Privacy Policy

1. Who we are

PipsDex (operated by the operator named on our Contact Us page, ) is a market-analysis and education tool, provided for educational and informational purposes only, for digital assets, commodities and world stocks. PipsDex is for learning and paper (simulated) trading only — there is no real-money trading: we do not accept deposits, hold funds, or buy, sell or hold crypto or any other asset, so we never hold your financial or trading assets. This policy explains what personal data we collect when you use the PipsDex website and app, why, how long we keep it and the choices you have. It is written to follow India's Information Technology Act, 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Digital Personal Data Protection Act, 2023. In this policy "we" means PipsDex and its operator, the "Data Fiduciary".

2. What we collect and store on our server

• Account details: name, email address, mobile number and your password stored only as a salted one-way hash (PBKDF2-SHA256) — we never store or see the password itself. Also your role, plan and plan expiry date, preferred currency, referral code and who referred you, the date your account was created, the time of your last sign-in, and which version of our Terms you accepted and when.
• Sign-in and security data: every time you sign in we create a session record with the IP address you signed in from, your browser and device type (user agent), and the time it was created and expires. We store only a hashed version of the sign-in token. Your account can be signed in on one device at a time; when you sign in somewhere new, the older session is ended and kept for a few days only to tell that device why it was signed out. We also count sign-in and sign-up attempts per IP address and email for a short time to stop password guessing and abuse.
• Your app data (saved to your account): settings and preferences (theme, sound, watchlist and similar), chart preferences and chart drawings, price and pattern alerts, news-alert settings, your strategies, your trading journal, your paper-trading account (virtual balance, positions, orders and history) and custom calendar events. This is stored on our server so it is available on any device you sign in from. API keys typed into the local desktop copy of PipsDex are never sent to our server.
• Plan and payment records: plan, orders, amounts, currency, period, coupons, referral rewards, AutoPay status, and the order, payment and subscription references from our payment partner Razorpay. Card, UPI and bank details are entered on Razorpay's secure checkout and never reach or stay on our server.
• Messages: records of plan-expiry reminders sent to you (date and channel), and your Telegram chat ID if you switch on Telegram alerts.
• Content you post: strategies you publish in the community marketplace (shown to other users with your display name), likes, tests and reports on strategies, and feature ideas and votes.
• Usage statistics: which pages of PipsDex are opened each day, which locked features are tried, when the Plans page or checkout is opened, and how many free AI analyses you have used. For visitors to our public pages we use a random browser id and note where the visit came from (for example a search engine or a link). We do not record what you type into pages for these statistics, and we use no advertising trackers.

3. Why we use it (purpose and basis)

• To create and run your account, save your app data and give you the features of your plan.
• To confirm payments, activate plans and keep records required by law (for example tax and accounting).
• To keep accounts secure — including recording sign-in IP address and device, allowing one device at a time, and detecting fraud, account sharing and misuse.
• To send service messages — plan-expiry reminders, payment confirmations and alerts you ask for — by email or Telegram.
• To understand which features are used so we can fix problems and improve PipsDex.
• To comply with the law, court orders and requests from authorities.

We process your personal data on the basis of the consent you give when you create an account and accept our Terms and this policy, and for the legitimate uses allowed by law (such as keeping records and preventing fraud). You can withdraw consent at any time (section 9); this does not affect processing done before, and some features or the account itself may stop working without it. We do not sell or rent your personal data and do not use it for third-party advertising.

4. Who we share it with

• Razorpay (payment partner) — to process payments and AutoPay; Razorpay has its own privacy policy.
• Email provider and Telegram — to deliver messages you receive from us.
• AI provider — currently none (AI features are switched off, so nothing is sent to an AI provider). When you use AI features (AI analysis, AI market scenarios, Pips AI, the AI data analyzer), market data, chart data, your question and — for the AI data analyzer — your paper-trade and journal statistics are sent to this provider to get an answer. We do not send your name, email or mobile number with them. The provider processes this data on its own servers, which are outside India (mainly in the United States), under its own privacy terms.
• Hosting provider — our server, database and backups run on a hosting service, which may keep technical logs (such as IP addresses) as part of running the server.
• Authorities — only when required by law or to protect our users, the public or the service.
• Other users — only what you choose to publish (marketplace strategies, feature ideas).

Market prices, news and other data shown in PipsDex are loaded from public sources; those requests do not include your personal details.

5. Where your data is stored

Our server and database are run by a hosting provider and may be located outside India (for example in the United States). AI requests are processed by the AI provider outside India (section 4), and Razorpay, email and Telegram process the data they need under their own terms. Your data may therefore be stored and processed outside India; you consent to this when you tick the box at sign-up. We transfer data only to countries not restricted by the Government of India and we protect it as described in this policy wherever it is stored.

6. Cookies and browser storage

• Sign-in cookie pipsdex_sid — essential; keeps you signed in. It holds only a random token (no name, email or password), is HTTP-only (scripts cannot read it), sent only over HTTPS, and lasts up to 30 days. It is removed when you sign out or when you sign in on another device.
• Local storage in your browser — your settings, a local copy of your app data (so pages open fast), cached market data, your language and currency choice, a referral code you arrived with (30 days), a random visitor id and where the visit came from, and which AI scenarios you have already seen.
• Session storage — small notes that end when you close the tab (for example that you closed an offer banner).

We do not use advertising or cross-site tracking cookies. You can clear cookies and site data in your browser at any time; you will be signed out and the local copy will be downloaded again from your account when you sign in.

7. How long we keep it

• Account details and app data: while your account is open. You can delete items (alerts, journal entries, strategies, drawings) in the app at any time.
• Sign-in sessions (IP address and device): up to 30 days after you last use them; a session ended by signing in elsewhere is deleted after 3 days.
• Usage statistics: about 13 months, then deleted.
• Payment and order records: as long as Indian law requires (usually up to 8 years).
• Backups and hosting logs: for a limited period as part of normal server operation.

When you ask us to close your account, we delete or anonymise your personal data, except records we must keep by law.

8. Security

Passwords are stored only as salted hashes, sign-in tokens are stored only as hashes, sign-in cookies are HTTP-only and secure, the live website runs over HTTPS with security headers, repeated sign-in attempts are limited, and one device at a time is allowed per account. No system is 100% secure, so please use a strong password that you do not use elsewhere and tell us at once if you think your account has been misused.

9. Your rights

• Ask for a summary of the personal data we hold about you and how we use it, and get it corrected or updated.
• Withdraw consent and ask us to delete your account and personal data, subject to what the law requires us to keep.
• Turn off optional features (for example Telegram alerts) at any time.
• Nominate another person to exercise your rights in case of death or incapacity.
• Raise a complaint with our Grievance Officer (section 12); if you are not satisfied with our reply, you may approach the Data Protection Board of India.

To use these rights, write to us from your registered email address (details in section 12). We may ask you to confirm your identity.

10. Children

PipsDex is for adults (18+). We do not knowingly collect data from anyone under 18; if we learn that we have, we will delete it.

11. Changes

We may update this policy. The date at the top shows the version in force. For small changes (for example clearer wording or new contact details) we update this page. For important changes — new kinds of data, new purposes, or sharing with new kinds of recipients — we will show you the updated policy in the app and ask for your consent again, by ticking a box, before you continue using your account; that consent is recorded with the date and time. If you do not agree, you can stop using PipsDex and ask us to delete your account.

12. Contact and Grievance Officer

For any question, request or complaint about your personal data — or about the service, payments or refunds — write to our Grievance Officer:

• Grievance Officer: named on our Contact Us page,
• Operator: see our Contact Us page,
• Email: see our Contact Us page · Phone: ·

We acknowledge every grievance within 48 hours and resolve it within 30 days of receiving it. Please write from your registered email and include what the request is about. You can also use our Contact Us page. If you are not satisfied with our reply, you may approach the Data Protection Board of India.