Privacy Policy

1. What we collect

• Account data: your email address and a securely hashed password. We never store your password in plain text.
• Usage data: your plan/tier, saved backtesting sessions, and basic technical logs (IP, browser) used for security and rate limiting.
• Payment data: handled entirely by our merchant of record, Lemon Squeezy. We do not receive or store your card details — only a customer/subscription reference and your plan status.

2. How we use it

• To provide the Service and enforce your plan's access.
• To authenticate you and keep your account secure.
• To send essential emails (password resets, receipts, account notices).
• To comply with legal obligations.

We do not sell your personal data.

3. Cookies

We use a single essential, http-only session cookie to keep you logged in. It is not used for advertising or cross-site tracking.

4. Who we share data with (sub-processors)

We rely on a small set of providers to run the Service:

• Lemon Squeezy (payments & merchant of record)
• Neon (database hosting)
• Netlify (application hosting)
• Resend (transactional email)

5. Data retention

We keep your account data while your account is active. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain records (e.g. for tax/accounting).

6. Your rights

Depending on where you live (e.g. under GDPR or CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. To exercise these, email crtlab@proton.me.

7. Security

We use hashed passwords, encrypted connections, and scoped access controls. No system is perfectly secure, but we work to protect your data and will notify affected users of a material breach as required by law.

8. Changes & contact

We may update this policy; material changes will be posted here with a new effective date. Questions or requests: crtlab@proton.me.