What we collect
Your account
You sign in with Google. Google gives us your name, email address, profile picture and Google account ID. If you add a phone number during setup, we store that too.
Your Telegram connection
Connecting Telegram links Trade Arena as a device on your Telegram account. We store that session encrypted, with your Telegram user ID, username, first name and a masked phone number. Your phone number, login code and any two-step verification password are passed to Telegram to complete the login and are not stored.
We read messages only from the channels you add: their text, time and message ID, so they can be checked for trading signals. If a channel later edits or deletes a message we read, we keep the edited text and the time we saw the change, so each trade keeps a true record of what was posted. When you browse your chats to add a channel, we list their names; that list is held for about a minute.
When you pick a channel to add, we read its messages from the last 10 days once (at most 300), so we can suggest which instruments it trades. We read it whether or not you then add it. The result is kept for 30 minutes so a second look costs nothing, and is then deleted; if you add the channel, up to three of its own calls are kept as examples that help us read its next messages. Only a channel or group you have joined can be read this way. We do not read your private chats, or any group or channel you have not picked or added.
Your broker account
To place orders for you we store your Fyers app ID, secret key and the daily access token, encrypted. Through the broker's API we read the orders, positions, trades and funds needed to run, protect and reconcile your trades.
For Groww, we store your TOTP token and TOTP secret, encrypted, which we use each morning to sign in on your behalf, and the day's access token that sign-in returns. They are kept on our server only, never on your device. Disconnecting Groww deletes them.
Your trading activity
Your channel settings, risk limits, the signals we read and how each was handled, the orders and trades placed for you with their prices and profit or loss, your Trade Desk plans and, from before tokens were retired, your token balance and history.
Payments
We do not take payments in the app at present. For the dedicated IP subscription we keep the price, the period it covers and its status, and we keep any records of earlier payment attempts.
Your dedicated IP address
The static IP address assigned to you for sending orders to your broker, and the periods of your subscription.
Notifications
If you turn on alerts, the notification service of your phone or browser (Apple, Google, Microsoft or Mozilla) issues a push address for the Trade Arena app on that device. We store that address, the public key and the secret your browser creates so that alerts can be encrypted for that device alone, a short device label such as “iPhone · Safari”, your browser's user-agent string, and when the device last checked in and when an alert was last delivered to it or failed. We keep these only while you keep alerts on for that device, and remove them when you remove the device in Settings, sign out on it, or its notification service tells us the address no longer works.
Messages you send us
If you use the form on our Contact page, we receive your name, email address and message, delivered to us by email through Web3Forms. If you write to us by email, Telegram or WhatsApp, we receive what you send there.
How you use the site and the app
We use PostHog to understand how people use Trade Arena: which pages you open, what you click, your browser, device, approximate location from your IP address, and a recording of the screen as you use it, so we can see where people get stuck.
In the app, those recordings hide all text on the screen and everything you type, so no figure, trade, message, name or email is captured, and clicks are recorded without the text of what was clicked. On tradearena.in, recordings hide everything you type. Web addresses are recorded without the part after the “?”, which is where sign-in codes travel, except the campaign tags of a link you followed (the ones that begin “utm_”), so we can tell which of our posts or ads brought you. Once you sign in, this activity is linked to an internal account number, never to your name or email address.
Our server also tells PostHog when you reach a few milestones: you created your account, connected Telegram, added a channel, and each time a paper trade fills. These carry the same internal account number, the time, and internal IDs of the channel and paper trade, never a name, email, contract, price, amount or message.
You can turn this off at any time: in the app, while signed in, with the Usage analytics switch, or on tradearena.in with the “Usage analytics” switch at the bottom of every page. Once it is off, PostHog is not loaded on that browser, on tradearena.in or in the app. Signed in, it is also off for your account on every device, and our server sends no more milestones for you, including none from while it was off.
Technical data
Like any web service, our servers log IP addresses, browser and device details, and errors.
What stays in your browser
Your sign-in is kept in your browser's local storage. To save retyping, Settings also remembers your Fyers app ID and secret key in local storage on that device. They are stored there unencrypted, so anyone with access to that browser profile can read them. Use the app only on a device you control, and clear the site's data to remove them. If you turn on alerts, your browser also holds the push subscription itself, the ID we gave it, which account turned alerts on, and when it last checked in with us. Unless you have turned usage analytics off, PostHog keeps a random visitor ID in a first-party cookie and in local storage, so it can tell one visit from the next. We use no advertising cookies and no advertising trackers.
How we use it
- To run the Service: read your channels, interpret signals, check them against your rules, and place, protect and close orders in your broker account as you have configured.
- To sign you in, keep your account secure and prevent abuse.
- To email you about your account: a welcome email when you sign up. We send no marketing email, and no email of ours carries a trading result.
- To call you, on the phone number you give when you ask for live trading, to set up your broker with you.
- To run your dedicated IP subscription and answer your support requests.
- To see how the Service is used and where it confuses people, so we can improve it.
- To publish platform-wide counts, such as the number of signals processed. These are totals only and never identify you.
- To meet our legal obligations.
We do not sell your personal data, and we do not use it for advertising.
AI processing
To read a signal we send the message, the channel's recent messages for context, and your open positions from that channel to the AI model provider we use at the time and, when you pick a channel to add, up to 80 of its recent messages so we can suggest settings. That could be Anthropic, Amazon Web Services, Groq or OpenAI. We do not send your name, email address or broker credentials.
Who we share it with
Only the service providers needed to run the Service:
- Google: sign-in. The site also loads its typeface from Google Fonts, which sees your IP address.
- Telegram: to read the channels you add.
- Fyers: your orders go to your own broker account, under your credentials.
- Groww: likewise, if you connect it — your orders go to your own Groww account, under your credentials.
- Apple, Google, Microsoft and Mozilla push services: if you turn on alerts, they carry each alert, encrypted, to your device. They see your device's push address, not your account or what the alert says.
- AI model providers: as described above.
- PostHog: usage analytics and screen recordings, as described above, stored in its EU region.
- Web3Forms: delivers messages sent through the Contact page form to us by email.
- Resend: delivers the emails we send you. It receives your email address and the message.
- Amazon Web Services: hosting, in Mumbai, India.
- An error-monitoring provider, if we use one: technical details of errors.
We also disclose data when the law requires it. Some providers, including AI providers, may process data outside India.
How we protect it
Everything travels over HTTPS. Broker credentials, Telegram sessions and proxy passwords are encrypted at rest with AES-256-GCM, and access to production systems is restricted. No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.
How long we keep it
We keep your data while your account is open. When you ask us to delete your account, we delete or anonymise your personal data within 30 days. The exception is records the law requires us to keep, such as payment records, which we keep only for as long as required. Server logs are kept for a limited period.
Your rights and choices
- Access and correction: ask for a summary of your data, or have it corrected.
- Erasure: ask us to delete your account and data.
- Withdraw consent: disconnect Telegram or your broker in Settings at any time. You can also revoke the Trade Arena device in Telegram (Settings → Devices) or the app in your Fyers dashboard. Trading stops when you do.
- Nominate: name someone to exercise these rights if you cannot.
- Grievances: write to us (below). If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
Send any of these requests through the form on our Contact page, giving the email address on your account.
Children
The Service is for adults. We do not knowingly collect data from anyone under 18.
Changes
When this policy changes we update the date above. We tell you in the app before any significant change takes effect.
Contact and grievance officer
Questions, requests and complaints about your data go to our Grievance Officer through the form on our Contact page. Start your message with “Grievance”.