Privacy Policy
Version 2026-10-07.1 · Effective on production activation of this version.
Who operates the service
SessionTerrain is a trading name operated as a sole proprietorship in India. The production website is hosted on AWS Lightsail in Mumbai, India and serves users internationally. Contact support@sessionterrain.com for privacy questions, rights requests and grievances. We do collect personal information as described below.
Account and security information
We process account email, internal account ID, optional Google profile name, sign-in provider identifiers, account status, role, plan and trial or access dates. We retain login/activity records, administrator access changes and account notes. Passwords are stored as salted hashes; authentication and reset tokens are stored in hashed or protected short-lived records. Necessary cookies support sessions, sign-in security and one-time login events. Sessions expire after up to seven days and verification/reset links after fifteen minutes; expiry does not imply immediate deletion of every associated record.
Technical information
Hosting and security systems may process IP addresses, browser/device information, timestamps, request paths, errors and operational logs to operate, secure and troubleshoot the service. Browser preferences may be stored locally. We minimize sensitive data in logs and do not intentionally place passwords, authentication tokens or ticket contents in analytics.
Support and feedback
We store ticket identifiers, account association, category, subject, messages, status, timestamps, replies and administrative notes. Safe context may include route without query strings, selected instrument, Algorithm, forecast session and browser/device information. Tickets are private to the account owner and authorized administrators; internal notes are administrator-only. File attachments are disabled. Avoid unnecessary personal information and never submit passwords, login links, tokens or financial account credentials.
Purposes and grounds
We use information to provide and secure accounts and research access, administer trials and permissions, answer support and rights requests, investigate failures and abuse, record legal acceptance, and comply with applicable duties. Where applicable law requires a legal basis, we rely on the relevant service agreement, legal obligation, permitted legitimate interest or separately obtained consent as appropriate. Optional analytics is controlled separately; agreement to Terms is not blanket consent to unrelated processing.
Optional analytics
With your separate permission, Google Analytics 4 measures page visits, successful logins, signup/trial milestones, first dashboard visits, return usage, instrument views, Algorithm selection and feature usage. Google may process analytics identifiers and technical device/network information. We exclude account, support, administration and confirmation pages, strip URL queries from page locations, and do not send emails, passwords, tokens or ticket text. Advertising personalization and Google signals are disabled. You can decline or change your choice using Cookie preferences in the footer or your account. Necessary cookies are always on; Analytics is optional. Before you accept, we do not load Google Analytics or enable analytics storage. Your choice is saved in this browser; you can reject optional analytics or withdraw permission at any time. Preferences apply separately on the public website and app subdomain. We honor supported Global Privacy Control and Do Not Track signals. Browser blockers may also prevent collection.
Service providers and international processing
AWS provides hosting. Google provides optional Google sign-in and optional analytics; Google Fonts may supply fonts. Our configured email provider delivers authentication messages and limited support notifications. Authorized operators administer support and security. Providers may process information in India or other countries under their applicable terms and safeguards. Finazon is our licensed market-data source; we do not describe it as receiving account or support personal information merely because it supplies market data. We do not sell personal information or use ticket contents for advertising.
Email notifications
Authentication messages contain short-lived production-domain links. Support notifications direct recipients to sign in to the app without including ticket contents. Messages may be delivered through external mail systems; delivery to an inbox is not guaranteed.
Retention and deletion
We retain information for service, account security, support, legal acceptance, dispute and legal-compliance purposes only as needed, and review deletion requests individually. Automatic account and ticket deletion is not currently implemented. Token expiry and logout disable access but are not claims of immediate record erasure. Historical access requests may retain email, optional interests, consent version and submission time until reviewed or deleted. The cloud retains one local backup; protected recovery copies may also exist off-server. Deletion from active systems and expiry of backups can occur at different times. We may retain limited records where necessary or legally required and explain relevant restrictions in response to a request.
Your choices and rights
You may sign out, manage analytics preferences, and contact support@sessionterrain.com or in-app Support to request access, correction, account closure or deletion, or raise a grievance. Depending on applicable law, you may also have rights to withdraw consent, object, restrict processing, receive portable information, or complain to a competent authority. We verify identity proportionately and respond within applicable legal requirements. Withdrawal does not invalidate prior lawful processing. Essential information may be necessary to provide account services.
Security and policy updates
We use access controls, encrypted HTTPS transport, password hashing, expiring authentication links and authorization checks. No system is guaranteed secure. Contact support promptly about a suspected issue without sending credentials. Material policy changes are versioned and presented for acknowledgment where required. Marketing consent and optional analytics remain separate from Terms and Privacy acceptance.