Privacy Notice

StrikeHike is run by an individual, the owner, in India. The owner decides why and how your personal data is processed, as the “Data Fiduciary” under the Digital Personal Data Protection Act, 2023 (DPDP Act). Contact details are at the end of this notice.

Today, section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 (the SPDI Rules, G.S.R. 313(E) of 11 April 2011) apply. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E), corrected by G.S.R. 892(E)); their rules on notices (rule 3), the contact person (rule 9), rights and grievances (rule 14) and most other duties apply from 13 May 2027, when the SPDI regime ends. This notice is written to meet both.

Each item, why we need it, and where it is kept:

• Email address

  To create your account, sign you in, and send confirmation and password-reset links. Product news only if you opt in.

  Kept by: Supabase (AWS Mumbai)

• Password

  To sign you in. Supabase stores only a one-way hash; StrikeHike never stores your password. Before a new password is accepted, your browser sends the first 5 characters of its SHA-1 hash to Have I Been Pwned to check it against known breaches; that service also sees your IP address and browser details. Under the SPDI Rules a password is sensitive personal data (rule 3).

  Kept by: Supabase (AWS Mumbai)

• Google account details, only if you sign in with Google

  Your name, email address, profile picture link and Google account ID, which Google sends so that you can sign in. StrikeHike asks Google only for your basic profile and email address.

  Kept by: Supabase (AWS Mumbai)

• Display name (optional)

  Shown on your account page.

  Kept by: StrikeHike database (Supabase, AWS Mumbai)

• Your age confirmation, acceptance of the Terms of Use and consent to this notice, each with its time and document version

  To keep accounts to adults, and to show what you agreed to and when (DPDP Act, section 6(10)).

  Kept by: StrikeHike database (Supabase, AWS Mumbai)

• Your product-news choice, with its time

  To email you product news only if you said yes.

  Kept by: StrikeHike database (Supabase, AWS Mumbai)

• Watchlists, if you make any: each list's name, its place in your order and the time it was made, and the symbols in it with the time each was added

  To show the indices and stocks you follow, in your order, on every device you sign in on.

  Kept by: StrikeHike database (Supabase, AWS Mumbai)

• Preferences: your theme, default symbol, dashboard view, the last 10 symbols you opened on the Greeks page, and your quiet hours

  To keep the app the way you set it up, on every device you sign in on. Quiet hours are for alerts, which are coming soon.

  Kept by: StrikeHike database (Supabase, AWS Mumbai)

• Activity log: the start of each sign-in session, profile changes, data downloads and account deletion, each with the time, IP address and browser user agent (up to 256 characters)

  To keep accounts secure, to investigate misuse, and to keep the one-year log that the DPDP Rules require from 13 May 2027 (rules 6(1)(e) and 8(3)).

  Kept by: StrikeHike database (Supabase, AWS Mumbai)

• Sign-in sessions: the IP address and browser user agent of each device you sign in on

  Supabase's sign-in service keeps them with each session, to keep you signed in, until you sign out on that device or delete your account.

  Kept by: Supabase (AWS Mumbai)

• Sign-in service logs: sign-in events with IP address and email address

  Supabase's own security and operations logs.

  Kept by: Supabase, in EU data centres

• Web server logs: IP address, browser, time and the page requested, with sign-in codes and tokens removed

  To keep the site running and secure.

  Kept by: StrikeHike's server (Amazon Web Services Lightsail, Mumbai)

• Bot check: your IP address and browser details, on sign-in forms

  Cloudflare Turnstile uses them to tell people from bots.

  Kept by: Cloudflare

Fonts load from Google Fonts, so Google receives your IP address when your browser fetches them. We do not collect payment details or the passwords of any other service, and we collect nothing for advertising.

When you create an account, we show you a short notice and ask for your consent with an unticked box. Product news is a separate, optional box. You can withdraw consent as easily as you gave it (DPDP Act, section 6(4)):

• product news: untick it on the Account page;
• everything else: delete your account on the Account page, which ends the processing for it. The activity log is then kept only for the period in section 7.

Withdrawing consent does not affect processing that happened before.

• Account and profile data, watchlists and preferences, the activity log and backups: Supabase, in the AWS Asia Pacific (Mumbai) region.
• The StrikeHike application and its server logs: Amazon Web Services Lightsail, Mumbai.
• Supabase’s own service logs: data centres in the EU.

Supabase may also process data in other places for support, billing and operations, under its Data Processing Addendum.

• Supabase: authentication and database (AWS Mumbai; logs in the EU).
• Amazon Web Services Lightsail: application hosting (Mumbai).
• Cloudflare Turnstile: bot check on sign-in forms (global, on Cloudflare's network).
• Google: sign-in, only if you sign in with Google (global).
• Have I Been Pwned: password breach check, from your browser: only the first 5 characters of a hash of the password are sent, and the service also sees your IP address and browser details (global).

We do not sell your data and we do not share it for advertising.

• Account data (email address, sign-in methods, profile): until you delete your account.
• Watchlists: until you delete them or your account.
• Preferences: until you change them or delete your account. Recently viewed keeps only the last 10 symbols you opened.
• Sign-in sessions (IP address and browser user agent): until you sign out on that device or delete your account.
• Activity log: one year (366 days, so a leap day never shortens it) from each event, also after the account is deleted, then erased automatically (DPDP Rules, rules 6(1)(e) and 8(3), which apply from 13 May 2027).
• Backups: deleted data can remain in Supabase’s backups until they are replaced, for the backup period of the Supabase plan [to be confirmed by the owner].
• Supabase’s sign-in service logs: for Supabase’s log period (1 hour on its Free plan, 7 days on its Pro plan).
• Web server logs: [period to be confirmed by the owner].
• Browser storage: on your device until you clear your browser’s storage, or sooner for some items: signing out removes the sign-in session, and some items last only until you close the tab (see Cookies and storage).

The DPDP Act (sections 11 to 14) gives you these rights from 13 May 2027; StrikeHike offers them now. You can:

• see and export your data: “Download my data” on the Account page gives you a file with your account details, profile, watchlists, preferences, activity log, and a summary of the processing and the processors. The file does not include the details Google sends when you sign in with Google (your name, profile picture link and Google account ID): ask for them at the contact below;
• correct it: change your display name, product-news choice, default symbol and quiet hours on the Account page, your theme with the light and dark mode button at the top of the app, the dashboard view on the dashboard, and your watchlists on the Watchlists page, or contact us for anything else;
• erase it: “Delete account” on the Account page;
• withdraw consent: see section 4;
• nominate someone to use these rights for you if you die or cannot act yourself: tell us at the contact below;
• raise a grievance with us at the contact below.

When you contact us, write from your account’s email address, or include it, so that we can find your account (DPDP Rules, rule 14(1)). We may need to confirm it is you before we act. We aim to answer within 30 days; the SPDI Rules require an answer within one month (rule 5(9)), and from 13 May 2027 the DPDP Rules allow up to 90 days (rule 14(3)).

From 13 May 2027, if you are not satisfied with our answer, you can complain to the Data Protection Board of India (DPDP Act, section 13(3)): [Data Protection Board of India complaint link: to be added when the Board publishes one].

The Grievance Officer (SPDI Rules, rule 5(9)), who is also the person who answers questions about the processing of your data (DPDP Rules, rule 9): [Privacy and grievance contact: to be confirmed by the owner]

StrikeHike is for adults only. A child is anyone under 18 (DPDP Act, section 2(f)), and you must confirm that you are 18 or older to create an account. We do not knowingly process children’s data: if we learn that an account belongs to someone under 18, we delete it. StrikeHike does no tracking, behavioural monitoring or targeted advertising (section 9(3)).

StrikeHike does not use tracking or advertising cookies. Instead it keeps a few essential items in your browser’s local storage and session storage, such as your sign-in session and your theme. The Cookies and storage note lists every one.

Connections are encrypted (HTTPS). Supabase stores passwords only as hashes. The account tables cannot be reached from the browser: our server checks the sign-in token on every account request, and the database limits each query to your own rows (row-level security). Secret keys stay on the server. We keep the activity log to detect and investigate misuse.

If a breach affects your data, we will tell you without delay by email: what happened, the likely effects for you, what we have done, what you can do to protect yourself, and whom to contact (DPDP Rules, rule 7(1), from 13 May 2027). We will also report it as the law requires: to the Data Protection Board (rule 7(2)), and to CERT-In within 6 hours where its Directions of 28 April 2022 apply.

When we change this notice, we publish the new version here with a new version date. If the change affects what you agreed to, we ask for your consent again the next time you sign in.

Questions about this page, privacy requests and complaints: [Privacy and grievance contact: to be confirmed by the owner]