Privacy Policy

Last updated: 2 May 2026

This privacy policy explains what data INDASH collects, how we use it, and your rights. We aim to be honest and concrete — no legal-jargon padding.

What we collect

Account data

When you sign up: your full name, email address, optional phone number, and a hashed password (we never store your password in plain text).

Usage data

What features you use, what stocks you add to your watchlist, what trades you log, what alerts you set. This is required to provide the service.

Broker credentials (optional)

If you connect a broker (Fyers / Angel One / Dhan), we store your API credentials encrypted at rest using Fernet (AES-128 in CBC mode with HMAC). The encryption key is held separately. We use these credentials only to fetch your authorised data on your behalf.

AI provider keys (optional)

If you use the AI Copilot, your Anthropic / Gemini API keys are stored encrypted with the same scheme. AI calls go directly from INDASH to the provider using your key — we never proxy or log the content of your AI conversations beyond what's needed to display them back to you.

Payment data

If/when you subscribe, payment processing is handled by our payment partner (Razorpay/UPI). We see only the order amount, status, and a transaction ID — never your full card number or bank credentials.

Server logs

Standard web-server logs (IP address, user agent, timestamps) for security monitoring, kept for 30 days.

What we don't collect

• We don't sell your data to anyone, ever.
• We don't run third-party advertising trackers.
• We don't share your watchlist or portfolio with marketing partners.

How we use it

• To provide the platform features you use
• To send transactional emails (password resets, payment receipts, alerts)
• To send occasional product updates (you can unsubscribe anytime)
• To debug issues and improve the platform
• To comply with legal obligations

Your rights

• Access: Request a copy of your data anytime via /contact
• Correction: Edit your profile from your account page
• Deletion: Request full account deletion via /contact; we'll delete within 30 days except where required to keep records (eg. tax)
• Portability: Export your trade journal and watchlists as CSV

Security

• HTTPS everywhere
• Passwords hashed with PBKDF2 (Werkzeug default)
• Sensitive credentials encrypted at rest with Fernet
• Daily automated backups (encrypted)
• No shared admin passwords between team members

Cookies

We use a single session cookie (HttpOnly, SameSite=Lax) to keep you logged in. We don't use third-party tracking cookies.

Children

INDASH is not directed at users under 18. If you're under 18 you may not use INDASH.

Changes

We may update this policy as the platform evolves. Significant changes are emailed to all subscribers.

Contact

Questions or data requests? support@investdash.ind.in