Privacy Policy

1Introduction

ChartDeck is operated by Market Experts Trading LLC ("Company", "we", "us" or "our"). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what we collect, how we use it, who we share it with and the choices you have when you use chartdeck.trade and the ChartDeck terminal (the "Service").

We do not sell your personal information, we do not use third-party advertising or analytics trackers, and we do not store your card details.

2Information we collect

Account information you give us

• Email address and, if you set one, a password. We store only a salted, one-way hash of your password (Argon2), never the password itself.
• Display name, optional profile picture and short bio, and your preferences (for example theme and time zone).
• Your content: chart drawings, layouts, watchlists and alerts you save.
• Messages you send us (for example support requests).

Social and wallet sign-in

If you sign in with Google, Discord, Apple, X or Telegram, we receive from that provider your account identifier and, where the provider shares them, your name, email address (and whether it is verified) and profile picture. We do not receive or store your password for that provider, and we do not keep the provider's access tokens.

If you sign in with Google, Discord, X or Telegram we copy your profile picture from that service as your ChartDeck avatar; you can replace or remove it on your account page.

If you sign in with a crypto wallet (for example MetaMask, Phantom or Trust Wallet), we store your public wallet address, which you prove you control by signing a one-time message. Wallet sign-in never creates a transaction.

Payments

• Card payments are handled entirely by Stripe. Your card number and security code go directly to Stripe and are never sent to or stored by us. We keep Stripe's customer and subscription identifiers, your plan, amounts, dates and payment status.
• Bitcoin payments go through our own BTCPay server. We keep the invoice identifier, amount, plan and status.
• Wallet payments (stablecoins from MetaMask, Phantom, Trust Wallet and similar): we keep the chain, token, amount, the transaction hash and the paying address as recorded on the public blockchain. Blockchain transactions are public by nature and cannot be deleted by us.

Information collected automatically

• Page views (first-party analytics). When a page loads we record the page path (never the query string), the referring website's domain, campaign tags (utm), your country (supplied by Cloudflare from your connection), your device type, browser and operating system, and a random visitor and session id from our own cookies. If you are signed in, the view is linked to your account. We do not store your IP address for this: it is combined with a random value that changes every day and one-way hashed, and the daily values are deleted after two days so older hashes cannot be linked back to an IP address.
• Account and security events, such as sign-ups, sign-ins, failed sign-ins, password changes and plan changes, with the time, a hashed IP address, your country and a summary of your browser.
• Session and security data. For each signed-in session we store the IP address and browser user agent so you can review and sign out your devices from your account page and so we can detect abuse. Failed sign-in and password-reset attempts are recorded with the IP address to stop brute-force attacks.
• System logs about errors and the health of the Service. Log entries may include your account id or email address when an event concerns your account; they identify connections only by a hashed IP address and never contain passwords, tokens or card data.

Emails we send

We keep a record of the emails we send you (recipient, template, subject, time and delivery status), and for a short time the email content so a failed send can be retried. Security emails that contain one-time links are logged without their content.

3How we use your information

• Provide the Service: create and manage your account, sign you in, save and sync your drawings, layouts and watchlists, and apply your plan.
• Payments: take payments, grant and renew plans, and handle refunds and disputes.
• Communication: send account and security emails (verification, password reset and password-change notices, receipts, plan and renewal notices, and alert notifications you set up) and, where allowed, product news and offers. You can opt out of marketing emails at any time.
• Analytics: understand, in aggregate, how the Service is used so we can improve it.
• Security: detect and prevent fraud, abuse, account takeover and attacks on the Service.
• Legal compliance: comply with applicable laws, and establish or defend legal claims.

4Cookies and local storage

We use only first-party cookies that are needed to run the Service or to count visits, plus the cookies set by Cloudflare's bot check. We do not use advertising or cross-site tracking cookies.

We also use your browser's local storage for conveniences such as your theme choice and, when you are signed out, your chart drawings. This data stays in your browser.

You can block or delete cookies in your browser settings. Blocking cd_session will stop you from signing in.

5Service providers

We use the following providers to run the Service. They process personal data on our behalf, or as independent controllers where noted, under their own privacy policies.

Market data comes from exchanges (for example Binance, Bybit, OKX, Bitget, BloFin, Hyperliquid, MEXC, Gate, KuCoin and Coinbase). Our servers request this data; your personal data is not sent to those exchanges.

6Sharing and disclosure

Apart from the service providers above, we share personal data only:

• for legal reasons: if required by law, court order or government request, or to protect our rights, property or safety, or those of our users;
• in a business transfer: in the event of a merger, acquisition or sale of assets, your information may be transferred to the acquiring entity, subject to this policy;
• within Market Experts Trading LLC, which operates both ChartDeck and marketexpertstrading.com; and
• with your consent, when you explicitly ask us to.

We do not sell or rent your personal information.

7Data retention

When you ask us to delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law (for example payment records) or to resolve disputes and prevent fraud.

8Data security

• Encryption in transit: all traffic to ChartDeck uses TLS.
• Passwords and tokens: passwords are hashed with Argon2; sign-in sessions, password-reset links and verification links are stored only as one-way hashes.
• Access controls: access to personal data is limited to staff who need it, and every administrative change to a user account is recorded.
• Abuse protection: rate limits, sign-in throttling and a bot check protect accounts from automated attacks.

While we strive to protect your information, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

9Your rights and choices

• Access and portability: ask for a copy of the personal data we hold about you.
• Correction: update your display name, picture and preferences on your account page, or ask us to correct other data.
• Deletion: ask us to delete your account and personal data by emailing [email protected] from the email address on your account.
• Marketing opt-out: use the unsubscribe link in any marketing email. Account and security emails are still sent while you have an account.
• Devices and sign-in methods: review and sign out your devices, and connect or disconnect sign-in methods, on your account page.
• Withdraw consent where we rely on it, at any time.

To exercise these rights, contact us at [email protected]. We may need to verify your identity before acting on a request.

10California and European rights

California (CCPA)

California residents have the right to know what personal information is collected and how it is used, the right to delete personal information, the right to opt out of the sale of personal information (we do not sell personal information), and the right to non-discrimination for exercising these rights.

European Economic Area and United Kingdom (GDPR)

If you are in the EEA or the UK, you also have the right to restrict or object to processing and to lodge a complaint with your local data protection authority. Our legal bases for processing are: performance of our contract with you (running your account and plan), legitimate interests (security, fraud prevention, first-party analytics and improving the Service), legal obligations (tax and accounting records), and consent where we ask for it (for example marketing emails, where required).

11International data transfers

Market Experts Trading LLC is based in the United States, our servers are hosted in the European Union, and some providers (such as Cloudflare, Stripe and Resend) process data in the United States and other countries. Your information may therefore be transferred to and processed in countries other than your country of residence, which may have different data protection laws. We ensure appropriate safeguards are in place, such as the providers' standard contractual clauses, to protect your information in compliance with applicable laws.

12Children

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will delete it promptly.

13Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date, and by email or in the Service where appropriate. We encourage you to review this policy periodically.

14Contact

If you have questions, concerns or requests about this Privacy Policy or our data practices, please contact us: