Privacy Policy

Short version: we collect only what we need to run your account. We don't sell your data, we don't show ads, and we don't use tracking or analytics cookies.

1. What we collect

If you visit without an account: nothing that identifies you beyond the standard technical information our hosting providers log (IP address, browser type, pages requested), kept for security and troubleshooting.

When you create an account:

When you use the Service:

For security: when you sign in, we record the IP address and browser user-agent against your session, and the time of your last sign-in. We also count failed sign-in attempts and temporarily lock an account after too many. This helps us detect account takeover and abuse.

We take no payments today, so we hold no payment or card data. If we introduce paid plans, this policy will be updated first.

2. Cookies and browser storage

• One essential cookie keeps you signed in. It is first-party, cannot be read by scripts on the page, and is used for nothing else.
• Local storage in your browser remembers your theme (light/dark) and how you last arranged the stock table. It never leaves your device.

We use no advertising, analytics or cross-site tracking cookies. Because we use only strictly necessary storage, we don't show a cookie-consent banner. If we ever add analytics, this section — and our consent approach — will change first.

3. How and why we use your data

We don't make automated decisions about you that have legal or similarly significant effects.

4. Who we share it with

We share personal data only with service providers that process it on our behalf, under contract, for the purposes above:

We may also disclose data if the law requires it, to protect our rights or users' safety, or as part of a sale or reorganisation of the business (in which case this policy continues to apply to your data).

We do not sell or rent your personal data, or share it for cross-context behavioural advertising.

5. International transfers

Some of our providers process data outside your country, including in the United States. Where they do, we rely on appropriate safeguards such as the EU–US Data Privacy Framework (and its UK extension) or Standard Contractual Clauses.

6. How long we keep it

7. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy;
• correct inaccurate data;
• delete your data — you can delete your account yourself from Account;
• export your data in a portable format;
• object to or restrict certain processing;
• withdraw consent where we rely on it (for example, product emails);
• complain to your data-protection authority — in Canada the Office of the Privacy Commissioner, in the UK the ICO, and in the EU your local supervisory authority.

California residents have the right to know what personal information we collect and how we use it, to delete and correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under California law.

To exercise any right, email support@canopti.com from your account's email address. We respond within one month (45 days for California requests), and may need to verify your identity first.

8. Security

Passwords are hashed, connections are encrypted with TLS, sessions use short-lived tokens, repeated failed sign-ins lock the account temporarily, and access to production systems is restricted. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.

9. Children

The Service is not for anyone under 18, and we don't knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

10. Changes

We will post any update here with a new effective date, and email you before material changes take effect. See also our Terms of Service.

11. Contact

CanOpti Inc. · support@canopti.com