Last updated 18 September 2026
This policy explains what personal data rootcharts (“we”, “us”) collects when you use rootcharts.com and the rootcharts web application (together, the “Service”), why we collect it, and the choices you have. We keep it deliberately short and concrete; if anything is unclear, write to support@rootcharts.com.
rootcharts is operated by Kevin Krall. You can reach us at support@rootcharts.com. We are the controller of the personal data described in this policy.
To create your account we need to identify you. Depending on how you sign up we receive:
openid, email and profile scopes. We never see your Google password and we do not access your Gmail, Drive, contacts or any other Google data.Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google account data solely to authenticate you and display your name in the app. It is never sold, used for advertising, or shared with third parties beyond the processors listed below.
Subscriptions are processed by Stripe. Your card details are entered on Stripe’s checkout page and go directly to Stripe; they never touch our servers. We store your Stripe customer ID, subscription status, plan, trial and renewal dates, and — to enforce our one-free-trial-per-person rule — a non-reversible card fingerprint provided by Stripe. Stripe’s handling of your data is described in the Stripe Privacy Policy.
Your chart layouts, drawings, indicator settings, colour preferences and watchlists are saved to your account so they follow you between devices. This data is stored in Google Cloud Firestore and is only used to restore your workspace.
If you connect a Tradovate account, you authorise rootcharts on Tradovate’s own website (OAuth). We never see your Tradovate password. We store the resulting access and refresh tokens encrypted on our servers so that orders you place on the chart can be routed to your account, and we process account, position and order information in real time to display it to you. Disconnecting the account in the app deletes the stored tokens. Tradovate’s handling of your data is governed by its own policies.
Like any web service we receive your IP address, browser type and the pages you visit. We use Vercel Analytics, a privacy-friendly, cookie-less analytics service that aggregates page views and does not build individual profiles. Our hosting and API providers keep standard server logs for security and debugging, retained for a limited time.
If you email us we keep the correspondence to answer your request and to improve the Service.
Where the GDPR applies, we process account, workspace and billing data to perform our contract with you (Art. 6(1)(b)); usage and security data on the basis of our legitimate interest in running a secure, reliable Service (Art. 6(1)(f)); and billing records to meet our legal obligations (Art. 6(1)(c)). Where we rely on consent, you can withdraw it at any time.
We share data only with the service providers needed to run rootcharts, each bound by contract to process it on our instructions:
Some of these providers are located outside the EU/EEA. Where that is the case, transfers are covered by the EU Standard Contractual Clauses or an equivalent safeguard.
Account and workspace data is kept for as long as your account exists. Billing records are kept as long as required by tax and accounting law (typically up to ten years). Broker tokens are deleted when you disconnect the account or delete your rootcharts account. Server logs are kept for a short, fixed period. Data is deleted or anonymised once it is no longer needed.
You can access, correct, export or delete your personal data, restrict or object to processing, and lodge a complaint with your local data-protection authority. To delete your account and all associated data, or to exercise any other right, email support@rootcharts.com from the address on your account; we respond within 30 days. You can revoke rootcharts’ access to your Google account at any time at myaccount.google.com/permissions.
We use no advertising or tracking cookies. Firebase Authentication uses browser storage to keep you signed in, and the app stores interface preferences locally so the chart looks the same when you come back. Clearing your browser data signs you out and resets those preferences.
All traffic is encrypted with TLS. Passwords are never stored in plain text, broker tokens are encrypted at rest, and access to production systems is restricted to the people who need it. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you as required by law.
The Service is intended for adults. We do not knowingly collect data from anyone under 18; if you believe a minor has created an account, contact us and we will delete it.
We may update this policy as the Service evolves. The date at the top shows the latest revision; for material changes we will notify you by email or in the app before they take effect.
Questions about this policy or your data: support@rootcharts.com.