Privacy Policy

Welcome to Pipstone. We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our website, our web app, the Pipstone Terminal desktop app and our related services.

1. Information We Collect

1.1 Information You Provide

• Account registration information (name, email, username)
• Profile information (trading preferences, experience level)
• Financial information (wallet addresses, transaction history)
• Communication data (support tickets, emails)

1.2 Information Collected Automatically

• Device information (IP address, browser type or app version, operating system)
• Usage data (pages visited, features used and, in the desktop app, the events described in section 7)
• Cookies and similar tracking technologies
• Log data and error reports (access times, error logs, and the app error and crash reports described in section 7)

1.3 OAuth Information

• Google account information (email, profile name, profile picture)
• OAuth tokens for authentication
• No passwords are stored when using OAuth

2. How We Use Your Information

• Provide and maintain our trading platform services
• Process transactions and manage your wallet
• Send important updates about your account
• Improve our services and develop new features
• Comply with legal obligations and prevent fraud
• Provide customer support and respond to inquiries
• Calculate and distribute referral commissions (MLM program)

3. Data Sharing and Disclosure

We do not sell your personal information. We may share your data with:

• Service Providers: third-party services that process data on our behalf to run Pipstone: Supabase (sign-in and our database, including in-app feedback), Vercel (website hosting), PostHog (product analytics and app error reports, United States), Telegram (internal notifications to our team about new feedback) and Meta (advertising measurement on our web app, see section 6)
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger or acquisition
• Consent: With your explicit consent

4. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Regular security audits and updates
• Access controls and authentication mechanisms
• Secure OAuth 2.0 implementation for social logins

5. Your Rights and Choices

You have the right to:

• Access and receive a copy of your personal data
• Correct inaccurate or incomplete information
• Request deletion of your personal data
• Object to or restrict processing of your data
• Withdraw consent at any time
• Export your data in a portable format
• Turn off usage data and error reports in the desktop app at any time (Tools → Send usage data)

6. Cookies and Tracking

On our website and web app we use cookies and similar technologies, such as your browser's local storage:

• Essential: to keep you signed in. These cannot be turned off.
• Analytics (PostHog): to count visits and see how pages and features are used, so we can improve them. In the web app this includes recording clicks and session replays of how pages are used, with everything you type hidden.
• Advertising measurement (Meta Pixel): in the web app, to measure whether our Facebook and Instagram ads work.

You can block or delete cookies in your browser settings. Blocking analytics or advertising cookies does not stop you using Pipstone. The Pipstone Terminal desktop app does not use browser cookies. It stores a random install ID on your PC instead; see section 7, including how to turn usage data off.

7. Pipstone Terminal (Desktop App)

This section covers Pipstone Terminal, our desktop app for Windows. It explains what the app sends us about how it is used and when something goes wrong, and what happens to feedback you send from inside the app. The rest of this policy also applies to the app.

The app also connects to Pipstone's own servers to sign you in, load prices, run your account and check for updates. That is part of providing the service and is covered by the rest of this policy.

7.1 Usage data

While "Send usage data" is on, the app sends short usage events to PostHog, an analytics service hosted in the United States. These events tell us, for example:

• That the app was opened, and roughly how long it is actively used. While the app window is open and in focus, it sends a short "active" signal every 5 minutes, with whether you are signed in and how many charts are open
• How long the first chart took to load, and whether you pressed the Arena button on the welcome card
• That you started or completed sign-in, and which feature asked you to sign in
• Which features you use: opening a chart (the symbol and timeframe), adding an indicator (its name), placing or closing an order (only the side, the order type and how it was closed), creating an alert (its type and how it notifies you), adding or running a script (where the script came from, or the step at which it failed), running the tester or the challenge check, using Pip, and installing an update (the old and new version numbers)

Every event also includes the app version, your operating system and the app's environment (for example, the beta).

What usage events never include: your email address, your password or sign-in tokens, prices, trade sizes, account balances, profit or loss, your scripts' code, or the content of anything you type. Before an event leaves your PC, the app also removes any value that looks like an email address or a sign-in (access) token, and any long text value.

How events are linked to you: the first time the app runs, it creates a random install ID and stores it on your PC. Events are linked to that ID. Once you sign in, events from that install, including earlier ones, are linked to your Pipstone account ID. That is a random code, not your name or email address.

7.2 Error and crash reports

While "Send usage data" is on, the app also sends a report to PostHog when part of it fails. A report contains:

• The error message and a shortened technical trace showing which part of the app's own code was running
• The app version and your operating system
• Which part of the app failed (for example, the chart area or the toolbox), and whether the app could keep running

If a request to one of Pipstone's own services fails, the report names the service and the type of request, with the error code and how long it took. It never includes the full web address, your sign-in token or the content of the request.

If part of the app's core fails unexpectedly, it saves a small crash file in its data folder on your PC (at most 10 are kept). The file holds the time, the app version, your operating system, the error message and where in the app's code it happened. The next time you open the app, the file is deleted and, if Send usage data is on, its contents are sent to PostHog.

7.3 Turning it off

Usage data and error reports are on by default. You can turn them off at any time in Tools → Send usage data, or on the app's welcome card. Turning it off:

• Immediately stops usage events and error and crash reports from being sent
• Discards any events that were waiting to be sent
• Stays off until you turn it back on, including after the app restarts

Turning it off does not stop the connections the app needs to work (sign-in, prices, your account, update checks). It also does not affect feedback, which is only ever sent when you press Send (see 7.4). To have usage data or error reports already linked to your account deleted, email [email protected].

7.4 Feedback you send from the app

You can send us feedback from Help → Send feedback…, from the Feedback button in the status bar, or with Ctrl+Shift+F. If the app shows a problem screen, Send report opens this window with a short description of the error already filled in. You must be signed in, and nothing is sent until you press Send.

When you send feedback, we store:

• Your Pipstone account ID, the date and time, the type you chose (Bug, Idea or Confusing), the text you wrote (up to 2,000 characters), the app version and your operating system
• If you leave "Include app details" ticked: the chart symbol and timeframe you had open, which panels were open, and the app's last 20 diagnostic entries. These are the same kind of error and connection records described in 7.2. The box is ticked by default, and you can open "What's included" in the feedback window to see exactly what will be sent before you press Send. Untick it to send only your text, the app version and your operating system.

Feedback never includes a screenshot. Please don't put passwords or other sensitive information in your message.

Your feedback is stored in our database, run by our service provider Supabase. When new feedback arrives, our team gets a short notification in a private Telegram chat. The notification shows the feedback type, your Pipstone username, the app version and the first 300 characters of your message. Only Pipstone staff can read your feedback. You can ask us for a copy of feedback you have sent. It cannot be changed after sending.

We keep feedback for 24 months and then delete it. We delete it sooner if you ask us to or close your account.

7.5 Why we use this information

• Usage data and error reports: we have a legitimate interest in keeping the app working, finding and fixing faults, and understanding which features are used so we can improve them. You can object at any time by turning off Send usage data.
• Feedback: you choose to send it, and we use it to reply to you, fix problems and improve the app.

We do not sell this information. We do not use it for advertising, and we do not use it to make decisions about you.

7.6 Who receives it, where, and for how long

• Usage events, error and crash reports: PostHog, in the United States, kept for 12 months and then deleted
• Feedback: Supabase (our database), in Singapore, kept for 24 months
• New-feedback notification: Telegram, in our private team chat

When the app sends data to PostHog, PostHog receives your IP address, as any internet service does. PostHog uses it only to estimate your approximate location (country and city) and does not store it.

These providers process the data on our behalf and under our instructions. Because PostHog is in the United States, using the app means your usage data and error reports are transferred there. See section 9 (International Data Transfers).

7.7 Older versions

This section describes version 0.1.3 and later. Versions 0.1.2 and earlier send only five usage events (app opened, first chart loaded, sign-in started, sign-in completed and the Arena button clicked), on the same terms and with the same Tools → Send usage data switch. They send no error reports and have no feedback window.

8. Data Retention

We retain your personal data only as long as necessary to provide our services and comply with legal obligations. Account data is retained for the duration of your account and may be retained for up to 7 years after account closure for legal and regulatory purposes. Usage events and app error reports are kept for 12 months. In-app feedback is kept for 24 months, or less if you ask us to delete it or close your account. See section 7.

9. International Data Transfers

Some of our providers are outside your country. PostHog (analytics and app error reports) is in the United States, and Supabase stores our database in Singapore. When we transfer personal data abroad, we stay responsible for it and use contracts that require the provider to protect it.

10. Children's Privacy

Our services are not intended for users under 18 years of age. We do not knowingly collect personal information from children under 18.

11. Updates to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Effective Date" above.

12. Contact Us

If you have questions or concerns about this privacy policy, please contact us at:

• Email: [email protected]
• Support: [email protected]
• Website: https://pipstone.ai

Please read this policy carefully. If you have questions, contact us using the details above.