Privacy policy

1. Who is responsible for your data

[Company legal name] (registration number [Company registration number]), [Registered address], is the controller of your personal data. That means we decide how and why it’s used, and we’re responsible for protecting it.

For anything about your data, contact privacy@kurzharr.com.

2. The short version

• —We collect what we need to run your account and your tests: your email address, a hash of your password, sign-in records including your IP address and browser, what you submit, and your subscription status.
• —We use only the cookies needed to sign you in. No advertising or tracking cookies. We count visits with a tool that sets no cookie and doesn’t identify you, and you can tell it not to count this browser.
• —We don’t sell your personal data or use it for advertising.
• —AI features send what you type, and the strategy or results they need, to Google’s Gemini API — without your name, email address or IP address.
• —Deleting your account deletes your sign-in details and everything you saved. Your run records stay only in anonymised form: under a new random ID, as numbers and verdicts, without anything you wrote or any trade’s times and prices — see Deleting your account.
• —You can ask for a copy of your data, or for it to be corrected or deleted, at privacy@kurzharr.com.

3. What we collect

Here is everything we collect, grouped by where it comes from.

Account details

• —Your email address.
• —A hash of your password, made with scrypt and a random salt. We never store the password itself. Accounts created with Google have no password.
• —When you created the account, and when you verified your email address.
• —A display name, if you choose to set one.
• —A random account ID. It isn’t derived from your email address, and it links your account to everything you submit.
• —Which versions of our Terms of service and this Privacy policy you accepted when you created the account, when you accepted them, and whether you signed up with an email address or with Google.

Sign-in with Google

If you sign in with Google, Google sends us your Google account ID, your email address and whether Google has verified it, together with the basic profile details its sign-in shares, such as your name. We store only the Google account ID and the email address, and update the email address each time you sign in with Google. We don’t store your name or other profile details.

Sessions and security records

• —For each sign-in: your browser’s user-agent string (which identifies the browser and operating system), the IP address the sign-in came from, when it started, when it was last used, and when it expires — 30 days after you signed in. The Security tab of your account lists your active sessions, with the device, IP address, and when each started and was last used.
• —The codes in the one-time links we email you to verify your address (valid for 24 hours), to reset your password (valid for 1 hour), and to change your email address: one to your current address to approve the change (valid for 24 hours) and one to the new address to confirm it (valid for 1 hour), with the new address stored until the change is made or the links expire. We store only a hash of each code.
• —A log of sign-in and account attempts, used to stop repeated attempts: the email address, IP address or account ID involved, the action, whether it succeeded, and when.

What you submit

• —Strategies: their names, specifications, and any plain-English descriptions you write.
• —Runs: the specification, plan, cost settings and description you ran with, any AI summary, and the full result — the scorecard and every simulated trade.
• —Saved settings: validation configurations (a name and your minimum sample sizes and profit factor) and cost profiles (a name, broker, account type, commission and spread settings).
• —Forward-test registrations: the strategy specification, symbols, timeframe, plan and status, and the trades recorded after you registered.
• —Custom indicators: the Python source code you submit, and details about it.
• —Charts: chart files built from your runs — price bars, indicator values and your trades.

Some things stay on your device. A trade CSV file you load to compare with a run is read in your browser and never uploaded; we keep only a summary of counts. Prop-challenge simulations are calculated when you ask and kept only temporarily in server memory; they aren’t saved to our databases.

Free-text fields hold whatever you type into them, so please don’t put personal information in them.

AI conversations

When you use an AI feature, we pass your messages, and the context the feature needs, to our AI provider to get an answer (see Who receives your data). We don’t save the conversations on our servers. If you apply an AI draft and run it, its description and summary become part of that run’s record.

Billing

• —If you buy a plan: which plan, its status, renewal, end and trial dates, whether it’s set to cancel, and the IDs [Payment provider] uses for you and your subscription.
• —The notifications [Payment provider] sends us about your purchases and subscription. We keep each one exactly as received. They can include your email address and account ID, and other purchase details that [Payment provider] chooses to send.
• —We never receive your full card number.

What we don’t collect

We don’t ask for your date of birth, identity documents or postal address. We don’t connect to your broker or trading accounts. We don’t use advertising or tracking tools, we don’t profile you, and we don’t collect your location beyond the IP address described above and the country our visit counter reports from it (see Analytics).

4. Why we use it, and our legal basis

Data-protection law requires a legal basis for each way we use your data. These are ours.

Providing the service

Creating and running your account, signing you in, running your tests, storing your strategies and results, and the AI features. Basis: performing our contract with you.

Emails about your account

Verifying your email address, resetting your password, and changing your email address (a request to approve the change, sent to your current address; a link to confirm it, sent to the new one; and a notice once it’s done) — the only emails we send. We don’t send marketing email. Basis: our contract with you.

Security and abuse prevention

Session records, IP addresses and browser details, and the attempt log — to protect accounts, stop repeated sign-in attempts, prevent fraud and abuse, and investigate problems. Basis: our legitimate interest in keeping the service and your account secure.

Payments and subscriptions

Starting checkout, keeping your plan in step with your subscription, and cancelling it if you delete your account. Basis: our contract with you and, where we are the seller, our legal obligation to keep tax and accounting records.

Keeping the research ledger intact

Keeping every trial record for as long as your account exists, so the multiple-testing accounting at the heart of the method can’t be undone by deleting results. Basis: our legitimate interest in the integrity of the method. When you delete your account the records are anonymised — see Deleting your account.

Improving the service

When you delete a strategy, noting why, if you choose to tell us, with facts about it: how many runs it had and their verdicts, how many failed, its asset class, timeframe and number of symbols, and how old it was. And when a run fails, noting the kind of error, with the same kind of facts. Both are stored without your account ID, without the strategy itself or anything you wrote, and with the date but not the time. Basis: our legitimate interest in finding what goes wrong and fixing it.

Answering you

Replying when you contact us, and handling requests about your data. Basis: our legitimate interest in helping you, and our legal obligations.

Legal duties and claims

Complying with the law and with lawful requests from authorities, and establishing or defending legal claims — including keeping the record of which Terms and Privacy policy versions you accepted for 6 years after you delete your account, in case a dispute about what was agreed comes up. Basis: legal obligation, or our legitimate interest in protecting our rights.

We don’t rely on your consent for anything today. If we ever ask for it, you’ll be able to withdraw it at any time.

To open an account you need to give us an email address and a password, or use Google; without them we can’t provide the service. Everything else you submit is up to you.

We don’t make decisions about you based only on automated processing that have legal or similarly significant effects on you. A verdict is an automated assessment of a strategy, not of you.

5. Who receives your data

We share personal data only with the service providers below, and only what each one needs.

Google — sign-in

Only if you choose Sign in with Google. Your browser goes to Google to sign in, and Google sends us the details listed above.

Google — Gemini API (AI features)

When you use an AI feature, we send Google your messages and the context that feature needs, listed below. A strategy specification includes the name you gave the strategy. We don’t send your name, email address, account ID or IP address; Google sees our server’s address, not yours.

• —Strategy drafting: your messages, the indicators you picked, the current strategy specification, and a list of your past trials of that strategy (trial number, symbol, and verdict or failing checks).
• —Scorecard questions: your messages and a summary of the run — its verdict, checks and the reasons behind them, your account’s total trial count, trade statistics, past trials, and the specification.
• —Indicator adaptation: the code or descriptions you paste, and the current draft.
• —Methodology check: the strategy specification.

Email delivery provider

Currently Resend. It receives your email address and the content of the verification or password-reset email.

Payment provider

[Payment provider]. When you check out, we send it your account email address and account ID, so the payment can be matched to your account. You give your payment details to it directly. We also ask it for your subscription details to open its billing portal, and to cancel your subscription if you delete your account.

Hosting provider

[Hosting provider and region]. It runs our servers, databases and file storage, so it holds all the data described on this page.

Analytics provider

Vercel, for the visit counter described under Analytics. It receives the page you viewed, where you came from, your country and your device type. It doesn’t receive your name, email address or account ID.

Authorities and advisers

Courts, regulators or law enforcement when the law requires it, and our professional advisers, such as lawyers and accountants, under a duty of confidentiality.

Market-data providers get nothing about you. When a run needs price data we don’t already hold, our servers request it with our own credentials and no identifier of yours.

We don’t use advertising or error-monitoring services.

6. International transfers

We’re established in the United Kingdom, so UK data protection law governs what we do. Some of these providers are based outside the UK, or may process data outside it — for example Google, Vercel and our email delivery provider, and possibly [Payment provider] and [Hosting provider and region]. When your data leaves the UK, or leaves the European Economic Area for customers there, we protect it with [Transfer safeguards].

You can ask for a copy of these safeguards at privacy@kurzharr.com.

7. How long we keep it

These are the periods the service applies today. Records kept for a set time are removed by a clean-up that runs every day.

Account, profile and Google link

Until you delete your account. Unlinking Google removes the Google link straight away.

Record of the terms you accepted

6 years after you delete your account, counted from the start of the month after the deletion. It holds your account ID, which versions you accepted, and when and how — not your email address.

Sign-in sessions

Until you sign out or end the session on the Security tab, until a password change or reset ends it, or until you delete your account. A session that has expired is removed, with its IP address and browser details, 30 days after it expired.

Email link codes

7 days after the link is used or expires, or sooner if you delete your account.

Attempt log

24 hours. When you delete your account, entries under your email address go at once; entries under an IP address or your account ID go at the next clean-up.

Strategies

Until you delete them. A deleted strategy goes to Recently deleted, where you can restore it for 30 days; then it’s removed. The inputs and results stored with its runs stay with your account, no longer linked to the strategy, because they count toward the Free plan’s monthly runs; once their calendar month is over, those that have finished are deleted, with their charts. Deleting a strategy never deletes its trial records or scorecards. You can’t delete a strategy while one of its forward tests is active: withdraw the test first. Deleting your account deletes every strategy, including those in Recently deleted.

Runs made without a saved strategy

The inputs and results stored with them stay until you delete your account. Their trial records and scorecards are part of the research ledger, below.

Signal previews

The sample-size and trade-file checks in the strategy builder store the strategy they previewed; they’re deleted 7 days after they ran.

Configurations and cost profiles

Until you delete them, or your account.

Trial records and scorecards

For as long as your account exists — this is the research ledger. When you delete your account they’re anonymised and kept in that form (see Deleting your account).

Custom-indicator code

Until you delete the indicator, from the lookup on the page where you admit one. Deleting it removes its current version, every earlier one, and the code kept with each submission under its name. Submitting the same indicator again replaces its current version, but until you delete it, each earlier version is kept too. Code submitted for an indicator that isn’t admitted is removed from its submission record 7 days after the check finished. You can’t delete an indicator while an active forward test uses it: withdraw the test first. Deleting your account deletes every indicator and every version.

Forward-test registrations

For as long as your account exists. You can withdraw a registration but not delete it. Deleting your account withdraws every active one, so none goes on recording trades, and anonymises all of them like your trial records.

Chart files

90 days after they were made, or sooner when the run they were built from is deleted. A chart is made again from its run the next time you open it. Deleting your account deletes the charts built from your runs; one we can’t remove at that moment still goes at 90 days.

Script-explainer records

When you paste a script into the explainer, we record facts about it and about what you did next — never the script itself — under a code that changes every month and can’t be traced back to you once that month’s key is destroyed. Each month’s key is destroyed by the daily clean-up within a day of the month ending. Kept 13 months. Deleting your account deletes the ones that can still be matched to it.

Deletion reasons and error records

Indefinitely. They hold no account ID, no strategy and nothing you wrote, and only the date (see Why we use it, and our legal basis).

Subscription record

Until you delete your account.

Payment notifications

13 months after they arrive, including after you delete your account. They contain your email address.

Server logs

Our servers write operational logs. They can include your account ID (inside run identifiers) and, when something fails, part of a response from Google or [Payment provider]. How long logs are kept depends on [Hosting provider and region].

8. Deleting your account

You can delete your account on the Security tab: choose Delete account, then type your email address to confirm. First we check that none of your runs or forward-test updates is still going; if one is, nothing changes and you can try again once it has finished. If a paid plan is still live, we then cancel its renewal with [Payment provider]. If we can’t, the deletion stops and you’re asked to cancel from the billing portal. Then we sign the account out everywhere and remove your data from the engine that runs your tests, as set out below; for the next few days the engine also refuses anything new under your old account ID. If that step fails, the deletion stops and you sign in again to retry; a renewal already cancelled stays cancelled.

What’s deleted straight away

• —Your account details: email address, password hash, display name and verification dates.
• —Your Google link, all your sessions (with their IP addresses and browser details), and your email-link codes.
• —Your subscription record, and the attempt-log entries under your email address.
• —Your saved work: strategies, including those in Recently deleted; the inputs and the copies of results stored with every run and preview (each run’s scorecard is kept, anonymised, below); validation configurations and cost profiles; and custom indicators with every version of their code.
• —The chart files built from your runs (one still being built at that moment goes at 90 days).
• —The script-explainer records that can still be matched to your account.
• —On the device you delete from, the settings the app saved in your browser.

What stays

• —The research records, anonymised: every trial record and stored scorecard, and your forward-test registrations, all withdrawn. They move to a new random ID, and we remove what could identify you or your strategy: the descriptions you wrote and their AI summaries, indicator names and any other text, the strategies you registered for forward tests, and each trade’s times and prices. Each strategy’s fingerprint is replaced with one that can’t be matched to the strategy, and every time is reduced to its day. What’s left is numbers and verdicts — the checks and their figures, the trial count and the deflated-Sharpe accounting, each forward trade’s result in R — and which instruments and timeframes were tested.
• —The record of which Terms and Privacy policy versions you accepted, for 6 years from the start of the month after the deletion: your account ID, the versions, and when and how you accepted them. Not your email address.
• —Payment notifications from [Payment provider], which contain your email address and account ID, until they’re 13 months old.
• —Deletion reasons and error records from your use of the service. They were never stored with your account ID.
• —A note that the account was deleted, for 3 days: a one-way hash of your account ID and the day, so nothing already under way can store anything under that ID. It can’t be turned back into the ID.
• —Attempt-log entries under your IP address or account ID, until the next clean-up, and server logs for as long as they’re kept.

Why we keep the ledger

Kurzharr’s method counts every trial an account runs, and each scorecard shows a deflated-Sharpe figure adjusted for that count. That’s what keeps a lucky result among many tries from looking like a real edge. For the count to mean anything, trials can’t be erased by deleting a strategy. Once the account itself is gone, its records count toward no one’s trials. We keep them, anonymised, as research records — which checks fail most often, and how often strategies pass.

Anonymised, not just renamed

The new ID is random and isn’t stored anywhere else, so it doesn’t lead back to your account, your email address or your payments; the run identifiers that contained your old ID are rewritten with the new one, forward tests get new identifiers, and no kept record carries the moment you deleted your account (a forward test still running then keeps its last dates only to the month). We remove your descriptions, the AI summaries, indicator names and each trade’s times and prices because those are what could identify you or your strategy. What’s left describes how a strategy performed, not who you are. If you want even these records erased, email privacy@kurzharr.com and we’ll assess your request.

Before you delete: to keep a copy of everything, download your data on the Security tab first.

9. Cookies and browser storage

We use only cookies that are strictly necessary to sign you in and keep sign-in secure. We don’t use advertising or tracking cookies, and no script on our pages sets a cookie we haven’t listed below. Our fonts are served from our own servers, so loading a page doesn’t contact Google Fonts. We do count visits, with a tool that sets no cookie at all — see Analytics.

Cookies we set

kurzhaar_session

Keeps you signed in. Lasts 30 days. Scripts on the page can’t read it, and in the live service it’s sent only over HTTPS.

google_oauth_state and google_oauth_verifier

Protect Sign in with Google against forged requests. Last 10 minutes.

google_oauth_next

Remembers which page to return you to after Sign in with Google. Lasts 10 minutes.

google_oauth_link

Marks that you’re connecting Google to an existing account. Lasts 10 minutes.

Browser storage

The app also saves a few things in your browser’s local storage, so it remembers your choices between visits. Unlike cookies, they aren’t sent to us with each request.

kurzhaar-user

Your account ID, email address and display name, so the app can show who’s signed in.

kurzhaar-validation-configs and kurzhaar-cost-profiles

Which saved validation configuration and cost profile you last selected.

kurzhaar-universe

The asset class, timeframe and date range you last picked.

kurzhaar-prop-challenge

Your prop-challenge preset, custom rules and risk percentage.

kurzhaar-equity-assumptions

The account size and risk percentage you entered for equity views.

kurzhaar-nav

Whether the sidebar is open.

Signing out clears your account ID, email address and display name from this storage. The other settings stay on that device until you delete your account from it, or clear your browser’s storage.

Analytics

We use Vercel Web Analytics to count visits and see which pages get used. It sets no cookie, doesn’t identify you and doesn’t follow you to other sites. We see aggregate figures only — page views, where visitors arrived from, country and device type — and we use them solely to decide what to improve. We don’t share them with anyone else, and we don’t use them for advertising.

You can tell us not to count this browser. The setting is stored on your device, so you’ll need to set it again on another browser, and clearing your browsing data clears it.

Don’t count my visitsChecking this browser’s setting…

The button needs JavaScript. If it doesn’t work for you, email privacy@kurzharr.com and say you don’t want to be counted — we’ll take you out of the figures either way.

10. Your rights

Under UK data protection law, you have the right to:

• —access your personal data and get a copy;
• —correct it if it’s wrong or incomplete;
• —erase it, in the cases the law provides;
• —restrict how we use it, in some cases;
• —take it with you in a machine-readable format (portability);
• —object to our using it on the basis of legitimate interests;
• —withdraw consent at any time, where we rely on it;
• —complain — to us first, as set out below, and to a data-protection authority at any point. Ours is the Information Commissioner’s Office (ICO); you can also go to the authority where you live or work.

To use any of these rights, email privacy@kurzharr.com. We’ll reply within one month. We may need to confirm it’s you first, usually by asking you to write from your account’s email address.

Complaining to us about your data

If you’re unhappy with how we’ve handled your personal data, tell us. Email privacy@kurzharr.com with “Data protection complaint” in the subject, or write to us at the address above. You don’t have to use any particular form of words, and you don’t have to have made a request first.

We’ll acknowledge your complaint within 30 days, look into it, and tell you what we’ve decided as soon as we can. If we need longer, we’ll tell you why and how long we expect to take.

If you’re still unhappy, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk, or on 0303 123 1113. We’d rather you came to us first, but you don’t have to.

What you can do yourself

• —See and end your active sessions, change your password or email address, download a copy of your data, and delete your account, on the Security tab. Changing your email address takes a link to your current address as well as one to the new address. The copy is one machine-readable file with everything listed under “What we collect” that we hold for your account.
• —Change your display name on the Profile tab.
• —Unlink Google from your account, as long as you still have another way to sign in.
• —Delete strategies, validation configurations, cost profiles and custom indicators, and withdraw forward-test registrations.

For anything else, email privacy@kurzharr.com and we’ll help.

11. How we protect your data

• —Passwords are stored only as salted scrypt hashes. Session tokens and email-link codes are stored only as hashes.
• —The session cookie can’t be read by scripts on the page, and in the live service it’s sent only over HTTPS.
• —Sign-in, sign-up, password resets and account deletion are rate-limited.
• —Sign in with Google uses state checks and PKCE to block forged sign-ins.
• —Every request for your account’s data is checked against your session, and our internal services authenticate each other with a secret key.

No system is perfectly secure, and we don’t offer two-factor authentication yet. If a breach puts your data at risk, we’ll tell you and the authorities where the law requires.

12. Children

Kurzharr isn’t for anyone under 18, and we don’t knowingly collect data from children. If you think a child has opened an account, contact privacy@kurzharr.com and we’ll delete the account.

13. Changes to this policy

We’ll publish any update here with a new effective date. If a change matters to you, we’ll also tell you by email or in the app before it takes effect.

14. Contact

Privacy questions and requests: privacy@kurzharr.com. By post: [Company legal name], [Registered address]. Supervisory authority: the Information Commissioner’s Office (ICO).