Written from the code that runs the service. Every line below names something the product actually does with your data.
Creating an account asks for your email address, a password, your first name and a mobile number. A Telegram handle is optional. These are held by Amazon Cognito, the sign-in service we use, in the Mumbai (ap-south-1) region. Your password is held by Cognito as a hash; we cannot read it.
Your mobile number is used for one thing: one account per number. The number is recorded against your account the moment you submit the form, before the emailed code is entered, so a second signup with the same number is refused. If you never finish the signup, the number stays recorded against the email you typed; the same email can retry, and anyone else is refused. Write to us to release it.
The Telegram handle, if you give one, is for broker-disconnection alerts and is unique to one account for the same reason.
To show your own positioning the workspace signs in to your broker with credentials you enter in Settings. They are encrypted with a key held in AWS Key Management Service and stored against your account; they are decrypted only to make the broker calls the workspace needs. Connecting a broker again replaces them; write to us to have them deleted.
We never place orders. The broker session is used to read option chains and your positions.
Payment is taken by Razorpay. Card and UPI details are entered on Razorpay's checkout and never reach us. We keep a ledger of what you paid: the plan, the amount, the date, and Razorpay's payment and subscription identifiers, so that a charge can be matched to your access and to a refund request. Razorpay has its own privacy policy for the data it holds.
We send account email through Resend: the sign-up verification code, a welcome note, a notice before a renewal above Rs 15,000 is charged, a notice when a subscription stops, and expiry reminders.
The site loads Google Analytics 4 and a Google Ads conversion tag, which record page views and the signup and payment steps, with the identifiers Google sets in your browser. They run on every page, including the workspace. We do not send Google your email, phone number or anything you type into the product. Blocking the tag in your browser does not affect the product.
Our servers keep standard access logs: the address a request came from, the time, the route and the response code. They are used to keep the service running and to investigate faults and abuse, and they are kept for a limited time.
You can stop a subscription in Settings. To change the name, phone number or Telegram handle on your account, to delete your account, or to release a phone number from a signup that was never finished, write to connect@hedgewall.in from the email on the account; we remove the account, its broker credentials and its claims, and keep only the payment ledger for as long as tax and accounting rules require.
We may update this page; the date at the top is the current version. Questions go to connect@hedgewall.in.