Privacy Policy

If you sign in with Google: your Google account identifier, email address, name and profile picture, nothing else from your Google account, and we never receive your Google password. If you sign in by email link: just the address. Usage events: which pages and companies were viewed, so we can understand what the product is used for. Visitors: instead of storing IP addresses we store a salted one-way hash, which counts distinct visitors and detects abuse but cannot be turned back into an address.

We do not sell or share your personal data with anyone. We run no advertising. Cookies: the one that keeps you signed in (essential) and one remembering your choice in the privacy dialog. Google Analytics loads only if you allowed analytics there; it then sets its own cookies (_ga) to count visits and pages, with IP addresses not stored by Google Analytics 4. The same choice loads Microsoft Clarity, which records how pages are used (clicks, scrolling, session replays; Clarity masks text by default) and sets its own cookies (_clck, _clsk). Without that choice neither loads. If you join the Pro list we keep that email address for the Pro announcement only, and delete it on request. Cloudflare Web Analytics counts page views on every visit without cookies and without storing personal data. We do not have, and never ask for, your brokerage credentials. Payments: a Pro subscription is paid through Stripe Checkout. Stripe receives your card and billing details under its own privacy policy; we store only your Stripe customer id, the subscription status and the renewal date.

Signing in can use Google. Sign-in emails are delivered by Resend. Price charts are provided by TradingView and load from their servers inside a frame, so TradingView receives the request for the chart. The site is served through Cloudflare and hosted with Hetzner in Germany (EU). Each of these has its own privacy policy.

Sign-in sessions expire after 30 days. Account records are kept until you ask us to delete them. Usage events are retained for up to 24 months.

You can ask us at any time to show you what we hold about you, correct it, or delete your account and its data. To delete your account, use the Delete my account button on your account page or email us; we delete your account data within 30 days, except billing records we must keep for tax purposes. Email the address below for anything else and we will act on it. If you are in the EU or UK, this is your right under the GDPR.

Traffic is encrypted in transit. Sign-in tokens are stored only as irreversible hashes, so a copy of our database would not let anyone into your account. We do not store passwords at all.

WaveMan is not directed at children under 16 and we do not knowingly collect their data.

If this policy changes materially we will update the date in the sidebar and, for registered users, say so in the product.