Privacy Policy

Signal by Lazycode · signal.lazycode.ai · Last updated 12 July 2026

Educational tool, not financial advice. Signal is an educational charting and pattern-detection app. It is not a SEBI-registered investment adviser and does not provide personalised investment advice. Nothing here is a recommendation to buy or sell any security. Trading carries risk of loss.

1. Who we are

“Signal” (“we”, “us”) is operated by Lazycode. Contact: sethy.soumyaranjan@gmail.com.

2. Data we collect

• Account (only if you sign in with Google): your name, email address and Google profile picture, used to identify your account and apply your role.
• Your app data: starred/favourite markets, price alerts, saved chart layouts, and your paper-trading state (simulated wallet, positions, orders and bots). This is stored on our server against your account so it persists across sessions and devices. Paper trading is simulated with virtual money — it places no real orders.
• Usage analytics (everyone, signed in or not): we record how the product is used, so we can see what works and fix what doesn’t. Specifically:
  • What you did: pages opened, symbols searched/picked, charts opened, filters and timeframes chosen, signal cards opened, alerts/bots/paper-trades created, theme and language changes, and errors you hit.
  • What you looked at: which boards and symbols were on your screen, for how long, and how far you scrolled. This is measured from your browser viewport — we do not record your screen.
  • How long: time spent per page and per session. Time while the tab is hidden is not counted.
  • Performance: how long pages took to load for you, and which of our API calls were slow — measured in your browser so we can find real-world slowness.
  • Technical context: device type, browser, OS, referring site, approximate location (country/city, derived from your IP), and a per-browser id so repeat visits can be counted as one person.
• Your IP address is used to derive an approximate location and is then stored only as a salted hash — we do not keep the raw address.
• Technical: a signed session cookie to keep you logged in. We do not run third-party advertising or cross-site tracking.

Broker credentials. If you connect a broker (e.g. Zerodha or Binance), your API key and secret are stored on our server encrypted at rest (AES-256-GCM), and are used only to place the orders you ask for. They are never written to our analytics, never shown back to you, and never sent anywhere except the broker itself.

What we never collect. We do not record your screen, your keystrokes, or the contents of any field you type into. We do not sell or share your data, and we do not track you across other websites.

3. How we use it

• To provide the service — show charts, run detectors, sync your favourites/alerts.
• To keep you signed in and apply access (viewer/admin).
• To keep the service secure and reliable (rate-limiting, abuse prevention).
• To understand how the product is used and make it better — which boards and signals people actually read, where they get stuck, which pages are slow, and which errors they hit. This is aggregate product analytics; it is not used to profile you, target advertising at you, or make any decision about you.

We do not sell your personal data.

4. Third-party services

To function, the app talks to these providers; their handling of any data is governed by their own policies:

• Google Sign-In — authentication.
• Market data — Binance and CoinGecko (crypto), Zerodha/Upstox and public NSE/BSE feeds (Indian equities), Alpaca (US equities), Dhan (logos).
• Firecrawl — fetches public news articles for the symbols shown in the app.
• OpenRouter — the AI provider behind the written summaries and TL;DRs. We send it only market data and public news text. We do not send it your identity — no name, email, account id or browsing history.
• Google Fonts — typography.

5. Cookies

We use a single first-party, HttpOnly session cookie to keep you logged in. No advertising or analytics cookies.

6. Data retention & your rights

Your account data is kept while your account is active. You can request access to, correction of, or deletion of your data by emailing us. Signing out clears favourites stored for the previous user on that browser.

Usage analytics are kept for up to 12 months and then deleted. If you ask us to delete your data, that includes your analytics history.

7. Security

Traffic is encrypted (HTTPS). Servers are hardened (key-only SSH via private tunnel, restrictive firewall). Secrets are never committed to source control. No method is 100% secure, but we take reasonable measures.

8. Children

Not directed to children under 18. Do not use if you are a minor.

9. Changes

We may update this policy; the “last updated” date will change. Continued use means acceptance.

10. Jurisdiction

This policy is governed by the laws of India.