Your data, kept purposeful.

Market Watch uses account email, subscription records, your chosen settings and integration credentials to provide your workspace. Credentials are encrypted at rest in the application vault. Payments are processed by whichever payment processor is active at checkout: Stripe, Paystack, Flutterwave, Fincra or Korapay. The processor receives your email, the plan and amount, and your payment details on its own hosted page. Our application never receives or stores card numbers.

Sign-in security records

When you sign in, we record the IP address, the browser user agent, an approximate country and city, and a device identifier. The country and city come from our hosting provider's request headers; we do not use a separate location service. The device identifier is a hash of browser characteristics, stored in the watch_dev cookie and hashed again on the server, so raw device details are not stored. If that cookie is missing, for example because it was blocked or cleared, a server-side hash of the browser user agent is used instead. One record is kept per user, device and IP, with a sign-in count and the time last seen.

Purpose: account security, which means spotting unfamiliar sign-ins and investigating misuse. Retention: 90 days, and at most 50 records per account. A daily scheduled job deletes older records. Access: only the service operator, through the owner console. When a sign-in comes from a new device or network, we email you its time, approximate location, IP address and browser. That email is sent through the email provider configured by the operator, so the provider processes its contents.

Abuse protection

To slow down password guessing, the backend keeps short-lived sign-in and sign-up counters. They are keyed by one-way hashes of your email and IP address, not the plain values, and the same daily job deletes them about a day after the last attempt, once any lockout has ended. To check whether a new password has appeared in a known data breach, only the first 5 characters of the password's SHA-1 hash are sent to the Have I Been Pwned service. The password itself is never sent.

Application logging

Security event log: to detect and respond to account attacks (for example repeated failed sign-ins, misuse of recovery codes or EA bridge keys, and prompt-injection attempts), the backend records security events with the event type, time, approximate country, your account id, and keyed one-way hashes (HMAC) of your email and IP address, never the plain values. Alerts raised from these events and the owner's response actions (such as signing out sessions or locking an account) are recorded too. Purpose: account security and abuse prevention. Retention: 90 days, deleted by a daily scheduled job. Access: only the service operator, through the owner console. If the operator turns on security notifications, alert summaries (without your email or IP) may be sent to the operator by email, SMS or Discord.

Backend log output redacts IP address literals and never contains API keys or passwords. Hosting, authentication, payment, email, broker and AI providers operate their own infrastructure and may process connection metadata, including IP addresses, under their own policies.

Security monitoring and device fingerprinting

To detect and stop attacks on the service and on accounts (password guessing, injection attempts, scanners and account sharing used for abuse), the backend records suspicious and blocked requests and failed sign-ins in full: the IP address, the account email, what was requested (method, full address, HTTP status and whether it was blocked, served or caused a server error), the browser user agent, referrer and content type, and the request body as sent, capped at 8 KB. Passwords, access tokens, one-time and recovery codes, API keys, cookies and webhook addresses are replaced with a fixed placeholder ("redacted") before anything is stored; neither the secret nor its length is kept or shown. The stored body is encrypted by the application (AES-GCM with a server-held key) when that key is configured. Only the operator (owner account, signed in with two-factor authentication) can read these records. They are deleted after 90 days by a daily scheduled job.

When switched on by the operator, the website also computes a security device fingerprint in your browser: one-way SHA-256 hashes of how your browser draws text and graphics (canvas, WebGL), processes audio, and of your screen size, time zone, languages, platform, installed fonts, CPU cores and memory, together with the graphics-card name your browser reports. Only these hashes and that display information leave your browser, in the first-party watch_fp cookie and with sign-in, sign-up, password-reset and dashboard requests. We use it only to recognise a device across sign-in attempts and to see which accounts were used from the same device (for example many accounts created from one device to abuse the service). It is never used for advertising, analytics or tracking across other websites, and it is not combined with data from other companies. A fingerprint can be blocked or faked, so it is treated as a hint, never as proof. Device records are deleted 90 days after the device was last seen.

The approximate city and network operator of an IP address come from an offline database kept on our own server; the IP address is not sent to any location service. IP geolocation by DB-IP (https://db-ip.com), CC BY 4.0.

Operator security alerts are sent to the operator's private Discord channel. They contain the full IP address, the full requested address and the request as sent (with the secrets above masked), the device fingerprint id, and account emails shown partly masked (for example t***@example.com).

Copilot answers about your past trades

When you ask Copilot about your own past trades (for example "why did my last trade lose?"), we send details of your closed trades to the AI provider that answers the question, so that it can explain them. We send up to 20 of your most recent trades closed in the last 90 days, or only the trade you name if it is one of them. For each trade we send the symbol, the direction (buy or sell), the entry and exit prices, the stop-loss and take-profit levels, the profit or loss, the open and close times, the trade reference (MT5 ticket number or paper-trade id), and any strategy label or paper-trade note recorded with it. Labels and notes are shortened and cleaned before they are sent.

Your open positions and pending orders are never sent. Your balance, equity, broker login, broker credentials, email address and name are not sent. Ordinary Copilot questions that are not about your past trades do not include your trade history.

Watch-provided AI currently uses xAI (Grok) and Cloudflare Workers AI. If you have added your own AI key, your question and these trade details go to that provider (OpenAI, Anthropic, Google Gemini or Cloudflare) under your own account with them. Each provider processes this data under its own terms and privacy policy. Purpose: to answer the question you asked. We will update this notice if the providers we use change.

Provider connections

Dashboard scripts and fonts load from our application. No advertising trackers are included. AI prompts, market queries and notifications are sent to providers you configure or use; this requires transmitting relevant market and trade context to them.

Sessions and storage

Authentication uses server-managed cookies, and the watch_dev device cookie supports the sign-in security records above. Local browser storage may hold display preferences, the setup-guide dismissal and your saved alerts. Local browser preferences are separate from your subscription account and should be cleared on shared devices.

Retention and deletion

Billing records may need to be retained by payment providers for their legal obligations. Sign-in security records are kept for 90 days, as described above. Workspace records are account-scoped. Contact support to request account export or deletion. Cancel your subscription through the billing portal before requesting deletion.

Why we process data

We use account, workspace and subscription data to provide the service you request, protect accounts and meet applicable legal obligations. We do not sell account data or use it for advertising. The operator must confirm the applicable legal bases, retention periods, processor agreements and international-transfer safeguards before accepting customers.

Your rights

Contact the operator to request access, correction, export or deletion, or to raise an objection or restriction request where applicable. You may complain to the competent data protection authority. The response depends on the request and applicable legal obligations. We do not ask for passwords or provider secrets to handle these requests.

Read the cookies and browser storage notice for session and local-preference storage.

Contact

Support contact must be configured before launch.