1. What we collect
- Account data: your email address and a securely hashed password. We never store your password in plain text.
- Usage data: your plan/tier, saved backtesting sessions, and basic technical logs (IP, browser) used for security and rate limiting.
- Payment data: handled entirely by our merchant of record, Kai Alan Branca (CRTLAB). We do not receive or store your card details — only a customer/subscription reference and your plan status.
2. How we use it
- To provide the Service and enforce your plan's access.
- To authenticate you and keep your account secure.
- To send essential emails (password resets, receipts, account notices).
- To comply with legal obligations.
We do not sell your personal data.
3. Cookies
We use a single essential, http-only session cookie to keep you logged in. It is not used for advertising or cross-site tracking.
4. Who we share data with (sub-processors)
We rely on a small set of providers to run the Service:
- Railway (application hosting and database)
- Cloudflare (network delivery, DNS and security)
- Stripe (payment processing)
- Resend (transactional email)
- Google and Discord (optional sign-in, only if you choose it)
5. Data retention
We keep your account data while your account is active. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain records (e.g. for tax/accounting).
6. Your rights
Depending on where you live (e.g. under GDPR or CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. To exercise these, email crtlab@proton.me.
7. Security
We use hashed passwords, encrypted connections, and scoped access controls. No system is perfectly secure, but we work to protect your data and will notify affected users of a material breach as required by law.
8. Changes & contact
We may update this policy; material changes will be posted here with a new effective date. Questions or requests: crtlab@proton.me.