Legal & policies

TMR Terminal — The Market Revelation

This notice explains what personal data The Market Revelation ("we", "us"), based in India, processes when you use TMR Terminal (the desktop app and the trading workstation it opens), why, how long we keep it, and the rights you have. We decide why and how this data is processed, so we are its Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and its controller under the EU and UK General Data Protection Regulation ("GDPR") and similar laws. Our general Privacy Policy covers the rest of our website and services; where the two differ on TMR Terminal, this notice applies.

The short version

• To run your licence we receive your account details, a hashed identifier for each computer you use, the computer's name, operating system, app version, and the IP address it connects from.
• If you connect a broker or a data source, we hold the access it gives us encrypted, use it only for your own account, and delete it when you disconnect. Passwords, PINs and one-time codes used only to sign in are not kept.
• Layouts, drawings, watchlists, alerts, personal scripts, templates and most settings stay on your computer.
• There is no advertising, no third-party analytics or tracking in TMR Terminal, and we do not sell or rent personal data.

1. What we collect and why

Account. Email address, name, password hash (never the password), Discord ID, username and avatar if you sign in with Discord. Used for: sign-in, support, contacting you about your account.

Licence. Whether you hold a licence, its seats, start and end dates, and notes made by our team. Used for: deciding whether you may use the Software and on how many computers.

Device. A device identifier made on your computer from hardware identifiers (such as the machine ID, motherboard and disk serial numbers and network adapter address), each turned into a one-way hash before it leaves your computer; the computer name; operating system and version; app version; when it was first and last seen. Used for: binding seats to computers, detecting shared or misused licences, support.

Connection. The IP address your computer connects from, as seen by our network provider, and a history of when and from where the app was used. Used for: security, fraud and abuse prevention, support.

Broker connections. The broker, a label you give, environment (live or practice), the access token or API key the broker issues, your safety settings such as a maximum order size, and recent errors. Used for: sending the orders you instruct and showing your accounts, positions and orders.

Data-source connections. The provider, its access token or key, status and expiry, and a log of connect, refresh, use and disconnect events (never the secret itself). Used for: showing market data you are entitled to, with your own credentials.

Orders and trading data. Orders you send, and the account, position, order, fill and balance information your broker returns. Used for: placing, showing and managing your orders, and your journal.

Paper accounts. Simulated balance, orders, positions and fills. Used for: running the practice account you choose to use.

Journal. Trades, notes, tags and attachments you add. Used for: your own review of your trading.

Published content. Scripts and versions you publish, their covers, access grants and requests, stars and use counts, your trader profile (bio and links you choose to add), follows and chart snapshots. Used for: running the script library and community features you choose to use.

Support and communications. Messages you send us and our replies. Used for: helping you and keeping a record of what was agreed.

We do not ask for, and you should not give us, sensitive information such as health data, religious beliefs, biometric data, government identity numbers or bank account numbers.

2. What stays on your computer

Unless you choose to publish or share it, the following is stored only on your computer and is not sent to us: layouts, tabs and watchlists; drawings and templates; chart and indicator settings; price alerts and the alert log; personal Pine scripts; imported data files; the replay account; app settings; non-secret sign-in fields you ask the app to remember (such as a server or username, never a password); a proxy password you save, which is encrypted with Windows-protected storage; a NinjaTrader password you ask the setup helper to remember, which is encrypted for your Windows user only; cached market history; and application logs.

Uninstalling the app does not delete this data, so that a reinstall keeps your work. You can delete it from the app's settings (reset) or by removing the app's data folder.

3. Legal basis

• India (DPDP Act). We process your data on the basis of the consent you give when you accept this notice and use TMR Terminal, and for the legitimate uses the DPDP Act allows, such as where you voluntarily provide data for a specified purpose, and compliance with law and court orders. You may withdraw consent at any time (see section 9); doing so does not affect processing already done, but we will no longer be able to provide the parts of the service that depend on it.
• EU, UK and similar laws (GDPR). We rely on performance of our contract with you (account, licence, broker and data connections, orders, journal, paper accounts), our legitimate interests in securing our services and preventing fraud and licence abuse (device and connection data), compliance with legal obligations (tax, accounting, responding to authorities), and your consent where we ask for it.

4. Who we share it with

• Brokers and data providers you connect. We send your instructions and credentials to them, and they send us your account and market data. They process that data under their own privacy policies.
• Service providers who act on our instructions: our hosting provider, Cloudflare (network delivery and protection), Discord (only if you sign in with Discord), Razorpay (payments, if you pay us), and Resend (account email).
• Other users, only for what you choose to publish: public or invite-only scripts, your trader profile, follows, and snapshot links (visible to anyone who has the link).
• Authorities, where the law requires it, or to protect the rights, property or safety of our users, the public or us.
• A successor, if our business is reorganised, merged or sold, subject to this notice.

We do not sell, rent or trade personal data, and we do not share it for targeted advertising.

5. Third-party content and requests

Some features load content from third parties, such as exchanges and data vendors, news feeds, economic calendars and educational videos. Where we can, these are fetched by our servers rather than by your computer, so that the third party does not learn which symbols you watch. Crypto exchange market data may be fetched by the app directly from the exchange, which then sees your IP address. Links that open in your browser take you to sites that have their own privacy policies.

6. International transfers

We are based in India. Our servers and providers may process data in countries other than yours, including outside India and outside the European Economic Area and United Kingdom. Where the law requires it, we use appropriate safeguards for those transfers, such as standard contractual clauses, and we do not transfer data to any country the Government of India has restricted.

7. How long we keep it

• Account data: while your account is open and for up to 12 months after it closes.
• Licence, device and connection history: while your licence is active and for up to 12 months after it ends or the seat is released, so that we can investigate abuse and answer support questions; records of a blocked computer are kept while the block lasts.
• Broker and data-source credentials: until you disconnect, or your account is deleted, whichever is first; the event log without secrets is kept for up to 12 months.
• Paper accounts and their orders: until you delete them or your account.
• Journal entries and published content: until you delete them or your account.
• Chart snapshots: 180 days.
• Records we must keep by law (for example tax, accounting and records relating to a legal claim): for the period the law requires.

When a period ends, we delete or anonymise the data. If you have not used TMR Terminal or our website for an extended period and the purpose for keeping your data has ended, we may delete it after notifying you at least 48 hours in advance, as the DPDP rules require.

8. Security

We use technical and organisational measures appropriate to the data: encrypted connections; encryption of broker and data-source credentials at rest; hashed passwords and device identifiers; signed licences and signed app updates; access to production systems limited to people who need it; and logs to detect misuse. Our Security and Responsible Disclosure page describes how to report a vulnerability. No system is perfectly secure, and we cannot guarantee it. If a personal data breach occurs, we will notify affected users and the authorities as the law requires, including the Data Protection Board of India and CERT-In.

9. Your rights

Depending on where you live, you have some or all of these rights:

• access a summary of your personal data we process and how, and the identities of those we have shared it with;
• correct, complete or update inaccurate or incomplete data;
• erase your data, where we no longer need it for the purpose it was collected or for a legal obligation;
• withdraw consent, as easily as you gave it;
• object to or restrict processing based on our legitimate interests (GDPR);
• receive a copy of data you provided in a portable format (GDPR);
• nominate another person to exercise your rights if you die or become incapable (DPDP Act);
• grievance redressal, and to complain to a supervisory authority: in India, the Data Protection Board of India after first raising it with us; in the EU or UK, your local data protection authority;
• if you live in California or another U.S. state with a privacy law: to know, delete and correct your data, and not to be discriminated against for exercising these rights. We do not sell or share personal data as those laws define it, and do not use sensitive personal information to infer characteristics about you.

To exercise any right, email [email protected] with the subject "Privacy request" from the email address on your account, or open a support ticket in our Discord server. We may ask you to confirm your identity. We respond within the time the law requires, and in any case within 30 days. You can disconnect brokers and data sources, delete paper accounts, journal entries and published scripts yourself in the Software at any time. Deleting your account releases its seats and ends your licence.

10. Children

TMR Terminal is for adults. It is not intended for anyone under 18, and we do not knowingly process their data. If you believe a child has given us personal data, contact us and we will delete it.

11. Language

This notice is written in English. If you are in India, you may ask us for it in any language listed in the Eighth Schedule to the Constitution of India.

12. Changes

We may update this notice. The version and date at the top tell you which version applies. If a change materially affects how we use your data, we will tell you in the Software, by email or on our website before it takes effect, and ask for your consent again where the law requires.

13. Contact and grievances

The Market Revelation. Email [email protected], or open a support ticket in our Discord server (discord.gg/akz3bTgnx7). Questions and complaints about your personal data go to our Grievance Officer, as set out in our Grievance Redressal policy.