Privacy Policy

ChartLooper is operated by Jakob Wimmer in Germany. For privacy questions or to exercise your data-protection rights, contact [email protected].

The information we process depends on how you use ChartLooper and the consent choices you make:

• Account and support information, such as your name, email address, authentication details, and messages you send to us.
• Subscription information from Stripe, such as your plan, subscription status, billing interval, payment status, final checkout amount and currency, and limited payment-method details. ChartLooper does not store your complete card number.
• Necessary technical information used to deliver and secure the service, including authentication state, security logs, device and browser information, and IP address.
• When you connect a supported broker, account metadata and trading history needed for your journal, such as the broker account identifier, broker, environment, account currency, symbols, orders, positions, executions, prices, quantities, commissions, fees, swaps, and timestamps.
• Broker OAuth access and refresh tokens are stored in encrypted form so scheduled synchronization can continue. ChartLooper does not receive or store your cTrader password and the cTrader integration cannot place, modify, or close orders.
• Unless you object, restricted Umami usage information such as sanitized public-page and dashboard feature categories, permitted UTM campaign parameters, sanitized referrer, approximate session engagement, approximate location, browser, operating system, and selected anonymous product and funnel events.
• With Marketing consent, advertising or affiliate attribution information such as Google Ads click identifiers, an opaque purchase transaction reference, conversion status, and PromoteKit referral code.

The NinjaTrader / Tradovate Connection has a gated Demo-development transport and remains disabled for production and Live use. In an explicitly approved Demo runtime, if you choose to connect it, ChartLooper processes only the information needed for read-only journal synchronization:

• Account identifiers, environment, currency, futures symbols, orders, positions, executions, prices, quantities, timestamps, commissions, and supported fees would be collected from the combined provider account system.
• Provider-hosted authorization is used; authorization tokens are encrypted at rest and used only for GET requests retrieving Demo account and trade-history evidence. After initial catch-up, enabled Demo synchronization runs about every 15 minutes and through a manual Sync now request. ChartLooper does not collect the provider password or issue order-entry requests.
• NinjaTrader or its applicable service providers would process the authorization and API requests under their own terms and privacy practices.
• Disconnecting would stop future synchronization and remove authorization once it is no longer shared by another selected account. Retention and analysis of previously imported provider data remains subject to written provider confirmation; ChartLooper does not currently promise that such data can be retained after disconnection.

We process information only for the purposes and legal bases described below:

• To provide accounts, the demo, backtesting features, subscriptions, support, and security where necessary to perform our contract with you or pursue our legitimate interest in operating a secure service.
• To connect a broker account at your request, import its completed trading history into your journal, refresh that history while synchronization remains enabled, prevent duplicate imports, and diagnose synchronization failures as part of providing the service you requested.
• To meet legal, accounting, fraud-prevention, and payment obligations where processing is required by law or supports our legitimate interests.
• To understand website and product-feature use and improve ChartLooper through restricted Umami analytics based on our legitimate interests under Article 6(1)(f) GDPR. You may object at any time.
• To attribute paid subscriptions to Google Ads or PromoteKit partners only when you consent to Marketing.

Unless you object, ChartLooper uses a restricted Umami Cloud configuration on public pages and selected authenticated dashboard feature categories. Umami helps us understand page views, anonymous sessions, engagement, acquisition channels, feature adoption, and the demo-to-subscription funnel.

• ChartLooper does not load Umami's general tracker script. It sends a minimized event directly to Umami's endpoint, without setting analytics cookies or reading analytics local or session storage, screen size, or other fingerprinting properties.
• The request necessarily transmits normal browser/network headers such as the IP address, User-Agent, and Accept-Language. Umami may use the IP address and User-Agent transiently for rotating anonymous sessions and coarse location, browser, operating-system, and device-class statistics; Umami states that it does not store the IP address.
• ChartLooper does not add Umami's browser-language or screen-dimension fields. Built-in browser-language and screen-resolution reports are therefore unavailable, device classification may be less precise, and time-on-page measurement is limited for visits that produce only one event.
• We send no names, email addresses, account IDs, form contents, auth codes, checkout or transaction IDs, Google advertising IDs, arbitrary query parameters, screen dimensions, or browser performance measurements.
• Dashboard page paths are restricted to coarse categories such as overview, session, analytics, trades, tags, checklists, and subscription. Record identifiers and all dashboard query parameters are removed. Profile, settings, and checkout-result pages are not recorded as page views.
• Selected product events report only coarse categories, such as which filter menu was opened, which comparison dimension was added, or whether monetary values are shown as currency, percentage, or R-multiples. After you affirmatively enable Analytics, locale events may additionally report the selected ChartLooper interface language and an explicit change between supported languages. The locale events do not read or attach your browser-language setting. Filter values, strategy names, tag names, session names, instruments, trades, and account content are not attached.
• A confirmed paid checkout may produce an anonymous event containing only the plan, billing interval, final amount paid, and currency. Its Stripe transaction ID remains in page memory solely for same-page deduplication and is never sent to Umami.
• We do not enable distinct visitor IDs, advertising profiles, heatmaps, keystroke capture, session replay, or cross-site tracking. Browser Do Not Track is respected.
• We treat this restricted, storage-free configuration as not requiring prior device-access consent under Section 25 TDDDG. The remaining minimized data processing is based on our legitimate interest in aggregate website and product-feature measurement under Article 6(1)(f) GDPR, and you may object at any time.

When you enable Marketing, ChartLooper may use Google Ads conversion measurement and PromoteKit affiliate attribution:

• Google Ads receives a conversion event only after ChartLooper confirms that Stripe created a paid subscription. The event contains an opaque transaction reference, the final amount paid, and the currency, but no email address or name.
• Google Ads is configured without advertising personalization or remarketing.
• PromoteKit reads the via referral parameter and may store a promotekit_referral cookie for up to 90 days. The referral code is attached to Stripe Checkout so partner commissions can be calculated.

Necessary storage supports authentication, security, billing flows, and your privacy preference. Restricted Umami analytics runs without cookies under our legitimate interest unless you object. Marketing technologies remain disabled until you consent.

• Ignoring the privacy banner permits only restricted Umami analytics; it does not enable Google Ads or PromoteKit.
• Marketing may enable Google Ads attribution cookies such as _gcl_* and the PromoteKit referral cookie.
• Reject all leaves necessary storage enabled but records your analytics objection and prevents Umami, Google Ads, and PromoteKit from collecting future data.
• You can use Privacy Policy & Settings in the website footer and the Change privacy settings button at the top of this page at any time. An analytics objection or withdrawn Marketing consent stops future collection and triggers best-effort deletion of accessible optional first-party cookies.

We use service providers only where needed to run ChartLooper. These may include Supabase for authentication and data services, Stripe for billing, cTrader/Spotware and supported broker-connection providers for user-requested synchronization, Umami Cloud in its EU account region for restricted analytics, Google for consented Ads measurement, PromoteKit for consented affiliate attribution, and hosting or email providers.

• Providers process information under their own terms and data-processing commitments.
• When you authorize cTrader, Spotware receives the authorization and API requests and returns the selected account information and trading history to ChartLooper. The authorization requests account access only; it does not request trading permission.
• Some providers may process information outside your country, including in the United States. Where required, transfers rely on recognized safeguards such as adequacy decisions or standard contractual clauses.
• We do not sell your personal information.

We retain information only for as long as necessary for the purpose for which it was collected, contractual and legal requirements, dispute resolution, and security.

• Restricted Umami analytics events are retained for no longer than 12 months; aggregate reporting may remain after event-level data expires.
• Cookie lifetimes are controlled by the relevant provider and may be renewed on later consented visits. You can withdraw consent or delete browser storage at any time.
• Account, subscription, invoice, and security records may be retained for the periods required by applicable tax, accounting, fraud-prevention, and legal obligations.
• Disconnecting the final cTrader account linked to an authorization deletes the stored encrypted authorization tokens. Pausing, disconnecting, or disabling synchronization does not delete trades already imported into your journal; they remain until you delete the relevant journal data or your account, subject to legal retention requirements.
• Synchronization run records used for reliability, support, and security are normally retained for 90 days.

Reasonable technical and organizational measures are applied to protect your information. However, no method of transmission over the Internet is 100% secure.

You have the right to:

• Access the personal information we hold about you.
• Request corrections or updates to your information.
• Request deletion of your personal information.
• Object to or request restriction of certain processing.
• Withdraw consent at any time without affecting processing that occurred before withdrawal.
• Request data portability where applicable and lodge a complaint with your competent supervisory authority.

To exercise these rights, please contact us at [email protected].

This Privacy Policy may be updated from time to time. Updates will be posted on this page with the “last updated” date revised accordingly.