Privacy Policy

This policy explains what personal data OneAlpha ("we", "us") collects when you use the OneAlpha website and app, why we collect it, and the choices you have. It is written to comply with India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.

1. Data we collect

• Account data: your email address, and a password (stored only as a salted hash) if you sign up with email; or your name, email and profile picture from Google if you use Google sign-in.
• Usage and settings: your wishlist and holdings you enter, saved strategies, backtest settings, plan usage counts, and app preferences.
• Broker connection data (paid plans): the API credentials or authorisation tokens you provide to connect a broker, and the orders, positions and balances the broker returns so we can show them and place the orders you request.
• Billing data: your plan, subscription status and Razorpay subscription and payment IDs. Card, UPI and bank details are entered on Razorpay's checkout and are never sent to or stored by us.
• Security data: the IP address of your session, which we bind to your login token to stop stolen tokens being used from elsewhere, and server logs used to investigate errors and abuse.
• Analytics: if enabled, aggregate page-view and button-click counts via Plausible Analytics, which uses no cookies and collects no personal identifiers.

2. Why we use it

• To create and secure your account and keep you signed in.
• To provide the screener, backtests, signals and, on paid plans, order placement and auto-rebalancing you ask for.
• To bill paid plans and enforce plan limits.
• To send service emails (account, security, billing and order notifications). We don't send marketing email without your consent.
• To find and fix bugs, prevent fraud and abuse, and meet legal obligations.

We do not sell your personal data, and we do not use it for advertising.

3. Who we share it with

Only the service providers needed to run OneAlpha, each bound to use the data only for that purpose:

• Google Firebase / Google Cloud: authentication and account storage.
• Razorpay: subscription billing and payments.
• Your broker: only when you connect it, and only to carry out the actions you request.
• Our hosting provider: application servers and backups.
• Plausible Analytics (if enabled): anonymous, aggregate statistics.

We may disclose data where required by law, court order or a lawful request from a government authority.

4. How we protect it

• All traffic is encrypted in transit (HTTPS).
• Broker API secrets are encrypted at rest with AES-256-GCM in a separate service that is the only component allowed to talk to brokers.
• Passwords are stored only as salted hashes. Login tokens expire and can be revoked by signing out everywhere.

No system is perfectly secure. If a breach affecting your personal data occurs, we will notify you and the authorities as the law requires.

5. How long we keep it

We keep account data for as long as your account is open. When you delete your account, we delete or anonymise your personal data within 30 days, except billing and transaction records we must keep for tax and accounting law (generally up to 8 years).

6. Your rights

You can ask us to:

• access a summary of the personal data we hold about you;
• correct or update inaccurate data;
• delete your account and data (subject to the legal retention above);
• withdraw consent for any processing based on consent;
• nominate someone to exercise these rights on your behalf.

To do any of these, or to raise a grievance, email our grievance contact at support@onealpha.in. We will respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

7. Cookies and local storage

We use your browser's local storage to keep you signed in and remember preferences such as theme, and a secure, HTTP-only cookie to renew your session. We do not use advertising or third-party tracking cookies.

8. Children

OneAlpha is not meant for anyone under 18, and we do not knowingly collect data from children.

9. Changes

If we change this policy in a meaningful way, we will update the date above and notify signed-in users before the change takes effect.