What the account holds
Creating an account stores exactly this, and nothing else:
- Your name and email address, as you entered them at sign-up.
- A scrypt hash of your password with a per-account salt. The password itself is never stored and cannot be recovered from the hash.
- Which plan you are on, when the account was created, and when the free trial started.
- The date your paid access runs until, and the identifier of the last payment credited to the account.
- Whether your email address has been verified, and the single-use token in the current verification link.
We do not ask for your date of birth, your PAN, your demat details, your portfolio or your phone number, and there is nowhere in the product to enter them. We do not store card numbers or UPI identifiers — see Payments below.
What your browser keeps
Some of the product runs entirely on your own device. The items marked as never leaving your browser are exactly that: they are not copied to our servers, so we cannot read them and cannot restore them if you clear your browser.
| Name | Where | What it is for |
|---|---|---|
| stockers_session | Cookie | Keeps you signed in so the server can recognise your account. Cleared when you sign out. |
| stockers-auth | Local storage | The same session token, held so a page reload does not sign you out. |
| stockers-theme | Local storage | Whether you chose the light or dark appearance. |
| stockers-watchlist | Local storage | The tickers on your watchlist. This never leaves your browser. |
| stockers-intel-bookmarks | Local storage | Research answers you saved. This never leaves your browser. |
| stockers-sidebar-collapsed | Local storage | Whether you left the dashboard sidebar open or collapsed. |
The one cookie we set is the session cookie, and it exists so the server can tell it is you. It is not used for tracking, and there are no cookies from anyone else. Because we set no advertising or analytics cookies, there is no consent banner to click through.
Payments
Card, UPI and netbanking details are entered on Razorpay's own checkout, hosted by Razorpay. Those details never reach our servers and we could not store them if we wanted to. What we receive back is a payment identifier, the amount, and whether it succeeded — that is what the account record's last payment field holds.
Razorpay handles that data under its own privacy policy, as the payment processor.
Who else sees anything
Three services process data on our behalf. Each is named, along with precisely what reaches it.
| Service | Role | What it receives |
|---|---|---|
| Razorpay | Payment gateway | Your name, email address and payment instrument. Card and UPI details are entered on Razorpay's own checkout and never reach our servers — we receive only a payment identifier and whether it succeeded. |
| Resend | Transactional email | Your name and email address, to send the address-verification message and account notices. No marketing mail is sent through it. |
| OpenRouter | AI model gateway | The already-measured market figures a board has rendered, and the question you typed into a research or comparison tool. Your name, email and account identifiers are never included in a model request. |
The AI row is worth reading twice. When a board asks the model to write a summary, what is sent is the figures already on your screen and the question being asked — never your name, your email, your account identifier or anything about who is looking. The model is given numbers and asked to describe them.
Where the market data comes from
Market data flows the other way: we fetch it, and these sources learn nothing about you. Requests to them are made by our servers, not by your browser, so your IP address is not exposed to them.
| Source | What we take from it |
|---|---|
| BSE India | The scrip master, the daily Bhavcopy and sector classifications. |
| NSE India | Sectoral indices, most-traded lists, corporate announcements, dividends and the IPO calendar. |
| Yahoo Finance | Live and historical quotes for the tracked universe. |
| Google News | Headlines from Indian financial publishers, linked back to the publisher. |
Company logos are the exception: those images load directly in your browser from a logo host, which means that host sees your IP address as it would for any image on any website. No identifying information is attached to those requests.
How long it is kept
- Your account record is kept while the account exists, and deleted when you ask us to delete it.
- Payment identifiers are kept for as long as tax and accounting rules require us to be able to evidence a transaction, which is longer than the account itself may last.
- Email verification tokens are single-use and are cleared the moment they are spent.
- Anything stored in your browser is kept until you clear it. We have no copy and no way to expire it for you.
How it is protected
- Passwords are hashed with scrypt and a per-account random salt. We cannot read your password, and a stolen database would not reveal it.
- Session tokens are signed, so one cannot be forged from an account id, and are compared in constant time.
- Administrative access is checked on the server for every request, not merely hidden in the interface.
No system is perfectly secure. If we discover a breach affecting your data we will tell you and the relevant authority, and we will tell you what was exposed rather than that “an incident occurred”.
Your rights
Write to privacy@stockers.ai from the address on the account and we will act on any of these:
- A copy of everything we hold about you, in a readable format.
- Correction of anything inaccurate — your name or email address, for instance.
- Deletion of your account and its record. We will tell you what, if anything, we must keep for tax purposes and why.
- Withdrawal of consent, which in practice means closing the account, since the only data we hold is what the account needs to work.
We respond within 30 days. These rights sit alongside the Digital Personal Data Protection Act, 2023 and do not replace anything it gives you.
Children
The service is not intended for anyone under 18, and we do not knowingly hold data about a child. If you believe we do, write to privacy@stockers.ai and we will delete it.
Changes, and how to complain
If this policy changes in a way that affects what we collect or who sees it, we will say so on this page and update the date at the top. Continuing to use the service after that means accepting the revised policy.
Complaints go to our grievance officer, [Grievance Officer name], at grievance@stockers.ai, acknowledged within 2 working days. What the service does and does not claim about markets is set out in the Disclaimer.
[Registered legal entity name], [Registered address, city, state, PIN]. [CIN / GSTIN].