Privacy Policy

Hardwon is a trading journal. It reads your trades from Delta Exchange India and shows the habits behind your results. This policy explains what personal data we hold, why, who helps us process it, and the rights you have under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act").

Who is responsible for your data

Hardwon is run by Anish, the "data fiduciary" for your personal data. For any question, request or complaint about your data, write to anish.grd2004@gmail.com. This address also acts as our grievance officer contact.

What we collect

• Your account: your email address and the name and picture from the sign-in you choose (for example Google). Sign-in is handled by Clerk.
• Your Delta Exchange API key and secret, if you connect one. They are locked (encrypted) the moment you save them, with a key only our sync server holds; our website can store them but can never read them back. We ask for a Read Data key only.
• Your trading records from Delta: fills, orders and wallet transactions (including deposits and withdrawals), which we rebuild into trades with fees, funding and profit and loss.
• What you write: journal answers, notes and ratings. Voice notes you send on Telegram are turned into text; we keep the text, not the audio.
• Telegram, if you connect it: your chat id, your Telegram username or first name, and the messages you send our bot.
• Phone notifications, if you turn them on: the browser's push address and a device label such as "Android · Chrome".
• Technical data: our hosting providers keep short-lived request logs (such as IP address and browser) for security.

Why we use it

• To sync your trades, build your journal, statistics, behaviour score and charts, and show them only to you.
• To message you about closed trades, your weekly review and sync problems, on Telegram or your phone, if you turned them on.
• To write AI coaching reviews and suggest journal answers from your notes, when you use those features.
• To keep the service secure, prevent abuse, and answer you when you contact us.

We process your data on the basis of your consent, which you give by creating an account and by connecting each service. You can withdraw it at any time: disconnect Delta or Telegram, turn notifications off, or delete your account in Settings. We do not sell your data, show ads, or use it to trade.

AI features

When you ask for a review, or add a note or voice note, we send the needed trade summaries and text to an AI model through Vercel AI Gateway (currently models by Google and OpenAI) and store the result. The AI coach comments on habits and process only; it does not give trade calls or investment advice.

Who processes it for us

We use these providers, each only for the job listed:

• Clerk: accounts and sign-in.
• Vercel: hosting the website (Mumbai region) and the AI Gateway.
• Turso: our database (Mumbai region).
• Amazon Web Services (Lightsail, Mumbai): our sync server, which talks to Delta Exchange.
• Google and OpenAI: AI reviews, suggestions and voice transcription.
• Telegram, and your browser's push service (Google, Apple or Mozilla), for messages you turned on.

Some of these providers process data outside India. We only use providers that protect it under their own security commitments, and we never transfer data to a country the Government of India has restricted.

How long we keep it

We keep your data while your account exists. When you delete your account, we erase your data from our database straight away; copies in our providers' backups expire within 30 days. Disconnecting Delta deletes your stored API key at once.

Your rights

• Access: download everything we hold about you from Settings → Your data.
• Correction: edit your journal at any time. For anything else, email us.
• Erasure: delete your account from Settings, or email us.
• Nomination: you may name someone to exercise these rights if you die or cannot act. Email us to do so.
• Grievances: write to anish.grd2004@gmail.com. We aim to reply within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.

Security

Data travels encrypted (HTTPS). API keys are sealed so only our sync server can open them, and each one is tied to its owner's account. Every user's data is kept apart, and we test that one user can never see another's. No system is perfectly secure; if a breach affects you, we will tell you and the Data Protection Board as the DPDP Act requires.

Children

Hardwon is for adults. You must be 18 or older to use it.

Changes

If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect.