Privacy Policy

CrackChart ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, mobile application, and related services (collectively, the "Platform").

By using CrackChart, you consent to the data practices described in this Policy. If you do not agree, please do not use the Platform.

We act as the data controller for personal data collected through the Platform. For questions about this Policy or your data, please contact us at privacy@crackchart.com.

Account Data: When you register, we collect your full name, email address, password (hashed), profile type (Trader or Signal Provider), display name, username, bio, and avatar image.

KYC / Verification Data: To comply with anti-money laundering obligations and to verify signal providers, we collect government-issued ID documents (front and back), selfie images, date of birth, country of residence, and professional/business information for provider accounts. This data is processed and stored securely.

Trading & Activity Data: We collect the signals, posts, comments, likes, saves, follows, and subscriptions you create or interact with on the Platform.

Financial Data: We store wallet balances (USD and CC Coins), transaction records, and—via our payment processors—masked card details and payment method tokens. We do not store raw card numbers on our servers.

Communication Data: Messages sent via Community Chat and Direct Messaging, including any attachments. We also store support correspondence.

Technical Data: IP addresses, browser type, device identifiers, operating system, referral URLs, pages visited, and session data collected automatically via logs and cookies.

KYC and payment data is stored with appropriate encryption at rest. We retain only the minimum data necessary for the purposes described in this Policy.

To Operate the Platform: Providing account access, displaying signals and posts, processing wallet transactions, enabling chat, and delivering features you request.

Identity & Fraud Prevention: KYC verification to confirm your identity, prevent fraudulent accounts, and comply with applicable financial regulations.

Communications: Sending transactional emails (email verification, password reset, KYC decisions, transaction confirmations) and, with your consent, marketing communications about new features and offers.

AI Chart Analysis: When you upload a chart image for AI analysis, the image is sent to our AI provider (Google AI Studio / Gemini) for processing. Images are not stored permanently after analysis unless you save the result.

Analytics & Improvement: Understanding how features are used to improve the Platform, fix bugs, and develop new functionality. We use aggregated, anonymised data where possible.

Legal Compliance: Retaining records to comply with applicable laws, responding to lawful requests from authorities, and enforcing our Terms of Service.

We do NOT sell your personal data to third parties.

Service Providers: We share data with trusted third-party vendors who help us operate the Platform, including cloud hosting providers (AWS), email delivery services (Resend), payment processors, file storage (AWS S3 / Cloudflare R2), push notification services (Firebase / APNs), AI providers (Google AI Studio), and error tracking (Sentry). These providers are bound by data processing agreements.

Broker & Prop Firm Partners: If you choose to link a broker account for rebate tracking, we share the minimum necessary data (your account identifier) with the relevant broker. We do not share your KYC documents with brokers.

Legal Requirements: We may disclose your data where required by law, court order, or governmental authority, or to protect the rights, property, or safety of CrackChart, our users, or others.

Business Transfers: If CrackChart is acquired or merged, your data may be transferred as part of that transaction. We will notify you via the Platform or email before your data is subjected to a different privacy policy.

We use cookies and similar technologies to operate and improve the Platform. Categories include:

Essential Cookies: Required for the Platform to function (e.g., authentication session, CSRF protection). These cannot be disabled.

Analytics Cookies: Help us understand how you use the Platform (e.g., Vercel Analytics). These are collected in anonymised form where possible.

Preference Cookies: Remember your settings such as timezone and appearance preferences.

You can control non-essential cookies via your browser settings. Note that disabling certain cookies may affect Platform functionality. We do not use third-party advertising cookies.

We implement industry-standard security measures to protect your data, including: TLS/HTTPS encryption for all data in transit, AES-256 encryption for sensitive data at rest (KYC documents, payment tokens), bcrypt hashing for passwords, HTTP-only cookies for web authentication tokens, and regular security audits.

While we take reasonable precautions, no security system is impenetrable. We cannot guarantee absolute security of your data. In the event of a data breach that affects your rights, we will notify you as required by applicable law.

You are responsible for keeping your login credentials confidential. Do not share your password with anyone.

We retain your personal data for as long as your account is active or as needed to provide services. If you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law (e.g., financial transaction records, KYC records for AML compliance).

KYC documents may be retained for up to 5 years after account closure to comply with anti-money laundering regulations.

Anonymised or aggregated data derived from your use of the Platform may be retained indefinitely for analytics purposes.

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you.

Correction: Request correction of inaccurate or incomplete data.

Deletion: Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.

Portability: Receive your data in a structured, machine-readable format.

Restriction: Request that we restrict processing of your data in certain circumstances.

Objection: Object to processing based on legitimate interests.

Withdraw Consent: Where processing is based on consent (e.g., marketing emails), withdraw consent at any time via Settings → Notifications or by contacting us.

To exercise any of these rights, contact us at privacy@crackchart.com. We will respond within 30 days. We may need to verify your identity before processing your request.

CrackChart is intended for users who are 18 years of age or older. We do not knowingly collect personal data from anyone under 18.

If we become aware that we have collected personal data from a child under 18 without parental consent, we will take steps to delete that data promptly.

If you believe a minor has provided us with personal information, please contact us at privacy@crackchart.com.

CrackChart operates globally. Your data may be transferred to, and processed in, countries other than your country of residence. These countries may have different data protection laws.

Where we transfer data outside your jurisdiction, we implement appropriate safeguards such as Standard Contractual Clauses (SCCs) or ensure the recipient country provides an adequate level of data protection.

By using the Platform, you consent to the transfer of your information to countries outside your country of residence.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and notify you via email or an in-platform notification at least 14 days before the changes take effect.

Your continued use of the Platform after the effective date of the revised Policy constitutes your acceptance of the changes.