Privacy Policy

Summary

We collect the minimum needed to run accounts and keep the service safe. We do not sell your data, we do not show ads, and we do not use third-party advertising or tracking scripts.

What we collect

Account: your email address, a username derived from it, and your password stored only as a salted one-way hash (we never see or store the password itself).

Sign-up safety: the IP address and a random device identifier from the browser you sign up on, used only to enforce the one-account-per-device and per-network limits and to stop abuse.

Sign-in: a session cookie (pt_session) that keeps you signed in for up to 30 days; we store only a hash of it. One-time email codes are stored hashed and expire after 10 minutes.

Practice data: your virtual balance, orders, positions and trades, stored so your account works across devices.

Usage: first-party page-view counts (page path, referring site, a random visitor id in the cs_vid cookie and a short-lived tab session id) and sign-in / sign-up events. Our usage analytics do not record your IP address.

In your browser only: settings such as watchlists, chart drawings and layout preferences are kept in your browser's local storage and are not sent to us.

Why we use it

To create and secure your account, send sign-up and password-reset codes, run the simulator, prevent fraud and abuse (including duplicate accounts and automated traffic), understand which pages are used so we can improve them, and meet legal obligations.

Our basis is your consent when you create an account, and legitimate uses permitted by the Digital Personal Data Protection Act, 2023, such as keeping the service secure.

Who processes it

Brevo sends our transactional emails (your email address and the code). Cloudflare carries traffic to the site and protects it from attacks. Our servers are hosted on Amazon Web Services in India. These providers process data on our behalf and only for these purposes.

Our market data provider receives requests for market data only. No personal data about you is sent to it.

We do not sell, rent or share your personal data for marketing. We may disclose it if required by law or a lawful request from authorities.

How long we keep it

Account and practice data: until you ask us to delete your account. Sessions: up to 30 days. Email codes: 10 minutes. Usage analytics: up to 400 days. Sign-up IP and device identifier: for as long as the account exists, to enforce sign-up limits.

Your rights

Under the DPDP Act, 2023 you may ask for a summary of the personal data we hold about you, ask us to correct or erase it, withdraw consent (which closes your account), nominate someone to exercise your rights, and raise a grievance.

Email support@sharesetu.app from the address on your account. We will respond within a reasonable time and in any case within the period the law requires.

Cookies

We use two first-party cookies: pt_session (keeps you signed in; essential) and cs_vid (a random visitor id used for our own usage counts and sign-up limits). We do not use advertising or cross-site tracking cookies.

Security

Traffic is encrypted with HTTPS, passwords are hashed with PBKDF2, session tokens are stored only as hashes, databases are access-restricted, and sign-in and code requests are rate-limited. No system is perfectly secure; if we become aware of a breach affecting you, we will notify you and the authorities as the law requires.

Children

ShareSetu is not meant for anyone under 18, and we do not knowingly collect data from children.

Changes and contact

We will update this page when our practices change and change the date at the top. For any privacy question or grievance, write to support@sharesetu.app.