Privacy

In short

OIDash is free in beta with an account. This notice says what we keep about you, why, who sees it, how long we keep it and how to have it erased. We do not sell your data, show advertising or send marketing email.

Your account

Your email address and, if you give one, your name. If you sign in with Google, Google gives us your name, email address and an account ID, and nothing else: no contacts, files or other Google data.

Your password, if you set one, is stored only as a one-way hash; nobody at OIDash can read it.

The account's status (waiting for approval, active, disabled), when it was created, confirmed and approved, when you last signed in, and the date your access ends.

The version of the terms you accepted, with the time and a salted one-way hash of your IP address.

The browsers you are signed in on: when each signed in and was last used (no address or browser details), to apply the limit on devices signed in at once.

How much you use the site, per day: active minutes, and the number of data requests and past sessions you open (to apply fair-use limits per account). Counts only, no pages or dates; kept 90 days.

If you use Practice: the paper orders you place on past sessions and their results, shown only to you.

If you use the Journal: the trades you enter (instrument, side, quantity, prices, times and charges), your tags and notes, the days you close out, and the market readings OIDash recorded at each entry minute. Shown only to you, never used for anything else, and deleted with your account. We never ask for broker logins, client codes or account numbers.

Sign-in and security records

Each sign-in, failed sign-in, password change and admin action on your account, with a salted one-way hash of your IP address and your browser's description of itself (user agent). They protect accounts against misuse and show who changed what.

Why we use it

To create your account, decide on and give access, keep accounts secure, and email you about your account: confirming your address, resetting a password, approval, extension, or the account being disabled. Nothing else.

Who sees it

The site's admins (at most five people) see your name, email address, account status and dates on the admin page, and are alerted when you ask for access.

Our server runs on Google Cloud in India (Mumbai). Emails to you are sent through our email provider. If you sign in with Google, Google handles that sign-in under its own privacy policy.

We do not give your data to anyone else unless the law requires it.

How the site is used

Our web server records each request briefly (address path, data sent, time, IP address and browser details). These raw records are summarised and deleted, normally within an hour and never later than 24 hours.

The summaries keep a visitor key (a one-way, keyed hash of the IP address and browser details that changes every month and cannot be turned back into either), a rough device type, the pages opened and the data sent. Per-visitor summaries are kept for 90 days; totals per page and per day, with no visitor key, are kept indefinitely.

This is done on our own server to see which features are used and to control hosting costs. No analytics or advertising company receives it, and no cookies are used for it. It is not linked to your account.

Security logs

Standard server logs, including your IP address, are used for security, rate limiting and abuse prevention, and are kept only as long as needed for that.

The daily notice

When you accept the notice, we store the notice version, the time and a salted one-way hash of your IP address and browser details. The raw IP address is not stored in that record. These records are kept as evidence that the notice was shown.

Requests you send

If you use Send a request, we keep your message, its type, the page it came from and, only if you give it, your email address, so the admins can read and answer it; a copy is emailed to them. If you are signed in, it is linked to your account so the answer can reach you on your dashboard. No IP address is stored with it. Requests are kept until they are dealt with and for up to 12 months after.

On your device

A sign-in cookie keeps you signed in for up to 30 days. Settings such as theme, font size and the notice acknowledgement are kept in your browser's local storage. You can clear them in your browser at any time.

Closing your account

You can close your account from your Account page. It is closed and signed out at once.

After 30 days we erase your email address, name, password, Google link, saved settings, practice record, journal and active-time record. The sign-in, security and acceptance records stay, without your email address or name, as a record of what happened on the account.

Your rights

You can ask what we hold about you, ask us to correct it, or ask us to erase it, under India's Digital Personal Data Protection Act, 2023. Use Send a request or the contact address below. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Changes

If paid plans are introduced, or we start keeping something new, this notice will be updated before that happens.

Third parties

Links lead to outside sites with their own policies.

Contact

• Questions: support@oidash.in
• Grievances: support@oidash.in