Privacy policy

Last updated: 29 August 2026.

This policy explains what personal data ChartThread collects, why we collect it, who it is shared with, and the rights you have over it. It covers the website at chartthread.com, the mobile web app, and the product pages behind sign-in.

1. Who is responsible for your data

The data controller is S.R.L. CHARTTHREAD (IDNO 1026023050641), a company registered in the Republic of Moldova.

For any privacy question or to exercise the rights described in section 9, write to support@chartthread.com or use our contact form. We answer privacy requests within 30 days.

We serve users worldwide. Where you are located in the European Economic Area or the United Kingdom, we process your data in line with the GDPR, which applies to us because we offer our service to people in those territories. Where you are in Moldova, Law No. 133/2011 on the protection of personal data applies.

2. What we collect

Data you give us

• Account details — your email address and a password, which we store only as a cryptographic hash and can never read. If you sign in with Google we receive your email address and basic profile identifier from Google instead of a password.
• Email verification codes — a short-lived code tied to your email address during sign-up.
• Messages you send us — the email address, topic and content of contact-form messages and feature requests.
• Questionnaire and waitlist answers — where you have completed an onboarding questionnaire or joined a waitlist, the answers you gave.
• Payment details — when a paid plan is active, card data is entered directly with our payment processor and never reaches our servers. We store only a customer identifier and your subscription status.

Data created as you use the service

• Product activity — the symbols you favourite, chart preferences you save, and chart images you generate in the app.
• Technical logs — for each request we record the page address, the time, your IP address, your browser's user-agent string, the referring page, the response status and, if you are signed in, your account identifier. We use these for security, abuse prevention, debugging and aggregate usage statistics.
• Email delivery records — which service emails were sent to you and whether they were delivered, so we can support you and honour unsubscribe requests.

We do not ask for and do not want special category data (health, political opinions, biometrics and similar). Please do not include such data in messages you send us. ChartThread is not intended for children under 16, and we do not knowingly collect their data.

3. Cookies and similar technologies

We use two groups of cookies and comparable storage.

• Strictly necessary — these run without consent because the site cannot work without them: your sign-in session, the anti-forgery token that protects forms, and the record of the cookie choice you make below. We also use your browser's local storage to remember interface preferences such as your chosen exchange, sort order and chart interval.
• Analytics — only with your consent — Google Analytics and Microsoft Clarity. Microsoft Clarity records how pages are used, including mouse movement, clicks and scrolling, so we can see where the product is confusing. Neither tool is loaded, and neither sets any cookie, unless you accept analytics in the cookie banner.

You can change or withdraw your choice at any time from the “Cookie settings” link in the footer of any page. Withdrawing consent reloads the page so that the analytics scripts stop running.

Separately, we use Google reCAPTCHA on sign-up and the contact form to block automated abuse. This is a security measure we rely on legitimate interests for, and it involves Google receiving technical information about your device and interaction with those forms.

4. Why we use your data, and on what legal basis

• To provide the service you asked for — creating and running your account, authenticating you, delivering charts, levels and spreads, and handling subscriptions. Legal basis: performance of a contract with you.
• To answer you — replying to contact messages and support requests. Legal basis: performance of a contract, or our legitimate interest in supporting people who write to us.
• To keep the service secure and working — technical logs, abuse prevention, reCAPTCHA, debugging. Legal basis: our legitimate interest in protecting the service and its users.
• To understand and improve the product — aggregate statistics from our own server logs, and, where you consent, Google Analytics and Microsoft Clarity. Legal basis: consent for the analytics tools; legitimate interest for our own aggregate server-side statistics.
• To send service and product emails — account emails such as verification and password reset are necessary for the service. Product update emails are sent on the basis of consent or, where permitted, our legitimate interest, and every one of them carries an unsubscribe link.
• To meet legal obligations — keeping accounting and tax records for payments. Legal basis: compliance with a legal obligation.

We do not sell your personal data, and we do not use it for automated decisions that produce legal or similarly significant effects about you.

5. Who we share data with

We share personal data only with service providers that help us operate ChartThread, and only as far as they need it:

• Hetzner Online GmbH (Germany) — hosting of our servers and databases.
• Stripe — payment processing and subscription billing.
• Microsoft — email delivery through Office 365, and Microsoft Clarity analytics where you have consented.
• Google — sign-in with Google where you choose it, reCAPTCHA anti-abuse, Google Fonts, and Google Analytics where you have consented.
• Content delivery networks (unpkg, jsDelivr) — serving the charting library; they receive your IP address as part of loading the page.

We may also disclose data where we are legally required to, or to establish or defend legal claims. If the business is ever sold or reorganised, data may transfer to the acquirer under this policy.

6. International transfers

We are established in the Republic of Moldova and our servers are located in Germany. Some of the providers listed above process data in the European Economic Area, the United Kingdom or the United States. Where data is transferred out of the EEA or the UK, we rely on the transfer mechanisms those providers make available, such as the European Commission's standard contractual clauses, together with their own supplementary safeguards.

7. How long we keep it

• Account data — for as long as your account exists, and up to 12 months after you close it, so we can resolve disputes and prevent abuse.
• Technical logs — up to 12 months, then deleted automatically.
• Contact messages and feature requests — up to 24 months after the matter is resolved.
• Email verification codes — minutes; they expire and become unusable shortly after being issued.
• Payment and accounting records — for the period required by applicable tax and accounting law.

8. How we protect it

The whole site is served over encrypted HTTPS connections. Passwords are stored only as salted hashes. Access to production systems is restricted to the people who operate the service. Payment card details never touch our servers. No system can be guaranteed perfectly secure, but we take these measures seriously and review them as the product grows.

9. Your rights

Depending on where you live, you have some or all of the following rights over your personal data:

• Ask what we hold about you, and get a copy of it.
• Have inaccurate data corrected.
• Have your data deleted, including by closing your account.
• Ask us to restrict how we use it, or object to processing we base on legitimate interests.
• Receive the data you gave us in a portable, machine-readable format.
• Withdraw consent at any time, including analytics cookies, without affecting processing that happened before you withdrew it.
• Unsubscribe from product emails using the link in any of them.

To use any of these rights, write to support@chartthread.com. You may also complain to a data protection authority: in Moldova, the National Center for Personal Data Protection; in the EEA or the UK, the authority in the country where you live or work.

10. Changes to this policy

If we change how we handle personal data we will update this page and change the date at the top. When the change is significant — for example a new analytics tool — we will ask for your cookie choice again or tell you directly.