Privacy Policy
Last updated: October 12, 2026
This is a convenience translation. The Hebrew original is the binding version; in case of any conflict, the Hebrew text controls.
This policy explains what data is collected when you use ChartRoom, how it is stored, and what your rights are. Your privacy matters to us — the Service does not sell data and does not use it for advertising.
1. Who is responsible for the data
ChartRoom is the service brand, currently operated by an individual. For privacy enquiries: davidtheking27@gmail.com
2. Information and purposes
Providing account details is voluntary, but an email and authentication are necessary for a cloud account. Broker connections, portfolio entries and push notifications are optional; declining them limits the corresponding features. We do not request GPS location or biometric information. We do not operate advertising trackers.
| Data | What is processed | Purpose |
|---|---|---|
| Account and profile | Email, name, display preferences and Google profile data when signing in with Google | Account creation, authentication and display |
| Journal and portfolios | Trades, notes, holdings, deposits, missed opportunities and watchlists | Journal, analysis and cross-device synchronization |
| Broker connections | Broker API credentials encrypted in Supabase Vault, imported reports and equity | Read-only data import and journal calculations |
| Notifications | Push endpoint and browser encryption keys, when enabled | Sending requested notifications |
| Technical records | Account identifier, screener visit records, error messages, stack traces and browser information; infrastructure providers may process IP addresses and request logs | Troubleshooting and operation |
| Browser storage | Session tokens, language, preferences and cached market information | Sign-in continuity, preferences and performance |
| Document acknowledgements | Terms and privacy versions, server timestamp and declaration of age 18+ | Recording acceptance and managing document updates; not marketing or billing authorization |
3. Storage and access
Account data is stored using Supabase. User-scoped access policies restrict ordinary users to their own data; authorized server processes and administrators may also access data as needed for operation and support. These measures do not guarantee absolute security. Network communication uses HTTPS.
Broker credentials are encrypted in Supabase Vault and used for authenticated requests to the relevant broker. Browser storage supports sign-in and preferences; use a trusted device and sign out of shared devices.
4. Service providers
| Provider | Role and data |
|---|---|
| Supabase | Authentication, database, encrypted broker credentials and server functions |
| GitHub Pages / jsDelivr | Website and library delivery; technical connection data such as IP addresses |
| Authentication when selected by the user | |
| IBKR / Bybit | Authenticated requests to retrieve account reports and balances |
| Finnhub / FMP / Alpha Vantage / CoinGecko / Yahoo Finance / CNN / Alternative.me | Market-data requests, symbols and technical request data; direct browser image requests can disclose an IP address |
| Browser and push-service providers | Notification delivery when enabled |
Providers may process information outside Israel according to their infrastructure and applicable agreements. We do not sell personal data or share it with advertisers. The embedded stock screener is part of the service and stores watchlists and screening preferences. Acknowledging this policy is not consent to marketing messages.
5. Access, correction and deletion
You may contact davidtheking27@gmail.com to request access, correction or deletion, subject to applicable law. We may request proportionate identity verification. Trade CSV export is available in Settings; it is not an export of every category of personal information. Editable journal records can also be corrected within the app.
6. Retention
Account records are retained for service operation. Deletion requests are reviewed individually, including related account records. Legal retention requirements, security records and backup cycles may affect deletion. We will explain relevant restrictions and timing when handling a request; deletion of a displayed record does not establish immediate deletion from all backups.
7. Adults only
The service is intended only for people aged 18 and over. If you believe a minor has created an account, contact us so we can investigate and take appropriate action.
8. Policy changes
The current version and date are shown on this page. Material changes will be communicated through the service; additional consent will be requested where required. A policy update does not automatically authorize unrelated new uses of personal information.
9. Contact
For any privacy question: davidtheking27@gmail.com