Privacy policy

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR):

2. General information on data processing

We process personal data only to the extent necessary to provide this website and its features, or where you have consented to it. Processing is carried out in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection law.

3. Provision of the website

When you access this website, technically necessary data is processed in order to deliver the page and to ensure the security and stability of the service.

• technical access data such as IP address, timestamp and pages accessed
• information about the browser, device and operating system used

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional provision of the website.

4. Use of the application

When you use features of the application, we process the inputs and content required for this — for example search queries, configuration data, uploaded files or requested downloads — solely to provide the function you triggered.

Where technically possible, processing takes place directly in your browser. Otherwise, data is processed only to the extent necessary to provide the requested function.

The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR respectively.

5. Waitlist and download sign-up

If you sign up for a waitlist notification or leave your email address before downloading a video, we store only the following data in a database:

• your email address
• the trigger of your sign-up (e.g. free download, Pro waitlist, Studio waitlist)
• the time of your first and last sign-up

We use your email address to send the requested waitlist or download-related information. If you also hold a chartrace account, the product emails described in section 6 apply, and you can object to them at any time. We do not send you promotional campaigns or offers unless you separately opt in to the newsletter, also described in section 6.

The legal basis is Art. 6(1)(b) GDPR (steps at your request before entering into a contract) or Art. 6(1)(f) GDPR (our legitimate interest in responding to your requested notification). We do not store any IP address or browser information together with your entry. To prevent automated mass sign-ups, we briefly check the IP address of a request in memory; it is not stored permanently.

Retention period: We delete waitlist entries no later than 24 months after your last activity, or immediately after you withdraw your consent.

Removal: You can ask us to remove a waitlist entry at any time by writing to dominik@chartrace.app.

6. Product emails and newsletter

We distinguish two kinds of email, with different legal bases and different ways to stop them.

Service emails. Your chartrace account includes emails about your own use of it: sign-in links, notices about your usage and plan limits, and messages about changes that affect your account. The legal basis is Art. 6(1)(b) GDPR, because these are necessary to provide the account you asked for. We tell you about them when your account is created, and every one contains a one-click link to stop them. If you do, we record the date and stop sending them; your access to chartrace is unaffected.

Emails on a free account. A free chartrace account is up to 3 videos a day together with a monthly email about viral chart ideas and new features. We aim for roughly that cadence rather than a fixed delivery date, and may occasionally send less often. Those emails are part of what the free account is, not an extra added afterwards, and we say so on the screen where you create the account, alongside the button that creates it. In the language of Directive (EU) 2019/770 and § 327 BGB, you provide your email address as counter-performance instead of paying, and you receive the service in return. The legal basis is Art. 6(1)(b) GDPR for that contract. One click in any email ends them, and your account keeps working exactly as before.

Campaigns and offers. Promotional email that is not part of the account above, such as discounts or launch campaigns, is sent only if you actively and separately consent, or, if you are a paying customer, on the narrow basis in § 7(3) UWG for our own similar services, which you can refuse at any time at no cost beyond your normal transmission rates. Consent is never pre-ticked and never bundled with another declaration. Where we ask for it, we use a double opt-in: you receive a confirmation email and must open the link and actively continue before we record anything.

If you would rather not receive any of this, chartrace Pro is a paid plan without them, and you can stop the emails on a free account at any time without losing access.

For proof of consent, we store:

• your email address
• the exact consent wording and its version
• the source of consent and the date and time of confirmation
• the date and time of a withdrawal, where applicable

For the newsletter, the legal basis is your consent under Art. 6(1)(a) GDPR and, for email advertising, § 7(2) no. 2 UWG. You can unsubscribe at any time with effect for the future by using the link in every email or by contacting dominik@chartrace.app. This is as easy as giving consent and does not affect your access to chartrace. The unsubscribe link stops both kinds of email described above, so a single click ends all of it.

Where we send advertising to you as a paying customer under § 7(3) UWG, the legal basis under the GDPR is Art. 6(1)(f) GDPR, our legitimate interest in telling our own customers about our own similar services. You may object at any time under Art. 21(2) GDPR. For direct advertising that objection is unconditional: we do not weigh it against any interest of ours, we simply stop.

We store only your email address and the date of your objection or withdrawal. We keep that record for as long as we hold your address, because it is what stops us from contacting you again by mistake.

Retention period: We retain an active consent until you withdraw it. After withdrawal, we retain only the minimum blocking and proof record needed to honour the withdrawal and demonstrate compliance, then delete it when it is no longer necessary.

7. Reach measurement, cookies and privacy settings

Cookieless reach measurement: To measure visitor numbers and frequently accessed pages, we use Vercel Web Analytics and a first-party counter. These tools do not set analytics cookies or store analytics identifiers on your device. For the first-party counter, the server uses the IP address and browser information transmitted with the request to create a one-way identifier that changes each day. The raw IP address is not stored, and the identifier is not used to recognise you across different days. We use the resulting data only for aggregate reach statistics. The legal basis is our legitimate interest in measuring and improving the reach of our service, Art. 6(1)(f) GDPR. § 25 TDDDG does not apply because no information is stored on or read from your device.

Cookieless visit statistics: If you choose “Only necessary”, we use PostHog Cloud EU to count page visits without analytics cookies or persistent browser storage. We do not create profiles, identify visitors, record sessions, capture clicks or collect Web Vitals in this mode. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to measure and improve our service. We retain PostHog event data for no longer than 12 months from capture and may retain aggregated statistics that no longer identify visitors for longer. You may object at any time by contacting dominik@chartrace.app.

Optional analytics with consent: With your consent, we use PostHog Cloud EU to understand product use and performance and may create masked session recordings. PostHog is activated only after consent and stops when consent is withdrawn. Form inputs, images and the editor canvas are masked or excluded from recordings. The Custom Data editor, including its file, values and preview, is excluded from recordings. Files selected for Custom Data stay in your browser and are not uploaded to PostHog. Signed-in activity is linked using a pseudonymous identifier rather than your email address. We retain PostHog event data for no longer than 12 months from capture and masked session recordings for 30 days. You can change or withdraw your choice here at any time.

Necessary storage: We store your privacy choice locally in your browser (localStorage) and in a first-party cookie so that the selection is retained on your next visit and cookie-based analytics remains disabled when you choose “Only necessary”. We may record the fact that a privacy choice was made, including whether full analytics were accepted, without recording product usage before consent. This storage is technically necessary to implement the choice you made.

Storage of your inputs: So that your configuration (e.g. selected tickers, colors, time frame, title, format) is available again on your next visit, we also store these inputs locally in your browser (localStorage). The data does not leave your device; no transfer to us or third parties takes place. You can delete it at any time via your browser settings.

Change or withdraw your choice: Use “Cookie settings” in the footer on any page, at any time to change between cookie-based analytics and cookieless visit statistics. You may also object to cookieless measurement by contacting dominik@chartrace.app.

The legal basis is Art. 6(1)(f) GDPR for cookieless reach and visit measurement, as well as the necessary storage of your setting. Our legitimate interest is measuring and improving the reach and reliability of our service with the least data possible. The legal basis for optional analytics technologies is your consent under Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

8. Recipients and service providers

We use the following service providers. Where a provider processes personal data on our instructions, it acts as our processor under Art. 28 GDPR.

• Vercel Inc. — hosting of the website, provision of the application and cookieless reach measurement (Vercel Web Analytics).
• PostHog Inc. — cookieless page-visit measurement after an “Only necessary” choice, and optional product and web analytics, performance measurement, heatmaps and masked session recordings after consent. We use PostHog Cloud EU; according to PostHog, stored event and user data is hosted in AWS eu-central-1 (Frankfurt). When its managed reverse proxy is enabled, PostHog uses Cloudflare, Inc. as a subprocessor to route requests.
• Neon Inc. — provision of the PostgreSQL database in which user and waitlist entries are stored.
• Resend, Inc., San Francisco, USA — sending of transactional emails (in particular magic-link sign-in emails and, only with separate newsletter consent, product-news emails). Only the email address and the content of the message sent are processed. Legal basis: Art. 6(1)(b) GDPR (sign-in) or Art. 6(1)(a) GDPR (newsletter consent).
• Lemon Squeezy — payment provider and Merchant of Record for paid plans (invoicing, payment processing, VAT and fraud prevention). For the payment transaction, Lemon Squeezy processes the necessary payment and billing data under its own privacy information. The legal basis for our transfer of the necessary data is Art. 6(1)(b) GDPR.

Transfers outside the EEA: Some providers and their subprocessors may process personal data outside the EEA. For any such transfer, we use the safeguards required by Chapter V GDPR, for example an adequacy decision, the EU-US Data Privacy Framework where applicable, or the European Commission’s Standard Contractual Clauses. You can obtain information about the safeguard applicable to a specific transfer by contacting dominik@chartrace.app.

We will provide further information about the specific recipients used on request, as part of your data subject rights.

9. Your rights

You have the right at any time:

• to obtain information about your stored data (Art. 15 GDPR)
• to request rectification of inaccurate data (Art. 16 GDPR)
• to request erasure of your data (Art. 17 GDPR)
• to request restriction of processing (Art. 18 GDPR)
• to request data portability (Art. 20 GDPR)
• to object to processing (Art. 21 GDPR)

To exercise your rights, please contact: dominik@chartrace.app

Where we rely on Art. 6(1)(f) GDPR for cookieless reach and visit measurement, you may object at any time by contacting dominik@chartrace.app.

10. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority is:

11. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption.

12. Changes to this privacy policy

We reserve the right to amend this privacy policy in order to adapt it to changes in the law or changes to the service.

Last updated: 3 August 2026