Last updated October 25, 2026

Privacy and Cookie Policy

Personal information we collect

The only personal information Tickspycorp itself receives is what you choose to send us through the contact and feedback forms. There is no account, no sign-up, no visitor-analytics beacon and no per-visitor profile. Concretely, we collect:

• Contact form: your name, your email address, and the message you write. A subject line is generated from what you entered.
• Feedback / bug form: your name, your email address, the category you select (Feedback, Bug Report or Feature Request), the message you write, and an optional screenshot (PNG, JPEG, WebP or GIF, up to 5 MB).
• Technical information carried by any web request, including a form submission: IP address, browser and device details, and a timestamp. This is processed by our delivery and mail providers, not stored by us in any database of our own.

Please do not send API keys, passwords, account numbers, brokerage statements or other sensitive financial information. There is no field that needs them, and we do not want them.

How the forms work: FormSubmit and Gmail

This site has no server of its own that stores messages. Both forms post directly from your browser to the relay service FormSubmit (formsubmit.co), which forwards your submission as an email to tickspysupport@gmail.com, an inbox hosted by Google Gmail. We read it there and reply from there.

What happens, step by step: your browser sends the fields you filled in (and any screenshot) to FormSubmit; FormSubmit relays them to the Gmail inbox; the message then sits in that mailbox until we action and delete it. FormSubmit and Google process the contents of the message and ordinary request data such as your IP address under their own privacy policies. Sending a message is entirely optional — you can simply email us, or not contact us at all, and still use every part of the desk.

Why we use it, and our legal basis

We use the information from the forms for exactly one purpose: to read, answer and resolve your request, and to investigate anything you report. We do not sell it, rent it, trade it, use it for advertising, build profiles from it, or use it to make automated decisions about you.

Our basis for handling it is your consent, given by actively submitting the form, plus our legitimate interest in answering support requests and keeping the service working. You may withdraw consent at any time by asking us to delete your message; withdrawal does not affect processing already carried out lawfully.

Legal framework: PIPEDA and Québec Law 25

Tickspycorp is based in Québec, Canada, and handles personal information in line with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and Québec's Act respecting the protection of personal information in the private sector, as modernized by Law 25 (2021, c. 25). In practice this means:

• Identified purposes and plain language. This policy states, in plain terms, what we collect and why, before or at the time of collection.
• Consent. We collect support messages only from you, only when you submit them, and only for answering them and fixing what you report.
• Minimal collection. We ask for the least information needed to reply. Optional fields and screenshots are just that: optional.
• Accountability. One person at Tickspycorp is responsible for personal-information protection (see below), and we can answer for our providers' handling.
• Safeguards. Messages travel over HTTPS and live in a provider mailbox with its own access controls. No system is perfectly secure, but we do not operate our own database of visitors to lose.
• Rights. You can ask to see the information we hold about you, correct it, delete it, or receive it in a structured electronic form — see Your rights.
• Privacy impact. Because our only collection is a form you choose to submit, and any processing outside Québec is limited to delivery providers under contract, we assess the risk to your privacy as low and proportionate to the purpose.

Where your information is handled

Tickspycorp holds support correspondence in Canada, but some of the services used to deliver it may process and store information outside Québec and Canada, including in the United States — in particular FormSubmit and Google Gmail. Providers outside Canada are subject to the laws of their own jurisdictions, and their authorities may be able to obtain disclosure of information held there. Where we rely on such a provider, we choose one that offers contractual privacy commitments, and we do not send more than the message needs.

Retention

Support messages are kept only as long as needed to answer your request, resolve the reported issue, and meet any applicable legal or accounting obligation. When that is done, we delete them. You can ask us to delete a message sooner (see below). Hosting logs and the calendar/news providers keep their own operational or security records for their own periods, which we neither control nor read as a profile of you.

Your rights

Under PIPEDA and Québec Law 25 you may contact us to:

• Access the personal information we hold about you, and be told how it has been used and to whom it has been communicated.
• Correct information that is inaccurate, incomplete or ambiguous.
• Delete information where the law allows, including a support message you no longer want us to keep, and to have a copy of it first.
• Withdraw consent to optional processing, and to object to processing you consider excessive.
• Portability — receive the computerized information you provided to us in a structured, commonly used format.
• De-indexing / cease dissemination of information in defined circumstances, subject to the conditions and exceptions in the law.

Send any request to tickspysupport@gmail.com. We may ask for enough information to verify your identity before acting, so that we do not disclose someone else's correspondence to you. We answer within the time the applicable law requires and, where we refuse a request, we explain why and tell you how to challenge it.

Privacy officer and complaints

The person with the highest authority at Tickspycorp is responsible for the protection of personal information, unless that responsibility is delegated in writing. That person is the privacy contact for this site, reachable at tickspysupport@gmail.com. If you are not satisfied with our response, you may contact the Commission d'accès à l'information du Québec, and for matters within federal jurisdiction, the Office of the Privacy Commissioner of Canada.

Information this site handles without collecting it

Learning exercises and Market Structure: practice inputs, chart gestures, recalculations and historical studies run in your browser. These features do not transmit your entered numbers or record your cursor movements. Practice values are not saved by the application; browser form-restoration behavior may retain them. Opening a page or following a reference link still makes ordinary web requests to its host. Market Structure uses the bars already loaded for the selected symbol; its research controls do not submit those bars to an AI service.

The landing page saves your language choice as tickspy-locale. Remove it by clearing this site's browser data. Translated navigation and introductory text do not mean all desk or legal content has been translated or professionally reviewed.

The desk stores your watchlist, alerts, preferences, and any optional Alpaca API keys in your browser's local storage. Those values are not stored by TickSPY. Alpaca keys are sent only to Alpaca when you choose to connect live data.

Alerts on Telegram, if you connect them

The desk's other alerts are client-side: they run in the page, are stored in your browser, and stop when the page closes. Telegram alerts are the exception, because the point of them is to reach you with the desk closed. This is therefore the only feature where something is deliberately sent to, and kept on, our edge server. It is off until you connect it, and one button deletes it.

It does not ask for your phone number and does not need one. The channel is a Telegram bot. While a chat is connected, the edge server keeps one record per connection: the Telegram chat identifier the bot may message (a number Telegram assigns to that conversation, which is deleted with the record), the display name Telegram shows the bot for that chat (typically a first name or a group title), the alert rules you set, and a timestamp for when each rule last fired. There is no email address, no phone number, no IP address, no TickSPY account and no other third-party identifier in that record, and it is used for one thing: deciding whether to send you a message.

Connecting happens through a one-time code: the landing page or the desk asks the server for a code valid for fifteen minutes, and it travels to Telegram inside a link that you press. Pressing START in the chat is the only thing that attaches a chat to a rule set, and the code is marked used and expires. Neither page learns your chat identifier, and the chat never receives the page's management key.

Telegram carries these messages, so Telegram can read them. Unlike the browser push notifications this replaced, they are not end-to-end encrypted against the messaging platform: a Telegram message is private to your chat and to Telegram's own handling, which is governed by Telegram's privacy policy. Nothing about the alert is sent to any advertising or analytics service, and no other provider is involved in delivery.

The Disconnect button on the landing page, the delete button in the desk's Alerts tab, or /stop in the chat removes the record and its rules from the server. Blocking the bot is also noticed: the failed delivery deletes the record on the next check rather than retrying indefinitely.

Text messages are not offered. Sending an SMS to an arbitrary number requires a paid messaging provider and carrier registration, so this deployment does not do it and says so on screen rather than offering a button that cannot work. No phone number is collected from anyone.

Community comments

The landing page has a public comment wall. It is anonymous by design: there is no sign-up, no email field, no cookie and no profile. When you first open it, your browser generates a random 32-byte key and keeps it in local storage under tickspy-community-key. That key is sent with your posts so the server can recognise your own comments; the server stores only a one-way SHA-256 hash of it, never the key itself. The nickname you see (for example, “Quiet Otter #4821”) is derived from that hash, so it is stable for this browser without being tied to you.

For each comment the server stores: the text you wrote, the generated nickname, the hash of your key, a hash of the text used to detect repeated spam, a timestamp, and a moderation status. It does not store your name, email address, IP address, location, or any advertising identifier. A comment is public the moment it is posted, so write it as something you are content for anyone to read.

Comments are kept until you delete them or we remove them under the moderation rules. The Delete button on your own comment replaces the text with an empty value on the server and marks the row deleted; the row keeps only the keyed hash and a timestamp so the rate limiter cannot be reset by deleting. If you clear this site's browser data, the key is destroyed — the comments stay public, but no browser can prove they are yours, so they can no longer be deleted from the page. There is deliberately no recovery channel, because a recovery channel would require collecting something that identifies you.

An automated filter holds comments that contain slurs, excessive links, shouting, repeated text or injection-shaped markup. Held comments are not public and are reviewed by a person. The moderation console is private and protected by a server-side token; it shows the comment text, the generated nickname, a short prefix of the key hash and timestamps. Do not post personal information, API keys, account numbers or anything about another person.

Google AdSense and cookies

No advertising runtime or advertising cookies are loaded in the current release. If a future deployment enables Google AdSense, the following choices apply. Enabling advertising requires an updated deployment and any consent platform required by Google and applicable law.

Advertising is optional. Until you choose Allow ads, the landing page does not load the Google AdSense runtime or request an ad. If you choose No thanks, no AdSense ad units are requested for that browser.

If you allow ads, this site asks Google for non-personalized ads. Google and its vendors may nevertheless use cookies, local storage, IP address, browser and device data, and similar technologies for ad delivery, frequency capping, fraud prevention, security, and aggregated measurement. Google controls those technologies and may process data under its own policies.

Read Google's Privacy Policy and advertising technology information for details. There is no advertising choice to change in this release because advertising is disabled.

Service providers

Netlify hosts the website and proxies public edge requests to Cloudflare. Both process request information such as IP addresses, requested paths, timestamps, and browser details and may retain operational or security logs according to their own policies. Tickspycorp does not operate an account database or independent analytics system.

Cloudflare also runs the comment API and stores the comment database (D1). Comment text and the pseudonymous record described above are therefore processed and stored on Cloudflare's infrastructure, which may be outside Québec and Canada, under Cloudflare's own privacy and lawful-access terms. The Worker keeps per-IP counters in memory for a few minutes to stop flooding; those counters are never written to the database and disappear with the process.

Google Fonts receives your IP address and browser details when typefaces load. jsDelivr provides TensorFlow.js when the volatility model runs. The model trains in your browser; your credentials and watchlist are not sent to jsDelivr.

With your own credentials, your browser contacts Alpaca directly for data and streams; Tickspycorp's edge proxy does not receive those credentials. Without credentials, your browser loads a replay file from this site's hosting. The currently bundled files contain generated demonstration data, not real market prices. If replaced with verified HF Data Library files, the price source is IEX exchange data. Headlines from public feeds and calendar entries from FairEconomy are requested by our edge server, not your browser. Google Gemini receives public headlines and calendar information from the edge server to produce a shared overview; no user-entered prompts or credentials are sent.

Telegram delivers the alert messages described above, and only if you connect a chat. It receives the message text, the chat it is addressed to, and ordinary connection information; Telegram operates under its own privacy policy and processes data outside Québec and Canada. Nothing is sent to Telegram until you press START in the chat.

FormSubmit and Gmail process submitted messages as described above. Providers can process and store information outside Québec and Canada, including in the United States. Their privacy practices and lawful access rules may differ from those in Québec.

Choices and browser storage

The calendar normally uses the site's edge service or bundled file. A fallback can request calendar data directly from FairEconomy, in which case that provider receives your browser's normal request information. This release does not include session recordings or a client-side visitor-analytics beacon. Hosting-provider traffic statistics and server logs are separate from those browser features.

Your advertising choice, if made, is saved under tickspy-ad-consent. Desk and landing-page storage includes cfg (optional Alpaca keys), wl (watchlist), deskprefs (your default symbol, timeframe and opening tab), alerts, calalert, calfired, calc (calendar cache), legal (disclosure acceptance), wiz (setup preference), tickspy-community-key (your anonymous comment identity, described above), and — only if you connect Telegram alerts — tgsub (that subscription's id and token, which are this browser's own key to change or delete it) and tgrules (the rules you set). Storage remains until you clear this site's browser data or remove the relevant item in the desk. Browser-stored keys are not encrypted by TickSPY. Use Paper-account keys and avoid shared devices. If storage is unavailable, preferences are held only for the current page session.

Eligibility and security

The desk is intended for people aged 18 or older. We do not knowingly solicit children's personal information. If such information was submitted, contact us to request its removal. HTTPS and browser security controls reduce risks, but no website or browser storage can be guaranteed completely secure.

Contact and changes

For support and privacy questions, email tickspysupport@gmail.com. This policy may change when site functionality or providers change; this page will show the updated date.