StratLab

Privacy policy

Last updated 28 October 2026

This policy explains what StratLab collects when you use StratLab, why, and your choices. It is written to meet India's Digital Personal Data Protection Act, 2023.

What we collect

  • Your Google account's email and ID, to sign you in.
  • What you create: notebooks, strategies, experiments, paper trading sessions, watchlists and settings.
  • Usage counts, such as experiments and AI builds this month, to apply plan limits.
  • Alert contacts you choose to add: an email address, each device's notification address if you turn on phone notifications, and a Telegram chat ID if Telegram is offered in Settings and you connect it.
  • Billing records: your plan and Razorpay subscription ID. Card, UPI and bank details go to Razorpay only.
  • Usage analytics: which pages you open and which features you use (such as running a backtest or saving a screen), and when a page breaks, the error's type and message with any addresses, IDs and long numbers removed; without your holdings, symbols you search or amounts. No screen recordings or typed text. Before you sign in, this is tied only to a random ID made in your browser, not to any account. Once you sign in, it is linked to your account's internal ID, never your email or name. Not collected at all if your browser sends Do Not Track or Global Privacy Control.
  • Technical logs: request logs and error reports kept to run and fix the service. Error reports carry no email, IP address or request contents.

How it's used

Only to run StratLab: sign-in, running your tests and paper sessions, sending the alerts you asked for, billing, preventing abuse, and fixing problems. We don't sell your data. The ads and analytics described below load only if you allow them.

Ads and analytics, only if you allow them

StratLab asks once, with an "Allow" and a "No thanks" button, before it loads any of the following. Say no and none of them is downloaded or sets anything. Basic and Pro have no ads.

  • Google ads (AdSense): public pages (the landing page, company pages, the strategy library and shared verdicts) and Free accounts may show ads. Google may set cookies and similar storage in your browser, and may read your IP address and device details, to choose, limit and measure ads and to prevent fraud.
  • Meta Pixel (Facebook and Instagram): when it is switched on, it tells Meta which StratLab pages you opened and when you finished creating an account, so StratLab can measure its own advertising on Meta. It sends no email, holdings, notebooks or typed text, and its automatic button and page-detail tracking is off.
  • Microsoft Clarity: when it is on, it records how pages are used (scrolls, taps and where people get stuck) as a replayable session with all text and form fields hidden. Microsoft may set cookies and process the recording.
  • Where none of them run: no ad, pixel or recording is on Money, tax, holdings, net worth, Account, Settings, Admin, sign-in or payment pages, or in emails. A recording that was running stops when you open one of them.
  • Your browser can say no for you: if it sends Do Not Track or Global Privacy Control, Google ads, the Meta Pixel and Clarity do not load, and nothing is asked. StratLab gives none of these your email, holdings, notebooks or anything you type.
  • Asked about ads alone: on a company page, the question is about Google ads only, and "Allow" there lets those ads load and nothing else. Meta's and Microsoft's are asked about separately and stay off until you allow them.
  • To change your answer, use "Change my choice" on this page (taking a yes back reloads the page), or clear this site's data in your browser's settings. Google's own ad settings are at adssettings.google.com.

Who processes it for us

  • Supabase (database and sign-in), Railway (server) and Vercel (website) host the service.
  • Google (AdSense) serves the ads on public pages and to Free accounts, Meta (the Meta Pixel) measures StratLab's own advertising, and Microsoft (Clarity) records how pages are used, each only if you allow it.
  • Razorpay processes payments.
  • AI providers receive the text you type into AI features, like an idea to turn into rules, but not your email. StratLab can send it to any of these eleven: Anthropic, Cerebras, Cloudflare Workers AI, Google Gemini, Groq, Hugging Face, Mistral, NVIDIA API catalog, OpenRouter, SambaNova and Z.ai. Which one answers a given request varies, and only those with a key set up on the server are used. Z.ai is a China-based service. Mistral and Google Gemini also read the public company filings that are scanned pictures. Some of these services are used on their free plans, whose terms let the provider keep what is sent and use it to improve or train their models (Google Gemini's free tier and Mistral's free plan say so): don't type anything into an AI feature that you wouldn't want a provider to keep.
  • Our email provider delivers the alerts you turn on by email, and Telegram delivers them if it is offered in Settings and you connect it. Sentry receives error reports without personal details.
  • PostHog (hosted in the US) receives the usage analytics described above.

Some of these providers store data outside India, under their own security and privacy commitments.

Cookies and storage

StratLab sets no cookies itself. It uses your browser's local storage, which stays on your device until you clear it, and session storage, which goes when you close the tab. Nothing StratLab stores is used for advertising. The ad and analytics scripts described above, if you allow them, can set their own cookies.

  • Before you sign in, on your first visit: a preference for light or dark mode and for the currency prices are shown in, a note that the page reloaded once if a file failed to load, and, when usage analytics are on, one entry from PostHog (its name starts with ph_) holding a random anonymous ID and session details. That PostHog entry is not made, and no analytics request is sent, if your browser sends Do Not Track or Global Privacy Control.
  • Your answer about ads and analytics: stratlab.ads, "yes" or "no" with the date (and, for a yes about Google ads alone, a note saying so), kept in your browser for a year. It stays on your device.
  • While Google sign-in runs: the page to come back to, and an invite code if you arrived by a friend's link.
  • After you sign in: your sign-in session, which the sign-in service refreshes, and a few choices such as which menu is open and whether you have seen the tour.
  • To pay: Razorpay's payment window can set its own cookies and storage on its own pages and windows.

You can clear all of this from your browser's settings; you will be signed out and the choices above reset.

Keeping and deleting

We keep your data while your account is open. You can delete notebooks and sessions yourself at any time. The Account page has "Download all my data" to get a copy of what we hold, "Delete all my data" to erase it, and "Delete my account" to erase it and delete your sign-in account too, at once and with no way back. Invoices and the payment records behind them are kept, as tax law requires; everything else goes. Or email privacy@stratlab.studio to see what we hold or correct it; we'll act within 30 days.

Security

Data is sent over HTTPS, access is limited to your own account, and secrets stay on the server. No system is perfectly secure; if a breach affects you, we'll tell you as the law requires.

Children

StratLab is for adults (18+). We don't knowingly collect children's data.

Contact and grievances

For privacy questions, requests or complaints, email privacy@stratlab.studio. If you're not satisfied, you can complain to the Data Protection Board of India.

Terms · Privacy · Refunds · Contact