Privacy Policy

01Who we are

This Privacy Policy explains how Crimson Algo (“Crimson Algo”, “we”, “us”) handles personal data when you visit crimsonalgo.com, create an account, use the member area (including the Trading Journal, Economic News, Risk Calculator and Crimson Tools), buy or claim digital products, or connect Discord or Telegram.

Crimson Algo is the data controller for the personal data described here. Crimson Algo is a global platform. We process personal data in accordance with the data protection laws that apply to us and to you, including Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and, where they apply to members in the European Economic Area or the United Kingdom, the EU and UK General Data Protection Regulation (“GDPR”). This policy is written to meet the strictest of these standards.

You can reach us about privacy matters through the channels on our contact page.

02Personal data we collect

Information you give us

• Account details: full name, email address, country, and password (stored by our authentication provider as a one-way hash — we never see it in plain text).
• Broker membership details: your ConnextFX client ID (CID), if you choose to submit it to verify membership benefits.
• Purchase and payment records: the product, amount, currency, payment method, order reference and status, and the payment slip image you upload as proof of a transfer. A slip may show your name, bank, partial account number, and the date and time of the transfer.
• Product claim details: for example your TradingView username, when you claim access to an indicator delivered through TradingView.
• Trading Journal content: trading accounts, trades, prices, times, notes, tags, rules, plans and outcomes, weekly reviews, reminder preferences, imported trade history files, and evidence images (such as chart screenshots) that you upload.
• Messages you send us through our contact channels (LINE, Telegram, social media).
• Website chat: the messages you exchange with our chat assistant on crimsonalgo.com, the page you were on when you sent each message, and any contact details you choose to share (such as a phone number) so our team can follow up. See Website chat.

Information from connected services

• Discord: when you connect Discord we receive your Discord user ID and username (OAuth “identify” scope). If you ask us to add you to our server we also use the “guilds.join” permission, and we keep a record of the roles and nickname we assign and of role-sync results.
• Telegram: when you connect Telegram we receive your Telegram user ID and username, and we keep records of Signals group invitations, access dates, trial use, and removals.
• ConnextFX (our partner broker): we receive partner reports from ConnextFX that list client IDs with associated level, deposit totals and traded volume. We match these to the CID you submitted to determine eligibility for benefits such as Discord roles and Telegram Signals access.

Information collected automatically

• Session and security data: authentication tokens in cookies, sign-in timestamps, and technical data our hosting and database providers record in server logs (such as IP address, browser user agent and request time).
• In-product usage events: limited Trading Journal events tied to your account (for example opening the journal, saving a trade, or completing a weekly review), used to run reminders and plan limits.
• Optional analytics: only if you accept the analytics consent banner — see Cookies and analytics.

We do not ask for government ID numbers, and we do not ask for card numbers or online-banking credentials.

03How we use data and our lawful bases

We do not sell personal data, and we do not use it for third-party advertising. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects; eligibility checks against broker reports follow published rules and can be reviewed on request.

If you do not provide data marked as required (such as your email address), we cannot create your account or deliver the related service.

04Service providers and other recipients

We share personal data only as needed with the following providers, who process it on our behalf under their own security and data protection terms:

• Supabase — database, authentication and file storage (including journal evidence and payment slips). Our project is hosted in the Seoul, South Korea region.
• Vercel — website hosting and server functions, running in the Seoul, South Korea region, with a global content-delivery network.
• Resend — delivery of account and transactional emails (your email address and the email content).
• Our chat assistant service — runs the website chat and LINE assistant, stores chat conversations, and uses an AI model provider to generate replies. It receives your messages, the page you were on, the random chat visitor ID, and, if you are signed in, your account ID, display name, and whether your CID is verified and Journal Plus is active.

The following services receive data when you choose to use them and act as independent controllers under their own privacy policies:

• Discord and Telegram — when you connect your account or join our server or group.
• TradingView — our market ticker widget loads from TradingView, which may receive your IP address and browser data; and if you claim an indicator, we use your TradingView username to grant access.
• ConnextFX — our partner broker, which provides partner reports to us. Your relationship with ConnextFX is governed by its own terms and privacy policy.

We also retrieve public market data (for example historical prices from OANDA and official economic calendars) to power charts and news. These requests do not include your personal data.

We may disclose data to professional advisers, to a successor if the business is transferred, or where required by law.

05International transfers

Our primary database and hosting are located in South Korea, and some providers (such as our email provider and content-delivery network) may process data in other countries, including the United States. Where we transfer personal data across borders, we do so as permitted by applicable data protection law — for example where it is necessary to perform our contract with you, or where the provider has appropriate safeguards in place, such as contractual data protection commitments.

06How long we keep data

• Account and journal data: for as long as your account is active. When you delete your account, we delete or anonymise it, except for records we must keep as described below.
• Journal evidence images: Free accounts include 250 MB of evidence storage and Journal Plus includes 1 GB. If Plus ends and your evidence exceeds the Free limit, you have a 30-day grace period to export, reduce or restore; after that the oldest evidence above the limit is removed automatically.
• Payment orders, slips and receipts: for as long as needed to provide access, handle disputes and refunds, and meet accounting and tax record-keeping requirements, which can be up to 10 years.
• Security and audit logs (such as Discord role-sync and payment review events): for as long as reasonably needed for security, fraud prevention and dispute resolution.
• Website chat conversations: for as long as needed to answer your questions and follow up on your requests. You can ask us to delete a conversation at any time.
• Optional analytics data: only while it remains useful for improving the product, and no longer than your account (or, for visitors, for a limited period).

07Security

We protect personal data with measures appropriate to the risk, including encrypted connections (HTTPS), hashed passwords, screening new passwords against known data breaches (using Have I Been Pwned’s anonymous range check, which receives only a short fragment of a password hash, never the password), row-level access controls in our database so members can access only their own records, private storage buckets for slips and evidence, restricted administrator access, and audit records for sensitive actions. No system is completely secure; if a personal data breach is likely to put your rights at risk, we will notify the authorities and you as required by the PDPA.

Please keep your password confidential and contact us immediately if you suspect unauthorised use of your account.

08Your rights and how to exercise them

Depending on the law that applies to you, you have the right to:

• access and obtain a copy of your personal data, and ask how we obtained data you did not give us;
• receive your data in a structured, machine-readable format and have it transferred to another controller (data portability);
• correct inaccurate or incomplete data;
• request deletion, destruction or anonymisation of your data;
• request restriction of processing;
• object to processing based on legitimate interests;
• withdraw consent at any time, without affecting processing before the withdrawal; and
• lodge a complaint with the data protection authority in the country where you live or work, or with the Office of the Personal Data Protection Committee (PDPC) of Thailand.

Self-service tools

• Download my data: in your Account area you can download a full export of your account data as a JSON file. You can also export your Trading Journal separately.
• Delete account: in your Account area you can permanently delete your account. This removes your profile, journal content and evidence, and connections, and ends any active access. Records we must keep by law (such as payment records) are retained for the required period.
• To correct your account details or CID, or to disconnect Discord or Telegram, contact us and we will help.

For any other request, contact us through one of the channels on our contact page. We may need to verify your identity, normally by asking you to confirm the request from your signed-in account or the email address on file. We will respond within 30 days, and tell you if we cannot fulfil a request and why (for example, where we must keep data by law).

09Cookies and analytics

Essential cookies and storage (always on)

These are strictly necessary for the site to work and cannot be turned off:

• Authentication session cookies set by Supabase to keep you signed in securely.
• Remember-me preference (crimson_remember) — records whether your session should last for one browser session or up to 30 days.
• Onboarding and connection state — short-lived values that protect the sign-up flow and the Discord/Telegram connection process (OAuth state) against forgery.
• Chat referral (crimson_ref) — a short code from our chat assistant, kept for 30 days, so that a purchase made after a LINE or website chat is credited to that conversation. It is set when you open a link our assistant sent you or chat with it on this site.
• Chat visitor ID (crimson_chat_visitor) — a random ID kept in your browser’s local storage when you open the website chat, so your conversation is still there when you come back. Clearing your browser storage starts a new conversation.
• Some features store small preferences in your browser’s local storage (for example dismissed reminders or calculator settings). These stay on your device.

Optional analytics (only with your consent)

When you first visit, a banner asks whether you accept analytics. If you accept, we collect first-party, privacy-friendly product analytics — such as pages viewed and features used — and store them in our own Supabase database, linked to a random visitor ID kept in your browser’s local storage (and to your account if you are signed in). Analytics data is kept for up to 24 months. We do not use third-party advertising or cross-site tracking cookies. If you decline, no analytics are collected. You can change your choice at any time with the “Cookie settings” link in the site footer; withdrawing consent stops collection and removes the visitor ID from your browser.

Third-party embeds, such as the TradingView market ticker, may set their own cookies under their own policies.

10Website chat

The chat button on our website connects you with our chat assistant, which answers questions about Crimson Algo products and trading tools. Replies are generated automatically by an AI model, so they may contain mistakes and are not financial advice. A member of our team may read a conversation and reply in person, for example when you ask to be contacted.

Anyone can use the chat without signing in. If you are signed in, we pass your account ID, display name, and whether your CID is verified and Journal Plus is active to the assistant so it can answer accurately; we never pass your email address, password or payment details. Please do not share passwords, card numbers or other sensitive information in the chat.

11Children

Crimson Algo is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, please contact us and we will delete it.

12Changes to this policy

We may update this policy as our services or legal requirements change. We will post the updated version on this page with a new effective date and, for material changes, notify members by email or in the Account area before the change takes effect where practicable.

13Contact

For privacy questions or to exercise your rights, contact Crimson Algo through the channels listed on our contact page (LINE Official Account, Telegram, Facebook, Instagram, TikTok or YouTube). Please mention “Privacy request” so we can route it correctly.