Privacy Policy
This policy describes what AlphaPine Terminal stores about you, why, and your rights under Malaysia's Personal Data Protection Act 2010 (PDPA).
What we collect
- Account: your email address, sign-up date, plan and trial dates. You need an account to see market data.
- What you create: watchlists, drawings, workspace layout and settings, alerts, notifications, journal entries, paper-trading activity, saved scans, Second Look usage counts, and whether you chose "Continue and don't ask again" for Second Look's records (below).
- Billing: once payments open, your subscription's identifiers and status from our payment provider, which sells the plans as merchant of record and holds your payment details. Card details never reach us. Until payments open we hold no billing data.
- Optional connections: your Telegram chat id if you link alerts; your browser's push subscription and a short device label if you turn on notifications, with your quiet hours; the webhook address you add for alerts (its signing secret stored encrypted); your own AI provider key if you add one (stored encrypted, never shown again or exported).
- Technical: a session cookie (strictly necessary for sign-in), request logs and error reports (message, page, browser type) kept for diagnosis and security.
- Fair-use limits: which markets' price history your account opened today (the market symbols and how many times, no prices), and which symbols your account asked My markets about today (the symbols only: never whether one is on a list, in a plan or on a chart, and no prices), so the per-account limits in the Terms can apply. Earlier days are deleted when your account first opens history, or first asks My markets, on a new day, and all of it with your account. If an account passes half a price-history limit, our server logs note the account id and the counts. The symbols asked about in My markets are also kept for the last 10 closes with no account attached, so the end-of-day job can measure them.
- Feedback you send: your words, the category, the app version, browser and system, window size, language, workspace, the symbol and timeframe on screen and the data provider (for a reading report, the indicator, its settings and value at that bar); a screenshot of the chart only if you tick it (deleted after 90 days); your email only if you ask for a reply. Never your account size, risk settings, trades, plans, journal, rules, AI conversations, keys or watchlists.
We do not use advertising cookies or sell personal data. One more cookie is set only if you press the theme button on these pages or on alphapinelab.com: ap_theme, which remembers whether you chose the dark or the light theme so both sites show the same one. It holds only that word, lasts up to a year, is not read by our servers and is never used to identify or track you; your browser keeps the same choice in its local storage too. Until you press the button, no theme cookie is set and these pages are light.
Kept only in your browser
My indicators and My libraries (your scripts, their conversions and their settings) are stored in your browser's local storage and run there. They are not sent to us, and are not part of Export my data. Clearing your browser's data removes them.
Vendor waitlist
If you join the waitlist for indicator authors, we collect your name, email address, the profile URL where you publish your scripts, number of published scripts and what you would like to sell. We use it only to contact you about selling on AlphaPine, and delete it on request (or with your Terminal account, if it uses the same email).
Founding list
If you join the founding list on the AlphaPine site, we store your email address, the language you chose, where the form was (for example, the landing page), which wording of the consent box you ticked, when you signed up, confirmed or left, and, until you confirm, a hash of your confirmation link (never the link itself; it expires after 48 hours). No name, IP address or tracking data is kept with it.
Why: with your consent, to send you emails about the founding list: its details on 27 November 2026, the opening date, the plans and their prices with the Terms that apply, and short build notes. Nothing is sold or bought through the list. We email you only after you confirm your address from the link we send (opening the link shows a button; you confirm by pressing it); if you don't confirm, we send nothing more.
How long: until you leave. If you never confirm, we delete the address 30 days after the last confirmation email. When you leave, we keep your address, its language and where you signed up, the dates you signed up, confirmed and left, and which consent wording you ticked, so that it stays off the list and we can show what you agreed to; ask us and we erase it entirely. It is also deleted with a Terminal account that uses the same email, and included in that account's Export my data.
How to leave: every email to the list carries a link to leave, as does the page you see after confirming; press the button on the page it opens and it works at once, without signing in. Or write to support@alphapinelab.com.
Why we use it
To provide the service you signed up for (account, saved work, alerts, billing), to secure it (rate limits, abuse prevention), to fix problems, and to send service emails (sign-in links, alerts you set up, important account notices).
Who processes it for us
- Cloudflare — hosting, database and logs.
- Resend — email delivery.
- Telegram — alert messages, if you link it.
- Your browser's push service (Google, Mozilla, Apple or Microsoft) — delivers the notifications you turn on, encrypted so that only your browser can read them.
- Anthropic or OpenAI — Second Look, the Terminal's AI. When you ask it a question, the question and the chart's structured context (the market, timeframe, recent prices and the AlphaPine readings on screen) are sent to the AI provider (your own provider, if you added a key). With Anthropic, on AlphaPine's key or your own, every request asks for processing in the United States only. With an OpenAI key, only your question and your own records are sent, never the chart's context or other market data. Its jobs that need your own records — "Find rule breaks" and "Review my trades" (your last closed trades: R, costs, adherence, notes), "Challenge plan" (your plan, rules and checklist, session and open heat, open and armed trades) and "Pre-session brief" (the same, with your planned and paper plans' stops and triggers, and My markets for your own symbols: figures and indicator states for your active list and the charts you opened this session) — first ask for your consent in the panel, saying what will be sent; nothing is sent until you choose Continue. They are sent only with that request, to answer it, and AlphaPine does not store them or the conversation. If you choose "Continue and don't ask again", that choice is kept on your account and your records go with later jobs and questions without asking (the pre-session brief asks once on its own wording); turn asking back on at any time in Settings → General → "Second Look and your records" → "Ask each time".
Some of these process data outside Malaysia (Second Look's requests in the United States); we rely on their contractual safeguards. Our market data provider (Tiingo) receives no personal data: our server asks it for prices, never with your details.
How long we keep it
For as long as your account exists (the founding list: as described above). Request logs and error reports are kept by our host for up to 30 days. When you delete your account, its data is deleted from the live database immediately and from backups within 30 days.
Your rights
- Access and portability: download all your data from Account & privacy → Export my data.
- Correction: edit your data in the Terminal, or contact us.
- Deletion: delete your account from Account & privacy.
- Withdraw consent / limit processing: leave the founding list from any of its emails, unlink Telegram, turn off email alerts, remove your AI key, set Second Look back to "Ask each time" (Settings → General), or contact us.
Security
Sign-in, session and founding-list confirmation tokens are stored only as hashes; AI keys are encrypted at rest; all traffic is encrypted in transit; access is rate-limited.
Contact
support@alphapinelab.com. We answer access and correction requests within 21 days, as the PDPA requires.