Privacy Policy

Account information. When you sign up we collect your email address, mobile number, and a password. The password is stored only as a one-way cryptographic hash — we cannot read it. Verification codes sent to your email or mobile are also stored hashed and expire after a short window.

Broker connection details. To stream market data, you connect one supported broker using API credentials issued by that broker. We store the API key and an encrypted copy of the API secret (AES-256-GCM; the encryption key is held separately from the database). We never ask for, receive, or store your broker login password, and the connection is used only to source market data for your charts.

Billing information. Payments are processed by Razorpay, our payment gateway. Your card, UPI, or bank details go directly to Razorpay — we never receive or store them. We keep only your subscription status, plan, and a record of billing events needed to run your account.

Workspace data. Chart layouts, drawings, indicator settings, and similar preferences you create in the terminal are saved so they're there when you come back.

Security and usage records. We log authentication events (sign-ups, logins, password resets) together with the IP address and browser user-agent involved. These records exist to protect your account — for example, to detect repeated failed login attempts.

• No advertising or cross-site tracking cookies — the only cookie we set is the strictly necessary session cookie that keeps you logged in.
• No broker login passwords — ever.
• No card, UPI, or bank account details — those stay with Razorpay.
• No sale or rental of personal data to anyone, for any purpose.

• To create and operate your account, verify your email and mobile, and keep you signed in.
• To establish the market-data connection with your chosen broker and render live and historical data in your terminal.
• To process subscription payments, manage your plan, and handle trial requests.
• To keep the service secure — rate limiting, abuse prevention, and investigating suspicious activity.
• To respond when you contact us for support.
• To send service messages about your account, such as verification codes, trial activation, or subscription notices. We don't send third-party marketing.

We share personal data only with the parties needed to run the service:

• Your broker — when you initiate the connection, your broker API credentials are used to authenticate with that broker. This happens at your direction; brokers have their own privacy policies.
• Razorpay — to process payments you authorize.
• Infrastructure providers — the hosting, database, email, and SMS providers that the platform runs on, bound to processing data only on our behalf.
• Legal requirements — if required by law, regulation, or a valid request from a competent authority.

We do not sell personal data, and we do not share it with advertisers or data brokers.

ODX Charts uses a single, strictly necessary session cookie to keep you authenticated while you use the terminal. It contains a random session identifier — not your personal details — and is removed when your session ends or you log out. Because we use no advertising or analytics cookies, there is no cookie consent banner to click through.

• Passwords hashed with bcrypt; verification codes stored as SHA-256 hashes.
• Broker API secrets encrypted at rest with AES-256-GCM, with the encryption key held outside the database.
• All traffic between your browser and our servers is encrypted in transit (HTTPS/TLS).
• Account lockouts after repeated failed login attempts, and an audit trail of authentication events.

No system is perfectly secure, but we design so that a single failure doesn't expose usable secrets — hashes instead of passwords, ciphertext instead of API secrets, and card data that never touches our servers at all.

• Account and workspace data is kept while your account is active.
• Billing records are retained as required by Indian tax and accounting law, even after account closure.
• Security audit logs are kept for a limited period for fraud and abuse prevention.
• Expired verification codes become unusable immediately and are purged routinely.

Subject to applicable law — including India's Digital Personal Data Protection Act, 2023 — you can:

• Ask for a copy of the personal data we hold about you.
• Correct inaccurate account details.
• Ask us to delete your account and associated personal data (records we must keep by law, such as billing records, are retained for the mandated period).
• Disconnect your broker at any time, which stops any further use of the stored credentials.

To exercise any of these, email contact@odxcharts.com from your registered address.

ODX Charts is intended for adults. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 18; if you believe a minor has created an account, contact us and we will delete it.

If we change how we handle personal data, we'll update this page and the “Last updated” date above. For material changes — a new category of data collected, or a new kind of recipient — we'll also notify you by email or an in-app notice before the change takes effect.