Privacy policy

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR):

2. General information on data processing

We process personal data only to the extent necessary to provide this website and its features, or where you have consented to it. Processing is carried out in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection law.

3. Provision of the website

When you access this website, technically necessary data is processed in order to deliver the page and to ensure the security and stability of the service.

• technical access data such as IP address, timestamp and pages accessed
• information about the browser, device and operating system used

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional provision of the website.

4. Use of the application

When you use features of the application, we process the inputs and content required for this — for example search queries, configuration data, uploaded files or requested downloads — solely to provide the function you triggered.

Where technically possible, processing takes place directly in your browser. Otherwise, data is processed only to the extent necessary to provide the requested function.

The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR respectively.

5. Waitlist and download sign-up

If you sign up for a waitlist notification or leave your email address before downloading a video, we store only the following data in a database:

• your email address
• the trigger of your sign-up (e.g. free download, Pro waitlist, Studio waitlist)
• the time of your first and last sign-up

We use your email address solely to send the requested waitlist or download-related information. We do not use it for product news or offers unless you separately opt in to the newsletter described below.

The legal basis is Art. 6(1)(b) GDPR (steps at your request before entering into a contract) or Art. 6(1)(f) GDPR (our legitimate interest in responding to your requested notification). We do not store any IP address or browser information together with your entry. To prevent automated mass sign-ups, we briefly check the IP address of a request in memory; it is not stored permanently.

Retention period: We delete waitlist entries no later than 24 months after your last activity, or immediately after you withdraw your consent.

Removal: You can ask us to remove a waitlist entry at any time by writing to dominik@chartrace.app.

6. Newsletter and product news

When you sign in, you may independently and voluntarily tick the optional box to receive occasional chartrace product news and offers by email. It is not pre-ticked, is not needed to use chartrace, and is not combined with any other declaration.

We use a double opt-in: after selecting the optional box, you receive a sign-in email and must open the link and actively continue. Only then do we record your newsletter consent.

For proof of consent, we store:

• your email address
• the exact consent wording and its version
• the source of consent and the date and time of confirmation
• the date and time of a withdrawal, where applicable

The legal basis is your consent under Art. 6(1)(a) GDPR and, for email advertising, § 7(2) no. 2 UWG. You can unsubscribe at any time with effect for the future by using the link in every newsletter or by contacting dominik@chartrace.app. This is as easy as giving consent and does not affect your access to chartrace.

Retention period: We retain an active consent until you withdraw it. After withdrawal, we retain only the minimum blocking and proof record needed to honour the withdrawal and demonstrate compliance, then delete it when it is no longer necessary.

7. Reach measurement, cookies and privacy settings

Anonymous reach measurement (without cookies): To determine visitor numbers and frequently accessed pages, we use Vercel Web Analytics and our own first-party count. No cookies are set and no information is stored on or read from your device. For our own count we derive a one-way, daily-rotating hash from your IP address and browser so a repeat visit on the same day is only counted once; the raw IP address is never stored and the hash cannot be reversed or linked across days. Only aggregated statistics (e.g. page views, referrer, country) are created; there is no personal reference and no recognition of your device. § 25 TDDDG does not apply because no information is stored on or read from your device. The legal basis is our legitimate interest in a statistical evaluation of reach, Art. 6(1)(f) GDPR.

Optional analytics with consent: With your consent, we additionally use PostHog Cloud EU to better understand the use of core features and to improve chartrace. These technologies are only activated after your express consent. This may include page views, clicks, feature events, heatmaps and session recordings. Session recordings are anonymised: all text and images are masked, so the content you enter or upload is not captured. If you are signed in, we identify your activity by your email address to link your visits across sessions and devices. Session recordings are retained for 30 days. You can change or withdraw your choice here at any time.

Necessary storage: We store your privacy choice locally in your browser (localStorage) and in a first-party cookie so that the selection is retained on your next visit and analytics remains disabled if you decline. We may record the fact that a privacy choice was made, including whether optional analytics were accepted or declined, without recording product usage before consent. This storage is technically necessary to implement the choice you made.

Storage of your inputs: So that your configuration (e.g. selected tickers, colors, time frame, title, format) is available again on your next visit, we also store these inputs locally in your browser (localStorage). The data does not leave your device; no transfer to us or third parties takes place. You can delete it at any time via your browser settings.

Change or withdraw your choice:Use “Cookie settings” in the footer on any page, at any time.

The legal basis is Art. 6(1)(f) GDPR for the anonymous reach measurement and the necessary storage of your setting, as well as Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG for optional analytics technologies.

8. Recipients and processors

We use the following service providers as processors within the meaning of Art. 28 GDPR:

• Vercel Inc.— hosting of the website, provision of the application and cookieless reach measurement (Vercel Web Analytics). Servers in the EU region (Frankfurt).
• PostHog Inc.— optional product analytics, heatmaps and session recordings after consent. We use PostHog Cloud EU; according to PostHog, event data and user data are hosted in AWS eu-central-1 (Frankfurt).
• Neon Inc.— provision of the PostgreSQL database in which user and waitlist entries are stored. Region: AWS eu-central-1 (Frankfurt).
• Resend, Inc., San Francisco, USA — sending of transactional emails (in particular magic-link sign-in emails and, only with separate newsletter consent, product-news emails). Only the email address and the content of the message sent are processed. Legal basis: Art. 6(1)(b) GDPR (sign-in) or Art. 6(1)(a) GDPR (newsletter consent).
• Lemon Squeezy Inc., 17 Edgewater Park, Boston, MA 02125, USA — processing of payments for paid plans as Merchant of Record (invoicing, payment processing, collection and remittance of VAT, fraud prevention). Processed data includes in particular email address, name, billing address, country, IP address for geo-based tax determination, and payment metadata. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

We have entered into the data processing agreements required under Art. 28 GDPR with all providers.

Transfer to third countries:Resend, Inc. and Lemon Squeezy Inc. are based in the USA. Where personal data is transferred there, this is done on the basis of the European Commission’s Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914 and, where applicable, supplementary technical and organizational measures (Art. 46(2)(c) GDPR). Vercel Inc., PostHog Inc. (PostHog Cloud EU) and Neon Inc. process our data in the EU (Frankfurt region) in normal operation.

We will provide further information about the specific recipients used on request, as part of your data subject rights.

9. Your rights

You have the right at any time:

• to obtain information about your stored data (Art. 15 GDPR)
• to request rectification of inaccurate data (Art. 16 GDPR)
• to request erasure of your data (Art. 17 GDPR)
• to request restriction of processing (Art. 18 GDPR)
• to request data portability (Art. 20 GDPR)
• to object to processing (Art. 21 GDPR)

To exercise your rights, please contact: dominik@chartrace.app

10. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority is:

11. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption.

12. Changes to this privacy policy

We reserve the right to amend this privacy policy in order to adapt it to changes in the law or changes to the service.

Last updated: 17 July 2026