Privacy Policy

Last updated: 10 November 2026

This policy explains how Charting Wizards Private Limited collects and uses personal data in Spellbook – The Wizard’s Journal, in line with India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

What we collect

• Account details: name, email address, password (stored encrypted by our login provider; we can't see it), batch or promo code, who invited you (if you used a referral link), your preferences, and your 2-step verification setting.
• Your journal: trades, notes, tags, daily journal entries, chart screenshots, playbook, risk settings, starting capital and broker account names / client IDs you enter.
• Subscription details: plan, payment status and subscription IDs from Razorpay or Stripe. We never receive or store card, UPI or bank details. Payments are handled by Razorpay and Stripe.
• Broker connections (if you use them): a temporary access session from the broker, used only to read your executed trades. It expires automatically. We never receive your broker password or PIN.
• Basic technical data: login times and error logs needed to run and secure the service.

Why we use it

• To provide the Journal: store your trades and show statistics, reports and coaching.
• To let your Charting Wizards mentor review your trades and reply to you.
• To manage your subscription, send sign-in and account emails, and give support.
• To keep the service secure and fix problems.

We do not sell your data or use it for advertising.

Who can see it

• You. Other members cannot see your journal.
• Your Charting Wizards mentor, for review and feedback, only if you choose to share. You decide when you sign up and can change it anytime in Settings → Mentor access. When your journal is private, your mentor sees only your name, email and plan.
• Service providers that run the Journal for us under contract: Supabase (database and login, hosted in Mumbai, India), Netlify (website hosting), Google Workspace (email), Razorpay and Stripe (payments), Cloudflare (bot protection on sign-in), an email delivery service (alerts and weekly debriefs, if you keep emails on), and Anthropic (summary statistics of your trades, never your name or email, are sent to write AI answers and weekly debriefs). To show prices, only stock symbols are sent to a market-data provider, never anything about you. Supabase stores your journal in India. Some of these providers (Anthropic, Netlify, Cloudflare, Google and the email service) may process the limited data they receive outside India, under their own security and confidentiality commitments.
• Other members see only your first name, initial and discipline score, and only if you join the leaderboard.
• Authorities, only where the law requires it.

How long we keep it

While your access is active, we keep your journal. If your access ends, your journal data and screenshots are kept for 6 months so you can resume, then permanently deleted. Payment records are kept as long as tax law requires. Security logs (sign-ins, errors and admin actions) are kept for 1 year to detect and investigate misuse, as Indian law requires, then deleted.

Your rights

• Download all your data anytime (Settings → Security & your data → Download all my data).
• Correct your details in Settings.
• Delete your account and all your data yourself (Settings → Security & your data → Delete my account), or ask us by emailing contact@chartingwizardsindia.com. We'll respond within 30 days.
• See when your mentor opened your journal (Settings).
• Withdraw consent at any time. This may mean we can't keep providing the Journal to you.
• Nominate someone to exercise these rights for you if you die or become unable to, by emailing us.
• If you're not satisfied with how we handle a complaint, you can complain to the Data Protection Board of India.

Security

Data is sent over HTTPS. Each member's data is protected by database-level access rules, so members can only read their own journal. The mentor account can open shared journals only after signing in with 2-step verification, and members can turn on 2-step verification too. Broker sessions are encrypted, stored where members can't read them, and expire automatically. Passwords are stored scrambled by our login provider and can't be read by anyone, including us. We never receive card, UPI or bank details. Our admin accounts use 2-step verification, the database is backed up regularly, and we review access and security settings regularly. No online service can be completely secure, but we work to protect your data and to act fast if something goes wrong.

If there's a data breach

If we find that your personal data has been accessed or disclosed without permission, we will tell you without delay by email and in the Journal. We'll say what happened, what data was involved, what we've done and what you should do. We will also report it to CERT-In and the Data Protection Board of India as the law requires.

Cookies and storage

The Journal uses your browser's storage to keep you signed in and remember settings such as light/dark mode. We don't use advertising or tracking cookies.

Children

The Journal is for adults aged 18 and over.

Grievance officer

For any privacy concern or complaint, contact our Grievance Officer at contact@chartingwizardsindia.com, phone +91 95669 85202, or write to Charting Wizards Private Limited, 52 Kamaraj Street, Karugambathur, Vellore 632013, Tamil Nadu, India. We'll acknowledge it within 48 hours and resolve it within 30 days.

Changes

We'll post any changes to this policy here and tell you in the Journal about important ones.