Privacy Policy

Indian Stock Tracker - Last updated: July 2026

Indian Stock Tracker ("we", "our", or "the app") is a market research platform for analyzing stocks listed on the National Stock Exchange (NSE) and Bombay Stock Exchange (BSE) of India. This Privacy Policy describes how we collect, use, store, and protect your information when you use our mobile application and web platform.

By using Indian Stock Tracker, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

a) Account Information

When you register or sign in, we collect:

• Email address
• Username
• Full name
• Password (stored in hashed form using bcrypt; we never store plain-text passwords)
• If you use Google Sign-In: your Google account ID and email (we do not access your Google contacts, calendar, or other Google data)

b) Financial and Portfolio Data

When you use portfolio features, we store:

• Portfolio names and descriptions
• Stock holdings: ticker symbol, quantity, buy price, buy date, sell price, sell date
• Transaction notes you add to holdings

c) Usage and Analytics Data

To improve the app experience and for security monitoring, we collect:

• Login timestamps, IP address, and user agent string
• Pages and screens visited within the app
• Session duration
• Platform information (web or mobile)

d) Device Information

If you enable push notifications, we collect:

• Firebase Cloud Messaging (FCM) device token
• Device name and platform (iOS or Android)
• Notification preferences (all news or portfolio-filtered)

e) AI Chat Data

When you use the AI Chat feature:

• Your chat messages and AI responses are stored temporarily
• Chat threads are automatically deleted after 24 hours
• Message and token usage counts are tracked for daily limit enforcement

f) Information We Do NOT Collect

• Precise location or GPS data
• Contacts or address book
• Photos, camera, or microphone access
• SMS or call logs
• Biometric data (biometric authentication is processed entirely on your device and never sent to our servers)

2. How We Use Your Information

We use the collected information for the following purposes:

• Authentication and Security: To verify your identity, protect your account, detect unauthorized access, and enforce rate limits
• Portfolio Tracking: To display your holdings, calculate profit and loss, and provide portfolio analysis
• Stock Analysis: To deliver personalized stock screeners, AI-powered analysis, and recommendations based on your queries
• Push Notifications: To send market news alerts matching your preferences or portfolio holdings
• Telegram Integration: To send scheduled stock reports to your configured Telegram channels
• Usage Analytics: To understand app usage patterns and improve features (admin and tenant-admin users can view aggregated analytics for their managed users)
• Daily Limits: To enforce chat message and token usage quotas as configured by your account template

3. Data Storage and Security

• All data is stored in databases managed by the server you connect to (self-hosted or provided by your organization)
• Passwords are hashed using bcrypt before storage
• Authentication uses JWT (JSON Web Tokens) with configurable expiration (default: 30 minutes)
• All API communication uses HTTPS in production deployments
• Security headers (X-Content-Type-Options, X-Frame-Options, Content-Security-Policy) are applied to all responses
• Brute-force protection locks accounts after 5 failed login attempts for 5 minutes
• API rate limiting is enforced per user role to prevent abuse
• Request size is limited to 1 MB to prevent denial-of-service attacks

4. Data Retention

• Account data: Retained as long as your account is active. You can request account deletion at any time through the Profile page. A 30-day grace period applies, during which you can cancel the request. After 30 days, your account and all associated data across all services are permanently purged.
• Portfolio data: Retained as long as your account is active. You can delete individual portfolios and stocks at any time.
• AI Chat threads: Automatically deleted after 24 hours. You can also manually delete threads at any time.
• Login history and page views: Subject to configurable data retention policies set by the server administrator.
• Push notification tokens: Automatically deactivated when the device token becomes invalid. Removed on logout.
• News seen records: Retained for 5 days to prevent duplicate notifications, then automatically cleaned up.

5. Third-Party Services

Indian Stock Tracker integrates with the following third-party services:

a) Yahoo Finance

We use Yahoo Finance (via the yfinance library) to fetch stock prices, market data, financial statements, and company information. Your search queries and viewed tickers may be sent to Yahoo Finance servers. Please refer to Yahoo's Privacy Policy for details.

b) Google Sign-In

If you choose to sign in with Google, authentication is handled via Google OAuth 2.0. We receive only your email address, name, and Google account ID. We do not access any other Google account data. See Google's Privacy Policy.

c) Firebase Cloud Messaging (FCM)

Push notifications are delivered via Google Firebase Cloud Messaging. Your FCM device token is sent to Google's servers for notification delivery. See Firebase Privacy Information.

d) AI Chat Providers

The AI Chat feature sends your messages to a configured AI provider (such as Google Gemini, OpenAI, Anthropic Claude, Groq, or DeepSeek) for generating stock analysis responses. Your chat messages and relevant stock context data are sent to the selected provider's API. Please review the privacy policy of the AI provider configured by your server administrator.

e) Telegram Bot API

If you use Telegram integration features, messages are sent via the Telegram Bot API to your specified channels. See Telegram's Privacy Policy.

f) Screener.in

Quarterly shareholding pattern data may be fetched from Screener.in for fundamental analysis. No user data is shared with Screener.in.

6. Data Sharing

We do not sell, rent, or trade your personal information to third parties. Your data may be shared only in these cases:

• Within your organization: If your account is managed by a tenant administrator, they can view your usage analytics and portfolio summaries as permitted by the role hierarchy.
• AI providers: Chat messages are sent to the configured AI provider for generating responses (see Section 5d).
• Legal requirements: If required by law, regulation, or legal process.

7. Your Rights

You have the following rights regarding your data:

• Access: View all your stored data through the app's profile, portfolio, and chat screens.
• Export: Export your portfolio data using the Data Export feature (available in the app).
• Correction: Update your profile information (name, email) through the Profile screen.
• Deletion: Delete individual portfolios, stocks, and chat threads at any time. You can request full account deletion from the Profile page. A 30-day grace period applies, during which you can cancel the request. After 30 days, all your data is permanently deleted across all services.
• Notification Control: Manage push notification preferences or unregister your device from notifications at any time.

8. Children's Privacy

Indian Stock Tracker is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. Stock market investing involves financial risk and is suitable only for adults. If we become aware that we have collected data from a person under 18, we will take steps to delete that information.

9. Self-Hosted Deployments

Indian Stock Tracker can be self-hosted on your own infrastructure. In self-hosted deployments:

• All data is stored on your own servers
• You control data retention, backups, and access
• The mobile app connects to the server URL you configure
• Third-party API calls (Yahoo Finance, AI providers, FCM) are made directly from your server

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the app after changes constitutes acceptance of the updated policy.

11. Contact

If you have questions or concerns about this Privacy Policy or your data, please contact us at: