Privacy Policy
TradeWick · effective 22 September 2026
TradeWick is a private, invitation-only application. It is not offered to the general public and accounts are created only for people who have been given access directly. This policy describes what the application stores about you, who else can see it, and how to have it removed.
Questions, requests and complaints: support@tradewickai.com.
1. Who is responsible
TradeWick is operated by an independent developer (“we”, “us”) rather than a company. For the purposes of India’s Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for your information; under United States privacy law, including the California Consumer Privacy Act, we are the business that determines how it is used. The same address, support@tradewickai.com, serves as the contact point and as the Grievance Officer channel required by the DPDP Act.
2. What we collect
Information you give us
| Data | Why |
|---|---|
| Email address and password | To create and secure your account. Passwords are stored only as a bcrypt hash, never in readable form. |
| First and last name, mobile number, country code | To address you in the app and, if you enable it, to deliver alerts and sign-in codes. |
| Notification preferences | To decide which channel an alert goes to. |
Information you create by using the app
Watchlists, chart drawings, indicator settings, saved screeners and screens, dashboards, alerts, Pine scripts, playbooks, trading agents and robot configurations, and your portfolio — positions, transactions, cost basis and paper-trading records. This is the content of the product. It is stored so the app can show it back to you, and it is visible only to your own account and to the operator of the server.
Information collected automatically
| Data | Retention |
|---|---|
| Activity log — IP address, browser user-agent, session identifier, the request path and method, the feature area, response status and duration. Request contents are recorded with credentials stripped out before storage. | 90 days, then deleted automatically |
| Time-per-feature summaries — one row per account per day per feature area | 365 days |
| Session cookie — a single cookie holding a session identifier | Expires after a period of inactivity |
The activity log exists so that account activity can be reviewed for security and support. It is deliberately built to exclude passwords and credentials before anything is written down, and its retention window is enforced by a scheduled job rather than left to discretion.
Connections you choose to make
- Zerodha Kite — if you connect your own Kite account, we store your API key and hold the API secret and access token encrypted (AES-256-GCM). These are used to fetch market data and margin figures. We do not connect to order placement, holdings or GTT functions, so the application cannot trade your real account.
- E*TRADE — access tokens are stored encrypted. This integration is sandbox-only.
- Push notifications — if you allow them, we store the push endpoint your browser issues, its encryption keys, and the browser user-agent.
Payment information
If billing is enabled on your account, payments are handled by Stripe. Card numbers never reach our servers; we store only Stripe’s customer and subscription identifiers and the events Stripe sends us about them.
3. What we do not do
- We do not sell your personal information, and we do not share it for cross-context behavioural advertising. There is nothing to opt out of because it does not happen.
- There are no third-party analytics or advertising trackers in this application. No Google Analytics, no advertising pixels, no session-recording tools. The activity log described above is our own and stays on our own server.
- We do not use your portfolio, trades or positions to train machine-learning models.
- We do not build profiles about you for marketing, and we send no marketing email.
4. Who else receives data
Most of the outside services this app talks to receive only a symbol or a date range — never your identity. Those are market-data sources (exchange and vendor feeds, company filings, economic statistics, news and cryptocurrency prices), and a request for a stock’s price carries nothing about who asked.
The services below can receive something connected to you:
| Service | What reaches it |
|---|---|
| Stripe | Billing identifiers and payment details you enter on Stripe’s own form |
| Zerodha Kite / E*TRADE | Requests authenticated with the credentials you connected |
| Twilio (only if SMS is enabled for your account) | Your mobile number and the message sent to it |
| Email delivery | Your email address and the message sent to it |
| Browser push services (Google, Mozilla, Apple) | The encrypted notification and your push endpoint, as part of how web push works |
| Google (Gemini) and Anthropic (Claude), for the optional AI features | The market context assembled for your question and the question itself. Do not type anything into an AI feature that you would not want sent to a third party. |
| IP geolocation | Your IP address, to determine an approximate country |
We disclose information to these services only to operate the features you use. We also disclose information where the law requires it.
5. Where data is held
Application data is stored on a server we operate directly in the United States, not on rented cloud infrastructure. If you are in India, your information is therefore transferred to and processed in the United States; by using the application you are asking us to provide it from there. The third-party services in section 4 process data in their own locations.
6. How it is protected
- All traffic is served over HTTPS; the session cookie is
HttpOnly,SecureandSameSite-restricted. - Passwords are stored as bcrypt hashes. We cannot read your password and will never ask you for it.
- Broker credentials are encrypted at rest with AES-256-GCM.
- Sign-in is rate-limited, and an optional two-step email code is available.
- Market-data access requires a signed-in session.
No system is perfectly secure. If we discover a breach affecting your personal data we will notify you and the relevant authority as the DPDP Act and applicable US state laws require.
7. Your rights
Whatever law applies to you, the practical route is the same: email support@tradewickai.com from the address on your account. We will respond within 30 days. There is currently no self-service delete button in the application, so deletion is carried out by hand on request — we would rather say that plainly than imply an automation that does not exist.
If you are in India (DPDP Act, 2023)
- Access a summary of the personal data we hold and who it has been shared with.
- Correction, completion and updating of inaccurate data — most of it you can edit yourself in the app.
- Erasure of your personal data, unless we are required to keep it.
- Withdraw consent at any time; the app stops processing on that basis, which in practice means closing your account.
- Grievance redressal through the address above. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.
- Nominate another person to exercise these rights if you die or become incapacitated.
If you are in the United States (CCPA/CPRA and comparable state laws)
- Know what categories of personal information we collect, why, and who receives it — section 2 and section 4 are that disclosure.
- Delete the personal information we hold about you.
- Correct inaccurate personal information.
- Opt out of sale or sharing — not applicable: we do neither, and we have not in the preceding twelve months.
- Limit use of sensitive personal information — we use it only to provide the service you asked for.
- Non-discrimination — exercising any of these rights will not degrade your access or change what you pay.
An authorised agent may make a request on your behalf with written proof; we may still ask you to verify it directly.
8. Children
TradeWick is not intended for anyone under 18 and we do not knowingly create accounts for children. If you believe a child has an account, write to us and we will remove it.
9. Changes
If this policy changes materially we will change the effective date above and notify account holders by email. Because access is by invitation and the user base is small, that notice is a direct message rather than a banner.