| Data | When collected | Purpose |
|---|---|---|
| Email address | Account registration | Authentication, account recovery, service communications |
| Name | Account registration (optional) | Personalization (dashboard greeting) |
| Password | Email registration | Authentication — stored as a salted, cryptographic hash (PBKDF2-HMAC-SHA256 with 260,000 iterations), never in plaintext |
If you sign up or log in using Google, we receive the following from Google:
We do not receive or store your Google password, contacts, calendar data, or any other Google account information beyond the items listed above.
| Data | Details | Purpose |
|---|---|---|
| API usage counts | Number of API calls per key per calendar month | Rate limiting and plan enforcement |
| API keys | Keys you create (prefixed cm_), key names, creation dates | API authentication |
| Subscription tier | Your current plan (Free, Pro, or Builder) | Feature access and billing |
| Account timestamps | Account creation date and last login date | Account management |
We want to be explicit about what we do not collect:
We use your browser's localStorage (not cookies) to store a single authentication token (cm_token). This token:
We use the information we collect for the following purposes:
We do not use your information for advertising, marketing profiling, or selling to third parties.
We share your personal information only with the following third-party services, and only to the extent necessary to operate the Service:
Paddle acts as our Merchant of Record and is the entity that processes your payment. Payment card details (card number, CVV, expiration date) are entered directly on Paddle's hosted checkout page. We never see, receive, or store your payment card information. Paddle handles all sales tax and VAT compliance. Paddle will appear as the charge merchant on your bank/card statement.
When you use the AI analysis feature, pattern match data (not your personal information) may be sent to one of the following AI providers for generating analysis:
The data sent to AI providers consists of pattern match results (symbols, similarity scores, outcomes) and does not include your name, email, account information, or any personally identifiable information.
ChartMatch retrieves publicly available market data from Binance and Yahoo Finance to power its pattern-matching engine. No user data is shared with these providers. These are one-way data feeds — we retrieve market data from them; we do not send them any user information.
We do not sell, rent, trade, or otherwise transfer your personal information to third parties for marketing, advertising, or any commercial purpose unrelated to operating the Service.
Your account data is stored in a SQLite database on our servers. Market data (publicly available candlestick data) is stored separately.
We implement the following security measures to protect your data:
While we take reasonable measures to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and API keys.
| Data type | Retention period |
|---|---|
| Account information (email, name) | Until you request deletion or account termination |
| Password hash | Until you change your password or request account deletion |
| API keys | Until you delete them or account termination |
| API usage counts | Retained for billing and rate-limiting purposes |
| Paddle customer/subscription IDs | Until account deletion (may be retained by Paddle independently per their policy) |
| Authentication tokens | Automatically expire after 72 hours |
Depending on your jurisdiction, you may have some or all of the following rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you. Your account information is visible on your dashboard at any time.
You have the right to request correction of any inaccurate personal data we hold about you.
You have the right to request deletion of your personal data. Upon receiving a valid deletion request, we will:
To request account deletion, contact us at the email provided in Section 12.
You have the right to receive your personal data in a structured, commonly used, and machine-readable format. Contact us to request a data export.
You have the right to object to certain types of processing. Since we only process your data for the purposes described in this policy (operating the Service), objecting to processing may require you to close your account.
Where processing is based on consent, you have the right to withdraw consent at any time. This does not affect the lawfulness of processing based on consent before its withdrawal.
If you are located in the EEA or UK, the following additional provisions apply:
If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information promptly. If you believe we have collected information from a child under 18, please contact us immediately.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by:
Your continued use of the Service after changes are posted constitutes your acceptance of the revised Privacy Policy. We encourage you to review this page periodically.
| Processing activity | Legal basis |
|---|---|
| Account creation and authentication | Contract performance |
| Subscription billing | Contract performance |
| Email verification | Contract performance |
| API rate limiting and usage tracking | Contract performance / Legitimate interest |
| Security and fraud prevention | Legitimate interest |
| Google OAuth authentication | Consent |
| Service improvement (aggregate metrics) | Legitimate interest |
If you have questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how your data is handled, please contact us at:
Email: privacy@chartmatch.com
We will respond to all legitimate requests within 30 days. We may ask you to verify your identity before processing your request.