripe retains transaction records under its own policy and applicable financial requirements. Deidentified research and model-integrity records may be retained longer because they are not designed to identify an account holder.
You may request deletion as described in Section 7. A deletion request may not remove records that must be retained for legal, security, fraud-prevention, accounting, dispute-resolution, or deidentified research-integrity purposes.
4. Data Sharing
We share data only with service providers necessary to operate ChartChest:
- Supabase — database and authentication
- Stripe — payment processing
- Render — application hosting, compute, and operational logs
- Cloudflare — website hosting, edge routing, security, and request forwarding. See Cloudflare's Privacy Policy.
- Google — website analytics (Google Analytics 4). We do not use Google's advertising features or share data for advertising purposes.
- Market-data providers, including Yahoo Finance — market data is retrieved using a symbol or market query. We do not intentionally send account credentials or payment data with those requests.
We do not sell, rent, or trade your personal data to any third party. We may disclose data if required by law, court order, or to protect the rights, safety, or property of ChartChest, its users, or the public.
5. Security
We use technical and organizational measures intended to protect personal data, including HTTPS, access controls, JWT verification for authenticated API requests, Stripe webhook signature verification, and rate limiting. No system is perfectly secure, and we cannot guarantee absolute security.
6. Children's Privacy
ChartChest is for users who are at least 18 years old and is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, please contact us so we can review and delete it as appropriate.
7. Your Rights
Depending on your location you may have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — request correction of inaccurate or incomplete data
- Erasure — request deletion of your personal data ("right to be forgotten")
- Portability — receive your data in a structured, machine-readable format
- Objection / Restriction — object to or restrict certain processing activities
- Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing
To exercise any of these rights, email us at cc14ventures@gmail.com. Requests are handled through support and may require verification that you control the relevant account. We will respond within the period required by applicable law. If you are in the EU or UK and believe your rights have not been addressed, you may lodge a complaint with your local data protection supervisory authority.
8. California (CCPA / CPRA)
California residents may have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including rights to know, correct, or delete certain personal information and to opt out of sale or sharing for cross-context behavioral advertising. We do not sell personal information or use it for cross-context behavioral advertising. We disclose information to the service providers listed above for business purposes. To submit a request, email cc14ventures@gmail.com.
9. Changes to This Policy
We may update this policy periodically. Material changes will be announced via a notice on the website or by email. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
10. Contact
Questions? Email us at cc14ventures@gmail.com.