Privacy Policy
Last updated 8 August 2026.
This is a list of what we actually store, not a list of what we might one day like to. There is no analytics, no advertising, no tracking pixel and no third party watching you read this page.
Who is responsible
Brainware Analytics GmbH, Rathausstrasse 14, 6340 Baar, Switzerland, CHE-114.517.014, is the controller of your personal data. Contact: support@turnmarks.com.
We are in Switzerland, so the Swiss Federal Act on Data Protection (FADP) applies. If you are in the EU or EEA, the GDPR applies as well, and this policy is written to satisfy both.
What we store, and why
| Data | Why | Basis |
|---|---|---|
| Email address | It is your login. Also used for verification, password reset and service notices. | Contract |
| Password, stored only as a bcrypt hash | To check your login. We cannot read your password and cannot tell it to you if you forget it. | Contract |
| Account creation time, email-verified flag, one-time verification and password-reset tokens | To run verification and reset, both of which expire. | Contract |
| Subscription status and expiry, Whop membership id and licence key | To know whether your plan is free or paid. | Contract |
| If you connect Telegram: your Telegram chat id, your Telegram username, when you linked it, and which symbols you ticked | To send the alerts you asked for, to the right chat, for the right instruments. | Consent |
| A record of which alert was sent to you, kept 30 days | So the same marker is not sent to you twice. | Contract |
| The IP address you registered from, kept 48 hours | To count registrations per address and stop bulk sign-ups. | Legitimate interest |
| Your IP address while you make requests | Rate limiting, which happens in memory and is not stored. | Legitimate interest |
| A web server log line: your IP address, the time, what was requested and your browser's user-agent string | The ordinary record any web server keeps, used to diagnose faults and notice abuse. Kept about two weeks, then rotated away. | Legitimate interest |
That is the whole list. We do not ask for your name, your address, your phone number or your date of birth, and we do not build a profile of you. We never see your card details — those go to the payment provider below and never touch our servers.
What is stored in your browser
We use no cookies. The application keeps three things in your browser's
localStorage: your sign-in token, and the instrument and timeframe
you last looked at, so the chart opens where you left it. Signing out or
clearing your browser data removes them.
The application loads Cloudflare Turnstile, a bot check used on the sign-in and registration forms. It is the only third-party code that runs in your browser here. On a wide screen the front page also embeds the live chart, which is the application, so Cloudflare sees the request from that page too.
Who else processes your data
We use a small number of service providers. Each gets only what it needs to do its job, and none of them is allowed to use your data for their own purposes.
- Whop Inc. (United States) — payments, as merchant of record. They take your payment details directly; we receive only your membership status. Their own privacy policy governs what they hold.
- Contabo GmbH — hosting. Our server, and therefore the database, is located in France.
- Mailgun / Sinch (EU region) — sending verification, password-reset and notice emails. They see your email address and the contents of those messages.
- Telegram — delivering alerts, if and only if you connect it.
- Cloudflare, Inc. (United States) — the Turnstile bot check on the sign-in and registration forms.
Whop and Cloudflare are in the United States, so using them involves a transfer of data outside Switzerland and the EEA. Those transfers rest on the safeguards in each provider's own data-processing terms, including the EU standard contractual clauses where they apply.
We do not sell your data, and we never will. We would disclose it to an authority only where Swiss law obliges us to.
How long we keep it
- Account data — for as long as your account exists.
- Telegram link and symbol choices — until you disconnect or delete the account.
- Alert delivery records — 30 days, then deleted automatically.
- Registration IP addresses — 48 hours, then deleted automatically.
Deleting your account removes your email, password hash, subscription record, Telegram link and symbol choices immediately and permanently.
One deliberate exception: the 48-hour registration-IP counter survives an account deletion, because otherwise deleting an account would hand a bot a fresh allowance. Those rows contain an IP address and a timestamp, nothing else, and they expire on their own within two days.
Your rights
You can ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything wrong;
- delete it — though the account page does this yourself, immediately;
- restrict or object to a particular use;
- hand it over in a portable form;
- withdraw your consent to Telegram alerts, which you can also do yourself by
sending
/stopto the bot.
Write to support@turnmarks.com. We answer within 30 days and we do not charge for it. We may need to confirm you control the account's email address first — otherwise the right to a copy of your data becomes a way for someone else to obtain it.
If you think we have handled your data badly, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), or, in the EU or EEA, to your national supervisory authority.
Security
Everything travels over HTTPS. Passwords are stored as bcrypt hashes, never in a readable form. Sign-in tokens carry a version number so that changing your password or resetting it invalidates every other session immediately. Registration, sign-in and password-reset are rate limited per IP address, and the forms are behind a bot check.
No system is perfect. If a breach affects your personal data and puts you at high risk, we will tell you and the relevant authority, as the law requires.
Children
The Service is not for anyone under 18, and we do not knowingly hold data about children.
Changes
If this policy changes, the date at the top changes with it. Anything that materially affects how we use data you have already given us will be emailed to the address on your account.