Privacy Policy

What we collect. Account data: your email address, the name you give when you sign up, your password hash and, if you turn it on, your two-factor secret and backup codes. If you add one, an optional contact phone number, stored unverified and not used for text messages, two-factor authentication or account recovery. Product data you create (watchlists, drawings, alerts, workspaces, journal entries, pre-trade records and their review notes, saved screens and research records), and the record of each alert that fires: the price, the value its rule compared, which provider the quote came from and when, and, for an alert set to email you, whether our mail service accepted the message. First-party usage analytics (page views and feature events keyed to a random identifier stored in your browser — not a fingerprint); events recorded while you are signed in also carry your account id. If your first visit here came through a link carrying campaign tags (utm parameters or a ref tag) or from another website, those tags, that site's host name and the page you landed on are kept with your analytics events and, when you create an account, with the account, so a sign-up or a subscription can be traced to the campaign that brought it even when you confirm your address on another device; when you open the checkout, the same record is added to your Stripe customer. And an audit log on your account — sign-ins, password resets, two-factor changes, plan changes, exports and account deletion — which is included in your export. If you subscribe, your account also holds your Stripe customer id and subscription status; Stripe holds the payment method. When you create an account we ask for your date of birth to check that you are 18 or older; the check runs when you submit the form, and the date itself is not stored. What is stored, in the audit log, is that the check passed and which version of the Terms you accepted. If you write to us through the contact form, your name, the address you give, the topic you pick, the page you wrote from and your message are mailed to our support inbox and kept there as an email; when you are signed in, your account's own address, id and plan go with it in place of a typed address. Our own mail service sends that mail as it sends account mail (through Google's Gmail API when that transport is configured; see Third parties below) to our support inbox, a Google Workspace mailbox on quantz.online, so Google holds what you wrote. Our database keeps none of what you wrote: only an analytics event with the topic, the page and whether the message was sent. A confirmation with a reference number and none of what you wrote is mailed to the address on the message, at most two a day to one address.

Saved research and sharing. Research you save or queue on our servers includes its configuration, captured candles, results and job status; cloud presets keep the settings you name and save. Private research spaces keep notes, watchlist snapshots, comments, invitations and membership roles. The owner and members can access a space according to their roles; the owner manages invitations and can remove members. If you create a report link, anyone who has that link can read the report until it expires or you revoke it. Sharing a report does not grant access to your account or trading controls.

Your PAPER notebook. Our database stores your simulated account's virtual cash and funding record, fee and slippage settings, fills and lots, saved trade plans and the plan snapshots attached to fills. It also stores journal notes and tags, and any images you attach with their file names and attachment references. These are simulated trading records associated with your account.

Browser push notifications. If you opt in and grant your browser permission, we store the device name, subscription endpoint and encryption keys with your account. We send a generic notification through your browser's push service asking you to sign in; its message contains no symbol, price or alert-rule details. You can remove a device from Alerts to delete its registration on our server. Browser notification permission is separate and can be turned off in your browser's settings.

IP addresses and browser details. Each entry in your account's audit log records the IP address and browser user-agent string of the request behind it. Each sign-in session records the IP address and user-agent it was created from. A newsletter sign-up records them as evidence of the consent. Some rate limits count requests per IP address, in counters that expire on their own.

Where it lives. On our own servers: our Postgres database, with our own Redis in front of it as the sign-in session cache, as the store for one-time tokens (password-reset links, two-factor sign-in steps and trusted-device markers), and as the home of rate-limit and monthly-allowance counters — keyed to your account id, to an IP address or to a hash of an email address, and expiring on their own. It also holds the latest check of each of your active alerts (when it ran, the value it compared and which provider the quote came from), each kept for five minutes. Analytics events go to our own database. Optional marketing tracking is described below; it can also send data to the vendors you allow. Paying happens on our domain, where the checkout page loads Stripe's own script from js.stripe.com and shows Stripe's payment form inside a Stripe frame — your card details are typed into Stripe's frame and go to Stripe, never to our servers. Managing or cancelling a subscription opens Stripe's billing portal on Stripe's domain, from Settings → Billing.

Third parties we do use. Stripe processes payments (we never see card numbers). Transactional email — sign-in verification, password resets and similar account mail — is sent by our own mail service from our domain, quantz.online: through Google's Gmail API from a QuantZ mailbox on that domain when that transport is configured, or otherwise straight to your mail provider, signed with our own DKIM key, or through a Google Workspace SMTP relay. Server-side, we query market-data vendors. Some AI features use outside language models, as the next paragraph describes.

AI features. Some features send what you give them to an outside language model to produce the answer: Google's Gemini, OpenAI or Anthropic, depending on the feature and on which of them is configured. Gemini answers the chart assistant (your typed messages), chart analysis (your prompt and any screenshot you attach; a question in education mode is also turned into an embedding by Google), journal write-ups (the trade you log, with its screenshot if you attach one), the terminal commands you type, and the plain-English alert compiler (your sentence, when its own rules cannot read it). The AI screener sends your query to Anthropic or OpenAI. Chart narratives try OpenAI, then Anthropic, then Gemini, and send the symbol, candle size and indicator readings of the chart you asked about. Symbol summaries send the symbol with the news headlines or filed figures they summarise. The Ask QuantZ support assistant on our pages answers from set replies and passages of our own pages first; only a question those do not answer is sent, with the last few turns of the conversation and those passages, to Google's Gemini, and its answer names the model that wrote it. We do not store the conversation unless you attach it to a message for a person. When our support mailbox assistant is on, mail sent to our support address is read through Google's Gmail API, and a message that set replies and our pages do not answer is sent to Google's Gemini, its subject and text without the quoted thread or the sender's address, with passages of our pages, to draft an answer. A person reviews each draft before it is sent, unless we choose to let set replies and page excerpts go out on their own; Gemini's drafts go out on their own only if we choose that too. Its replies come from that mailbox. Of each mail it decides on, our database records only its topic and what became of it, never who sent it or what it said; to hold each sender to a daily limit, our Redis counts the day's mail from each address under a hash of the address, and each count expires two days after it was last added to. The chart assistant, chart analysis and journal write-ups also send the market context they work from, such as the symbol, candle size, recent prices and the indicator readings we computed. Some of these tasks can run on a model we host on our own servers instead, and every answer is stamped with the model that wrote it.

Newsletter and waitlist. Signing up for the newsletter stores your email address with the exact consent wording you agreed to, the form you used, the time, and the IP address and browser user-agent recorded when you consented; the only mail sent before you confirm is the confirmation email itself. Unsubscribing marks the record rather than deleting it, so it shows the request was honoured. Joining the waitlist stores your email address, whether you used an invite code, and the experience and broker you gave, if any.

Server logs. Our services keep operational logs, and a log line can carry the account id or email address involved in an error: the mail service records the recipient's address in full when a message fails to send. A crash report from the app records the error, its stack trace and your browser's user-agent string, with no account id. Each service keeps at most three log files of up to 10 MB, and the oldest lines are discarded as new ones are written.

Cookies and browser storage. Our cookies: a session cookie when you sign in; short-lived cookies for a two-factor sign-in step and, if you choose to trust a device, a trusted-device cookie; and a deployment-group cookie for canary rollouts. Each is set by our own domain and is needed for the part of the site it serves; the optional vendor cookies below require your choice. On the checkout page only, Stripe’s script can set Stripe’s own cookies, which Stripe uses for fraud prevention under its own privacy policy. Your browser’s local storage on this device also holds: the random analytics identifier described above and, if your first visit carried campaign tags or came from another website, a record of that first visit (the tags, the site's host name, the landing page and the date); your preferences, such as theme, layout, chart indicators, studies, scripts and saved strategy configurations; the symbols you pinned and viewed recently, and the last chart you viewed, so it can reopen (when you are signed in, that last chart is also saved to your account so it follows you to another device); the desk’s trading cool-down, so it holds across a reload; whether this browser was last signed out, so a page can draw before it checks; and the daily clock for the signed-out screener preview. Clearing this site’s data in your browser removes all of it.

Getting your data out. Export is self-serve and needs no request: the Export button on Journal and Book returns your data as open JSON, with a manifest that accounts for every table in our database — what is in the file, what we hold back (credentials only, because handing them over would hand over the account), and the account-record fields the file leaves out.

Deleting your account. Deletion is self-serve, from Settings → Security, and needs no request. It asks for your password and for the word DELETE typed out. Deletion does not cancel a subscription: cancel it in Settings → Billing first. Deletion refuses while a plan would still charge, and it goes ahead only after Stripe confirms that none would; otherwise nothing is deleted. Deleting an account whose plan you have already cancelled ends its access at once, including any time left in the period. Deletion is permanent, so export first if you want a copy. You can also clear the anonymous analytics identifier from your browser yourself by clearing site data.

Who controls your data. The data controller is QuantZ, a sole proprietorship operating from the Province of Ontario, Canada. Postal address: 399 Spring Garden Ave, North York, Ontario, Canada. Privacy enquiries: thezhou@quantz.online.

Where your data are handled. We are based in Ontario, Canada, but your data are processed and stored on servers in the United States — New Jersey, on infrastructure we rent from DigitalOcean. Using the Service therefore involves your data being held in the United States, whatever country you are in. Payments are handled separately by Stripe on Stripe’s own systems. Mail you send us, through the contact form or to one of our addresses, is held in our Google Workspace mailboxes on Google's systems.

Legal basis and your rights. We accept accounts worldwide, so rather than ask which privacy law covers you, we give everyone the same rights: ask what we hold, take a copy (export is self-serve and needs no request), have it corrected, and have your account and its data deleted (deletion is self-serve too, apart from the records it keeps, named above). We use your data to run the Service you asked for, to keep your account secure, and to bill you if you subscribe. Allowing Meta permits sharing with Meta for advertising measurement and matching under its policy. Allowing Microsoft Clarity permits recordings of the public pages described above. We do not sell personal information. If the law where you live gives you more than this, that law wins and we will honour it; write to thezhou@quantz.online.

Changes. Material changes to this policy will be announced in the changelog before they take effect.