Privacy Policy

01Who we are

This Privacy Policy explains how IndicatorStack ("IndicatorStack," "we," "us") handles personal information when you visit indicatorstack.com, use LiveChart, create an account, subscribe, or contact us. For visitors and customers in the EEA, the UK and Switzerland, we are the controller of that information. Our contact details are in section 15.

02What we collect

When you use LiveChart

The tickers and intervals you open are sent to our server, which fetches the market data for them. Those requests appear in our standard server logs (see "Automatically" below). The chart itself runs in your browser.

When you create an account

• Your email address.
• A one-time sign-in code, stored only as a fingerprint for 15 minutes, and the number of attempts.
• Your chart settings and alert preferences, when you're signed in, so they follow you between devices.
• Anything you add to your profile: a display name and a profile picture. Your picture is stored with your account and shown only to you, in your header and on charts you choose to share.
• Your watchlist (the tickers you pin) and your trade journal (the trades you log, with any notes, tags and the stack's read at the time). Both are private to your account.
• If you signed up from a chart someone shared, their share code, so the referral can be credited.
• When you share a chart: the picture of it (with your display name and picture, if you've set them), the ticker and interval, and the read shared with it. Anyone with the link can see it, so the post or message that carries the link can show the chart.
• Your layers and subscription status, your Stripe customer and subscription IDs, and when your subscription renews or ends.
• Short records of the alert emails we've sent you (the ticker, interval, event and time), so the same alert is never sent twice.

Payment details

You enter card or wallet details into Stripe's secure payment form. They go directly to Stripe and never reach our servers. In our Stripe account we can see limited details, such as the card brand, the last four digits, the expiry date, the billing country and postal code if collected, and whether a payment succeeded.

When you contact us or The Desk

Your email address, your message and anything you attach, such as chart screenshots and settings.

Automatically

When you visit, our web host records standard server logs: your IP address, browser and device type, the pages, files and data requested, the referring page and the time. To prevent abuse we also count requests per visitor for a few minutes, using a fingerprint of the IP address. When the checkout opens, Stripe's script collects device and browser information to prevent fraud (see Stripe's privacy policy).

Google Analytics (with your consent where the law requires it, see section 3) records how the website is used: the pages you view, the buttons and links you click, how far you scroll, the steps you reach in the order panel and the value of a subscription, your device, browser and screen, the page that referred you, and your approximate location (country and city), which Google derives from your IP address without storing the address itself. It doesn't receive your email or payment details.

What we don't collect

We don't collect passwords, government ID numbers or other sensitive personal information, we don't ask for brokerage logins or see your trades, and we don't buy information about you from anyone.

03On your device: sign-in, chart settings, cookies and fonts

• Sign-in cookie. When you sign in we set one first-party cookie (is_session), signed so it can't be altered, unreadable by scripts, and lasting 60 days or until you sign out. It's strictly necessary to keep you signed in.
• LiveChart settings and recent tickers. LiveChart saves your settings and the tickers you've opened recently in your browser's local storage, so your chart opens the same way next time. Signed in, your settings are also saved to your account. Reset to defaults in the chart's Settings clears them, and you can clear local storage in your browser at any time.
• Watchlist and journal, signed out. Without an account, the tickers you pin and the trades you log are kept only in your browser's local storage. When you sign in, they move to your account and are cleared from the browser.
• Share links. A chart link someone shares with you may carry their share code (?ref=). We keep it in a first-party cookie (is_ref) for 30 days so that, if you sign up, the referral is credited. It holds no information about you.
• Ticker logos. LiveChart shows company logos, which your browser loads from FMP's image server, so FMP receives your IP address and the ticker whose logo is shown, with no referrer.
• Notifications. If you turn on desktop notifications, your browser asks your permission and remembers your answer. You can change it in your browser settings.
• Cookies for analytics. Google Analytics sets first-party cookies (_ga and _ga_*, lasting up to two years) to recognize repeat visits. In the EEA, the UK and Switzerland they're only set after you choose OK on our consent bar, and you can change your choice at any time with Cookie settings at the bottom of every page. We don't use advertising cookies. When the checkout opens, Stripe may set cookies that are strictly necessary for payment security and fraud prevention.
• Fonts. Our pages load typefaces from Google Fonts, so your browser sends Google your IP address and standard request information. Google's privacy policy applies.
• Analytics. We use Google Analytics 4 with Google signals and ad personalization turned off, to see in aggregate which pages, buttons and steps help people and which don't. Besides Cookie settings, you can block it everywhere with Google's opt-out browser add-on, and every part of the site works the same without it.

04How we use your information

Where we rely on legitimate interests, they are running and protecting our business in ways you'd reasonably expect, and you can object (section 10). Stripe screens payments automatically for fraud; apart from that, we don't make decisions about you based solely on automated processing.

05Emails we send

We send emails that are part of the Service: sign-in codes, a note when your layers switch on and when they end, the alert emails you turn on, and replies to your messages. Stripe sends payment receipts and billing notices.

We only send marketing emails if you've opted in, and every one includes an unsubscribe link. We don't currently send any.

06Who we share it with

We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We share it only with:

• Stripe, for payments, fraud prevention, receipts, subscription billing and the billing portal. Stripe also processes some information as an independent controller under its own privacy policy.
• Our email delivery provider (such as Postmark or Resend), which sends our emails and processes your email address and the content of the emails.
• Our website host, which stores the website, server logs and account records.
• FMP, our market-data provider, which receives the tickers our server requests, but not who you are, and which serves the ticker logos your browser loads.
• Google, which provides Google Analytics as our service provider and serves our fonts, as described in sections 2 and 3, with Google signals and advertising features turned off.
• Professional advisers, such as accountants and lawyers, under a duty of confidentiality, where needed.
• Authorities and others, where the law requires it, or where needed to protect rights or safety or to prevent fraud.
• A buyer or successor, if the business is sold or merged, who would continue to handle your information under this policy.
• Anyone else, with your consent.

Our service providers may use your information only to provide their services to us.

07International transfers

We're based in the United States, and our providers may process information in the United States and other countries. When we transfer personal information from the EEA, the UK or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK addendum) or the EU-U.S. Data Privacy Framework where a provider is certified.

08How long we keep it

When we no longer need information, we delete or anonymize it.

09Security

The site uses HTTPS throughout. Card details are handled by Stripe, which is certified to PCI DSS Level 1. There are no passwords to steal: sign-in codes are single-use, short-lived and stored only as fingerprints, and the sign-in cookie is signed and unreadable by scripts. Account records are kept outside the public website, and access is limited to people who need it. No method of transmission or storage is completely secure. If a breach affects your personal information, we'll notify you and the authorities as the law requires.

10Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy, including in a portable format;
• correct information that's wrong or incomplete;
• delete your information, including your whole account;
• object to, or ask us to restrict, how we use it;
• withdraw consent where we rely on it; and
• complain to your data protection authority, if you're in the EEA, the UK or Switzerland.

To make a request, email desk@indicatorstack.com from your account's address. We may need to verify your identity before acting. We respond within one month (EEA and UK) or 45 days (US states), and may extend that where the law allows. There's normally no fee. You can use an authorized agent if they provide proof of their authority.

We must keep some records, such as payment records, to meet legal obligations. If we decline your request, you can appeal by replying to our decision. If you're still unhappy, you can contact your state attorney general or data protection authority.

11US state privacy rights

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states have rights to know about, access, correct and delete their personal information, to opt out of its sale or sharing, targeted advertising and profiling, and not to be treated differently for exercising these rights. We don't sell or share personal information, use it for targeted advertising or profiling, or collect sensitive personal information.

Notice at collection: in the last 12 months we have collected the following categories of personal information.

We keep each category for the periods in section 8.

12Do Not Track and Global Privacy Control

We don't track you across other websites: Google Analytics runs only on our own pages, with Google signals and advertising features off. Because we don't sell or share personal information, there's nothing to opt out of, but we still treat a Global Privacy Control signal from your browser as a valid opt-out request.

13Children

The Service is for adults and isn't directed to anyone under 18. We don't knowingly collect information from children. If you believe a child has given us personal information, email desk@indicatorstack.com and we'll delete it.

14Changes to this policy

We may update this policy. We'll post the new version on this page with a new "last updated" date and, if a change materially affects how we use information we already hold, we'll tell affected account holders by email before it takes effect.

15Contact

Privacy questions and requests: