Who we are
Stake Trace (staketrace.in and api.staketrace.in) is operated by Done Right Private Limited, a company incorporated in India (“we”, “us”). We are the data fiduciary for the personal data described here under India’s Digital Personal Data Protection Act, 2023. Questions or requests go to support@staketrace.in.
The market data Stake Trace publishes, such as mutual fund holdings and stock prices, comes from public disclosures and is not personal data.
What we collect
Account details
You sign in with Google, Apple, GitHub, or X, or with an email and password on an existing account. From the sign-in provider we receive your name, email address and an account identifier. Accounts are managed in Amazon Cognito, and passwords are handled by Cognito, never by our own code. If you set a display name, we store it with your account. If you sign in with Apple, we store, encrypted, the token Apple issues to Stake Trace, so we can ask Apple to revoke our access when you delete your account.
API keys and AI app connections
When you create an API key, or connect an AI app such as Claude, Cursor or ChatGPT through OAuth, we issue a key for your account. We store only a salted hash of the key, a short prefix so you can recognise it, when it was created or revoked, and, for AI app connections, which app it was issued to. Keys issued through OAuth expire after 30 days, and the refresh tokens that renew them after 90 days. You can revoke a key at any time from your account.
Usage and Trace Credits
For each analysis you run through Stake Trace Chat, the MCP server or the API, we record which analysis it was, when it ran, which key or connected app made the call, and the Trace Credits it used. This is what your Activity Log and credit balance show. We use the stock, fund or sector you ask about to compute the answer. We do not save those arguments to your account history.
Things you save
We store the stocks and funds you add to your watchlist. When you are signed in, we store your Stake Trace Chat conversations so you can come back to them. If you use Chat without signing in, we process each message to answer it but do not save it; the conversation is kept only in your browser’s session storage. If you tell us which plan you are interested in, we store that choice and any note you add. If you add a WhatsApp number for alerts, we store that number with your account and use it only to tell you about new opportunities and moves in the stocks and funds you watch.
Stake Trace Chat answers are written by OpenAI, signed in or not, so your messages are sent to OpenAI as described under “Who we share it with”.
Reports about chat answers
If you report a Stake Trace Chat answer, on the website or in the app, we store the answer, the reason you pick, any note you add, the conversation and message it came from, the time, and your account ID if you are signed in. Our team gets a Slack notice with the reason, note and answer, but not your account ID or email address. We use reports only to review and correct answers.
Payments
Payments are processed by Razorpay. You enter card, UPI or bank details on Razorpay’s checkout, and we never receive or store them. We store the Razorpay order and payment IDs, the plan, amount, currency, status and payment time. We send Razorpay your Stake Trace account ID and the plan details with each order.
Messages to us
When you use the contact form we receive your name, email address and message, and deliver them to our team’s Slack workspace so we can reply. Emails you send to support@staketrace.in are kept in our mailbox.
Technical data
Like any web service, our hosting providers process your IP address, browser details and request times to serve pages and API calls, protect against abuse, and write error logs we use for troubleshooting.
Cookies and browser storage
We use only cookies that are needed to keep you signed in: session cookies holding your sign-in tokens (lasting up to 7 days and shared between www.staketrace.in and api.staketrace.in), and short-lived cookies that protect the sign-in handshake. We also keep a few small flags in your browser’s storage, for example whether you have dismissed a prompt about connecting an AI app.
The website does not use advertising cookies, third-party analytics or tracking pixels.
How we use your data
- To create your account, sign you in, and authenticate API and MCP calls.
- To run the analyses you ask for and meter them against your Trace Credits.
- To take payments, activate plans, and keep billing and tax records.
- To answer support requests and tell you about changes to your account or plan.
- To send the WhatsApp alerts you turn on.
- To review reports about chat answers and correct them.
- To keep the service secure, prevent abuse, and fix problems.
- To meet our legal obligations.
We do not sell your personal data, use it for advertising, or use it to train AI models. Internally, our team gets a Slack notification when someone signs up (their email address and sign-in method), buys a plan (their email address, the plan and the amount) or reports a chat answer (the reason, note and answer only).
AI apps you connect
When you connect Claude, Cursor, ChatGPT or another AI app to Stake Trace, that app sends us the analysis requests and we send the results back to it. What the AI app does with your conversation and our results is governed by its provider’s privacy policy, not this one. You can disconnect an app at any time by revoking its key in your account.
Where your data is stored
Sign-in accounts, API key records, the website and our API run on Amazon Web Services in Mumbai, India (ap-south-1). Our application database and the MCP server run on Neon, a managed Postgres service, on Amazon Web Services in Singapore (ap-southeast-1). Account-linked records such as usage, credits, billing records, watchlists, saved chats and reports about chat answers are stored there. OpenAI and Meta process the data we send them, described below, on their own systems, which may be outside India, including in the United States. This means some of your data is processed outside India, as the Digital Personal Data Protection Act allows.
Who we share it with
We share personal data only with the service providers that run Stake Trace for us:
- Amazon Web Services: hosting, sign-in (Amazon Cognito), API key storage, and email (Amazon SES), which receives your email address and the message to deliver account emails such as payment receipts and the account deletion confirmation.
- Neon: application database and MCP server hosting.
- OpenAI: writes Stake Trace Chat answers on the website and in the app. We send it your message, the earlier messages in that conversation and the Stake Trace results used to answer, but not your name, email address or account ID. Under its API terms OpenAI does not use this data to train its models, and it may keep it for up to 30 days. OpenAI also writes the short explanations on stock and fund cards from market data only, with no personal data.
- Meta (WhatsApp Cloud API): only if you turn on WhatsApp alerts. We send Meta your WhatsApp number and the text of each message, such as which stocks or funds moved, so it can deliver the alert to you on WhatsApp.
- Razorpay: payment processing.
- Google, Apple, GitHub or X: only the provider you choose to sign in with, which shares your name and email address with us.
- Slack: internal notifications, contact form messages and reports about chat answers.
We may also disclose data when Indian law, a court or a government authority requires it, or to protect our users, our rights or the service. If Stake Trace is sold or merged, your data would move with the business under this policy.
How long we keep it
- Account details, keys, usage history, watchlists, WhatsApp alert numbers and saved chats are kept while your account is open. When you delete your account yourself, they are deleted straight away. If you ask us by email instead, we delete or anonymise them within 30 days.
- Payment and invoice records are kept for up to 8 years, as Indian tax and company law requires, even after you close your account. Once the account is deleted they are no longer linked to it.
- Contact messages and support emails are kept as long as we need them to handle your request and any follow-up.
- Reports about chat answers sent while signed in are kept while your account is open and deleted with it. Reports sent without an account are kept as long as we need them to review and correct answers.
- Keys you revoke stop working within a few minutes. OAuth keys also expire on their own, as described above.
Deleting your account
You can delete your account yourself. In the app, go to Account and tap Delete account. On the website, go to Account, then Manage account, or open staketrace.in/delete-account. You confirm by typing DELETE. Deletion happens straight away and signs you out.
What is deleted
- Your sign-in account, name and email address.
- Your watchlist, saved chats, reports you sent about AI answers, and plan interest.
- Your WhatsApp alert number and alert settings.
- Your API keys and AI app connections. They stop working within a few minutes.
- Your usage history and Trace Credits.
- Stake Trace’s access to your Apple ID, if you signed in with Apple.
What we keep, and why
- Payment records (Razorpay order and payment IDs, plan, amount, status and date) for up to 8 years, as Indian tax and company law requires. They are no longer linked to your account.
- Razorpay’s own record of your payments, which Razorpay keeps under its privacy policy.
- Records of revoked API keys: a salted hash, a short prefix, dates and the deleted account’s ID. They cannot be used.
- Emails and messages already sent to you or to our team, and service logs until they expire.
Unused Trace Credits and any time left on a paid plan lapse when the account is deleted. Payments are non-refundable, except where the law requires a refund or we charged you in error. If you think a charge is wrong, email support@staketrace.in within 7 days of payment.
If you cannot sign in, email support@staketrace.in from the address on your account and we will delete it for you.
Your rights
Under the Digital Personal Data Protection Act, 2023 you can ask us to:
- give you a summary of the personal data we hold about you and how we use it;
- correct, complete or update it;
- delete it, and close your account;
- withdraw consent you have given, which may mean we can no longer provide the service;
- nominate someone to exercise these rights for you if you die or become unable to.
Email support@staketrace.in from the address on your account. We may ask you to confirm your identity, and we aim to reply within 30 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India.
Security
All traffic is encrypted with HTTPS. API keys are stored only as salted hashes, session cookies cannot be read by page scripts, and access to production systems is restricted to our team. No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board of India as the law requires.
Children
Stake Trace is intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, contact us and we will delete it.
Changes to this policy
We will update this page when our practices change, and change the date at the top. If a change materially affects how we use your personal data, we will tell you by email or on the website before it takes effect.
Contact
Done Right Private Limited, operator of Stake Trace. Email support@staketrace.in, or use the contact form.