Privacy policy

Last updated: 21 October 2026

This is an English translation for your convenience. The German version (switch the language to DE) is legally binding.

1. Controller

The controller responsible for processing data on this website (chartswipes.com), in the “Chart Swipes” web app and in the “Chart Swipes” Chrome extension within the meaning of the General Data Protection Regulation (GDPR) is:

[Vor- und Nachname / Name and surname]
[Straße und Hausnummer / Street and number]
[PLZ und Ort / Postcode and city], Deutschland
E-Mail: [E-Mail-Adresse / email address]

For any questions about data protection or to exercise your rights, contact us at the email address above. No data protection officer has been appointed, as there is no legal obligation to do so.

2. Overview

Chart Swipes is a tool for going through (“swiping”) and rating stock charts from your watchlists. We only process personal data where this is necessary to run the website, provide its features and improve the service. We do not sell data, show ads or send newsletters.

You can use Chart Swipes without an account. Your watchlists and ratings are then stored only in your browser (see section 9).

3. Legal bases

• Art. 6(1)(b) GDPR – performance of a contract or pre-contractual steps (providing your account and the app’s features),
• Art. 6(1)(f) GDPR – legitimate interests (secure and stable operation, audience measurement, improving the service),
• Art. 6(1)(c) GDPR – legal obligations,
• Section 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act) for storing and reading information on your device where strictly necessary for features you request.

4. Hosting and delivery (Cloudflare)

The website and its server functions run on Cloudflare. When you visit, Cloudflare processes technically necessary connection data, in particular your IP address, date and time, the address requested, and browser and device information. Cloudflare derives the country you are connecting from; we only use this country code (e.g. “DE”) to preselect the language and for our own usage statistics (section 7). We do not store the IP address itself.

Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses are also in place. Legal basis: Art. 6(1)(f) GDPR (secure and fast delivery of the website).

5. User account, sign-in and database (Supabase)

If you create an account, we sign you in by email with a one-time sign-in link. We process your email address, an internal user ID, the times you registered and signed in, and technical sign-in logs (including IP address) that the provider keeps to secure the sign-in process.

When you are signed in, we also store the content you create in the app:

• watchlists and the stocks in them,
• swipe rounds and your ratings (good/bad, favourite, marked for deletion),
• notes and price alerts on stocks,
• stocks you follow and the news found for them,
• your chart indicator settings.

This data is stored in a database run by Supabase on servers in the EU (Ireland). The legal basis is Art. 6(1)(b) GDPR. The data is kept until you ask us to delete your account (an informal message to the email address in section 1 is enough). Deleting the account deletes all of its content.

Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992. Data is processed on servers in Ireland (EU). A data processing agreement under Art. 28 GDPR is in place; standard contractual clauses cover any access from third countries.

6. Sending sign-in emails (Brevo)

We send sign-in links and other emails about your account (e.g. confirmation, password reset) through the email service Brevo. This involves your email address, the content of the email and sending/delivery information. The legal basis is Art. 6(1)(b) GDPR. We do not send marketing emails.

Sendinblue SAS (Brevo), 106 boulevard Haussmann, 75008 Paris, France. A data processing agreement under Art. 28 GDPR is in place.

7. Our own usage statistics

To understand how Chart Swipes is used and to improve it, we record usage events in our own database (Supabase, see section 5) – for example page views, session start and end, swipes, searches (including the search term entered), creating watchlists, CSV imports, alerts and notes set, language settings and changed chart settings. For each event we store the time, a random session ID (valid only for the current browser tab), the country code (see section 4), the stock symbols involved and – if you are signed in – your user ID. Free text you type (such as watchlist names or note text) is not recorded. We do not store IP addresses.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is analysing and improving our service. If your account is deleted, the link between these events and your user ID is removed. You can object to this processing at any time (section 13).

8. Google Analytics

This website uses Google Analytics 4, a web analytics service by Google. Google Analytics sets cookies (e.g. “_ga” and “_ga_<ID>”, kept for up to 2 years) and collects information about how you use the website, such as pages viewed, time spent, where the visit came from, approximate location, and browser and device data. This information is usually transferred to and stored on Google servers; transfer to the USA is possible. According to Google, Google Analytics 4 does not store IP addresses.

The legal basis is Art. 6(1)(f) GDPR (audience measurement and improving the service). You can prevent collection by blocking cookies in your browser or by installing Google’s browser add-on to opt out of Google Analytics (tools.google.com/dlpage/gaoptout).

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC (USA) is certified under the EU-U.S. Data Privacy Framework. More information: policies.google.com/privacy

9. Cookies and storage in your browser

We store the following on your device:

• locale (cookie, 1 year) – your language setting,
• geo_country (cookie, 1 day) – the country code determined by Cloudflare, for language preselection and usage statistics,
• sign-in session (local storage) – keeps you signed in until you sign out,
• app data without an account (local storage) – your watchlists, ratings and settings while you are not signed in; this data never leaves your browser,
• session ID (session storage) – a random ID for our own usage statistics, deleted when you close the tab,
• cookies from Google Analytics (section 8) and possibly TradingView (section 10).

Storing the sign-in session, app data and language setting is strictly necessary for the features you use (section 25(2) no. 2 TDDDG). You can delete stored data at any time in your browser settings.

10. Embedded charts (TradingView)

To display charts we embed TradingView’s chart widget. As soon as a chart is shown, your browser connects to TradingView servers (tradingview.com, tradingview-widget.com). In particular your IP address, browser and device information, the page visited and the symbol displayed are transmitted to TradingView; TradingView may use its own cookies or similar technologies. We have no influence over this processing.

The legal basis is Art. 6(1)(f) GDPR; displaying charts is the core of the service. For exchanges where the widget doesn’t display charts, we load the price data through our own server and draw the chart ourselves – in that case your browser does not connect to TradingView directly.

TradingView, Inc., 470 Olde Worthington Road, Suite 200, Westerville, OH 43082, USA. More information: tradingview.com/privacy-policy

11. Market and company data via our server

For stock search, prices, the market overview and chart data, our server requests data from TradingView (symbol search and market data), Yahoo Finance (price and chart data) and the US Securities and Exchange Commission (SEC EDGAR company filings). Only stock symbols or your search terms are sent – the request comes from our server, not your browser; your IP address and account are not disclosed to these providers.

For stocks you follow, we regularly research recent news using Anthropic’s AI service Claude. Only the stock symbol and company name are sent, no information about you. Provider: Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA.

12. “Chart Swipes” Chrome extension

The Chrome extension helps you add the stock on the page you have open to your watchlist:

• The extension shows its panel at the top right of the web page you are on. So that it can appear on any page, it is active on all websites. While the panel is open, it reads the page’s address and title – and on TradingView also the exchange shown on the chart – to recognise the stock symbol. This is evaluated only locally in your browser and is neither stored nor transmitted; no other page content is read and no browsing history is collected.
• Only the recognised or typed stock symbol (for search via our server, section 11), the watchlist entries you add and any watchlists you create (into your account, section 5) are transmitted.
• On chartswipes.com, the extension reads your sign-in on the website to connect to your account. For this, our server creates a separate sign-in session for the extension.
• The extension stores its sign-in session and your last selected watchlist locally in your browser. Signing out in the extension or uninstalling it removes this data.

The legal basis is Art. 6(1)(b) GDPR.

13. Your rights

You have the following rights regarding your personal data:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing based on Art. 6(1)(f) GDPR, on grounds relating to your particular situation (Art. 21 GDPR).

Just contact the email address in section 1. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the state or country where you live. The authority responsible for us is: [state data protection authority of the controller’s German state].

14. Further information

Obligation to provide data

You are not obliged to provide personal data. Without an email address you cannot create an account, but you can still use the app without one.

Automated decisions

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

Encryption

The website and all connections to our services are encrypted with TLS (HTTPS).

Changes

We update this privacy policy when our service or the legal situation changes. The version published on this page applies.