Privacy Policy

When you create an account, subscribe to a plan, post a comment, or otherwise use the Service, we collect:

• Account information: email address, display name, and a password hash (we never store plaintext passwords). If you sign in through an OAuth provider, we also receive the profile fields that provider returns — typically name, email, and avatar URL.
• Billing information: your Stripe customer ID, subscription tier, and billing period dates. Actual card numbers and bank details are handled entirely by Stripe — they never touch our servers.
• Content you post: comments you leave on blog posts, along with the author name and email attached to your account at the time of posting.
• Usage data: backtest queries you run and the resulting reports, so you can re-open them later. Also basic request logs (IP, user agent, endpoint, timestamp) retained for a short window to debug errors and detect abuse.
• Communications: any message you send through the Contact form or by email.

We use your information to:

• Run the Service — authenticate you, serve backtest and content endpoints, remember your subscription tier, show your history.
• Process payments and manage your subscription via Stripe.
• Send transactional emails: signup verification, password reset, billing receipts, 2-factor codes, subscription status changes, and comment moderation notices.
• Send optional product updates and educational content — only if you opt in, with a one-click unsubscribe link in every email.
• Moderate community comments and prevent abuse.
• Debug errors and improve the platform.

We do not use your data to build ad profiles. We do not run advertising on the Service.

We do not sell your personal information. We share data only with processors and providers strictly required to run the Service:

• Stripe — payment processing and subscription billing. Governed by Stripe's privacy policy.
• Microsoft Azure — primary cloud hosting for the backend, database, and secret store.
• MongoDB Atlas — managed database for account and content storage.
• Cloudflare — static site hosting for the frontend (Cloudflare Pages) and object storage for uploaded media (Cloudflare R2).
• SendGrid — outbound transactional email delivery.
• Google / Microsoft / LinkedIn / Apple — when you choose to sign in via an OAuth provider, basic profile data flows from them to us during the login step.
• Legal requirements — if required by law, regulation, or valid legal process, we may disclose information to comply.

We apply standard security practices:

• TLS 1.2+ on all traffic between your browser and our backend.
• Passwords stored as PBKDF2 hashes (never plaintext).
• Authentication tokens are short-lived JWTs signed with a private key held in Azure Key Vault.
• Third-party secrets (Stripe, SendGrid, R2) live in Azure Key Vault and are never committed to source control.
• Database and object storage are encrypted at rest by the underlying providers.

No online service can be guaranteed 100% secure. If you believe your account has been compromised, please contact us immediately.

We use the browser's localStorage to remember your JWT authentication token so you stay signed in between visits. We do not set third-party tracking cookies or advertising cookies. We do not currently run an analytics tool like Google Analytics; if we add one in the future, this section will be updated and the tool will be a privacy-respecting option.

You have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data — most profile fields are directly editable in your account settings.
• Delete your account and personal data. Contact us and we will remove your account within 30 days. Content you published (e.g. comments on public blog posts) will be anonymized or removed.
• Export your backtest history and reports on request.
• Withdraw consent at any time by unsubscribing from marketing emails or deleting your account.

To exercise any of these rights, use the Contact page. We respond within 30 days.

We retain account data for as long as your account is active. After you delete your account, personal data is removed within 30 days, with the following exceptions:

• Billing and invoice records are retained for as long as required by tax and accounting law.
• Anonymized, aggregated usage data (with no link to your identity) may be retained indefinitely for platform analytics.

SellCallPut is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has signed up, please contact us and we will delete the account.

SellCallPut is operated from Canada and the Service is hosted on infrastructure provided by global cloud providers. By using the Service you consent to your data being processed in the countries where these providers operate. If you are located in a jurisdiction with specific data-protection rules (GDPR, CCPA, etc.), the rights listed in Section 6 apply to you — contact us to exercise them.

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last updated" date at the top of this page and, where appropriate, communicated via email. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Privacy questions or data requests? Reach us via the Contact page.