Chrome extension · TradingView Web

Privacy Policy

In force since 6 September 2026 · Last updated: 2 October 2026

This policy describes which data CryptoTrader - TradingView Organizer — the Chrome extension that adds a sidebar to TradingView Web — collects, why it collects it, who it is shared with and how you exercise your rights.

The most important point: your exchange API keys never leave your computer. They are encrypted with 256-bit AES-GCM using a master key marked as non-extractable, kept in the extension's own private storage. Neither CryptoTrader, nor our server, nor any third party receives those keys. Orders go from your browser straight to the API of the exchange where you registered the key.

1. Who is the controller

The party responsible (controller) is the developer of CryptoTrader, who can be contacted at cryptotrader.trade@gmail.com. This is also the channel for any request regarding personal data.

2. Data we collect

The extension only works on tradingview.com pages. Outside them it is not loaded and collects nothing. Every data transmission goes to our server at https://st.cryptotrader.trade.

Data	How it is obtained	When it is sent	Purpose
E-mail and nickname	Sign-up form in the Account tab	On sign-up and when changing your details	Create and identify your account; send the validation link, the password set/reset link and the account change link
TradingView username	Read from the settings page of your own TradingView account, already authenticated in your browser	On sign-up, when checking the account status, on login, on password reset and when requesting a change of details	It is the account's identity in the extension: it links the registration to your TradingView user and appears as the author of the analyses you publish
Password	Defined by you through the link sent to your e-mail	On login and when setting/changing the password	Authenticate you. We store only the hash (scrypt), never the password
Language selected in TradingView	Browser environment	On sign-up and when changing your details	Send e-mails and display the interface in your language
Feedback message, with the symbol on screen, the extension version, the language and the browser's user agent	Form in the Send feedback tab	Only when you click Send	Handle and diagnose the reported problem, bug or suggestion
Shared analyses: chart drawings and studies, symbol and the text of the comments	From your chart, when you use the sharing feature	Only when you publish an analysis or comment on one	Allow someone else to reproduce your analysis through the generated code. Moderation only reviews analyses that are reported — through the Send feedback tab or the contact e-mail —, to enforce the Terms of Use
Installed version of the extension	From the package itself	On every call to the server (`X-TVA-Version` header); the last version used is recorded in your account	Compatibility, mandatory update notices and support
Plan and subscription: plan, expiry date, whether it came from the evaluation period or from a payment, and the payment history (cycle, amount and date)	Generated on the server, at sign-up (evaluation period) and when each payment is confirmed	Queried by the extension while you use it signed in	Enable your plan's features and show, in the Account tab, the subscription status and the expiry notice
Daily usage record: your username and the date	Generated on the server	Automatically, on each day you use the extension while signed in	Active user count. It does not record what you did, nor which symbols, orders or amounts

2.1. Data we do not collect

Exchange API keys and secrets — they stay encrypted on your device only, as described above.
Your balances, positions, orders and results — they are read straight from the exchange by your browser and displayed in the sidebar. They do not go through our server.
Your TradingView plan and the remaining days — they are read and displayed locally only, in the Account tab. They are not sent to the server.
Your browsing history — the extension does not watch or record visited pages; it is only loaded on tradingview.com.
Your IP address is not stored in a database. It is used only in memory, at the moment of the request, to limit abuse (rate limit), and discarded right after.
We do not use tracking cookies, advertising, third-party analytics or fingerprinting. The only cookies are the session cookies of the account page and of the partner area, on our server — technical and strictly necessary — and, when you open this website through an address with a referral code (?c=), a cookie holding only that code, for 30 days, to fill it in on the password page. It does not identify you.

2.2. Subscription and payment

Payment is made on the page of the NOWPayments service, outside the extension. What you enter on that page is handled by NOWPayments, under its own privacy policy.
To identify the purchase, we send NOWPayments your TradingView username, the chosen cycle and the amount. We do not send your e-mail.
From NOWPayments we receive the confirmation of each payment — identifier, amounts, status and dates of the transaction —, which we keep to enable the plan, handle refund requests and meet legal obligations.
The subscription page is opened through a link carrying an individual code for your account, and it shows your TradingView username, nickname, partially hidden e-mail, plan and expiry date. Do not share that link.

2.3. Referral program

If you signed up through the link or invitation of an accredited partner, or entered that partner's referral code when setting the password of an account created in the extension, your account is permanently linked to that partner. To apply the first-purchase discount and calculate the commission, the partner sees, in the partner area: your nickname; the invitation and sign-up dates; your plan's status and expiry date; and the cycle, amount paid and commission of each payment.
From accredited partners, we process name, e-mail, phone, referral code and the details for receiving commissions, plus the record of commissions and withdrawals. Every account has its own referral link, created together with it: the e-mail is the account's, and the name and phone are entered when setting the password (and can be changed in the partner area). The partner's name is shown to whoever opens their link.

3. Legal basis

Performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)) — sign-up, authentication, operation of the tabs, subscription and payment, the referral program, sharing of analyses and sending the transactional e-mails. Without that data the extension does not work.
Compliance with a legal obligation (LGPD art. 7, II; GDPR art. 6(1)(c)) — keeping the records of payments, commissions and withdrawals for the period required by tax and accounting law.
Legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)) — security (abuse limiting), moderation of reported content, active user count, record of the extension version in use and diagnosis of the feedback received. You may object at any time through the contact e-mail.
Consent (LGPD art. 7, I; GDPR art. 6(1)(a)) — accepting this policy and the Terms of Use at sign-up, and the publication of each shared analysis, which only happens through an action of yours.

4. Who we share it with

We do not sell, rent or assign personal data. We use three processors, exclusively to provide the service:

Supabase — the database holding the registration, the sessions, the feedback and the shared analyses. Access is made only by our server, with a service key; the tables have Row Level Security enabled and no public access policies.
Brevo — sending the transactional e-mails (e-mail validation, password set and reset, change of details and the referral program e-mails). It receives the destination address and the content of the message.
NOWPayments — processing of subscription payments. It receives your TradingView username, the cycle and the purchase amount (section 2.2).

In the referral program, part of your data is shown to the accredited partner who referred you (section 2.3).

The application server runs on our own VPS at Contabo. We may disclose data if legally required to do so by a competent authority.

International transfer: these providers may process data outside Brazil. The transfer takes place based on the contractual clauses and safeguards offered by each of them, in accordance with the LGPD (art. 33) and the GDPR (Ch. V).

5. How long we keep it

Registration (e-mail, nickname, TradingView user, password hash, language, plan, referral link and the last extension version used) — for as long as your account exists. It is deleted when you request the deletion.
Records of payments, commissions and withdrawals — for the period required by tax and accounting law, even after the account is deleted.
Login sessions — they expire within 90 days and are swept automatically from the database. Logging out invalidates the session immediately.
E-mail login codes — they expire in about 15 minutes and are also swept automatically.
Feedback — kept while useful for the support and diagnosis history; it can be deleted at your request.
Shared analyses and comments — they remain available until you delete them through the extension itself, or until the account is deleted.
Daily usage record — kept for the active user metric.

6. Your rights

Under the LGPD (art. 18) and the GDPR (arts. 15 to 22), you may request: confirmation of the processing and access to your data; correction of incomplete or outdated data; anonymization, blocking or erasure; portability; information about the sharing; withdrawal of consent; and objection to processing based on legitimate interest.

6.1. How to change your data

Nickname, e-mail and password are changed by you: in the Account tab, click Change account details. We send a link to the registered e-mail — possession of the e-mail is what authorizes the change.

6.2. How to request account deletion

The extension does not have a self-deletion button yet. Send an e-mail to cryptotrader.trade@gmail.com from the registered address, asking for the deletion and including your TradingView username. We answer within 15 days, deleting the registration, the sessions and the published analyses. The records of payments, commissions and withdrawals are kept for the legal period (section 5).

To erase what is on your device — including the encrypted API keys — just remove the extension from the browser; or, before that, delete each exchange account through the Exchanges tab.

7. Security

All traffic is HTTPS-only, with a fixed list of allowed destinations. The authorization header is sent only to our own server.
Exchange API keys: AES-GCM 256 with a non-extractable master key, in the extension's private storage.
Session token kept out of reach of web pages, in the extension's private area; on the account page, in an HttpOnly cookie.
Password stored only as a scrypt hash.
The extension runs no remote code: no eval, no CDN scripts, no code downloads. Everything that runs comes inside the package published on the Chrome Web Store.

No system is 100% secure. We recommend creating the API keys without withdrawal permission and revoking them on the exchange if you stop using the extension.

8. Minors

CryptoTrader is not intended for people under 18 and we do not knowingly collect data from children and teenagers. If we identify a registration in that condition, it will be deleted.

9. Limited use of data (Chrome Web Store)

The use of the information received by CryptoTrader complies with the Chrome Web Store's Limited Use policy. In particular:

the data is used only to provide and improve the user-facing features described in this policy;
we do not transfer data to third parties, except to the processors listed in section 4 and, in the referral program, to the accredited partner who referred you (section 2.3), where necessary to provide the service, by legal requirement, or in a security investigation;
we do not use or transfer data for advertising, marketing, data brokerage or creditworthiness assessment;
we do not allow humans to read user data, except with express consent (for example, when analysing feedback you sent), by legal requirement, for security — including the moderation of reported content —, or when the data is aggregated and anonymized.

10. Changes to this policy

We may update this document. The last-updated date at the top always indicates the version in force. Relevant changes will be communicated by e-mail or inside the extension itself before they take effect.

11. Contact

Questions, access or deletion requests, or any privacy matter: cryptotrader.trade@gmail.com. You may also complain to the ANPD (Brazil's National Data Protection Authority) or to the data protection authority of your country.