Last updated October 25, 2026

Privacy and Cookie Policy

Personal information we collect

The only personal information Tickspycorp itself receives is what you choose to send us through the contact and feedback forms. There is no account, no sign-up, no visitor-analytics beacon and no per-visitor profile. Concretely, we collect:

• Contact form: your name, your email address, and the message you write. A subject line is generated from what you entered.
• Feedback / bug form: your name, your email address, the category you select (Feedback, Bug Report or Feature Request), the message you write, and an optional screenshot (PNG, JPEG, WebP or GIF, up to 5 MB).
• Technical information carried by any web request, including a form submission: IP address, browser and device details, and a timestamp. This is processed by our delivery and mail providers, not stored by us in any database of our own.

Please do not send API keys, passwords, account numbers, brokerage statements or other sensitive financial information. There is no field that needs them, and we do not want them.

How the forms work: FormSubmit and Gmail

This site has no server of its own that stores messages. Both forms post directly from your browser to the relay service FormSubmit (formsubmit.co), which forwards your submission as an email to tickspysupport@gmail.com, an inbox hosted by Google Gmail. We read it there and reply from there.

What happens, step by step: your browser sends the fields you filled in (and any screenshot) to FormSubmit; FormSubmit relays them to the Gmail inbox; the message then sits in that mailbox until we action and delete it. FormSubmit and Google process the contents of the message and ordinary request data such as your IP address under their own privacy policies. Sending a message is entirely optional — you can simply email us, or not contact us at all, and still use every part of the desk.

Why we use it, and our legal basis

We use the information from the forms for exactly one purpose: to read, answer and resolve your request, and to investigate anything you report. We do not sell it, rent it, trade it, use it for advertising, build profiles from it, or use it to make automated decisions about you.

Our basis for handling it is your consent, given by actively submitting the form, plus our legitimate interest in answering support requests and keeping the service working. You may withdraw consent at any time by asking us to delete your message; withdrawal does not affect processing already carried out lawfully.

Legal framework: PIPEDA and Québec Law 25

Tickspycorp is based in Québec, Canada, and handles personal information in line with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and Québec's Act respecting the protection of personal information in the private sector, as modernized by Law 25 (2021, c. 25). In practice this means:

• Identified purposes and plain language. This policy states, in plain terms, what we collect and why, before or at the time of collection.
• Consent. We collect support messages only from you, only when you submit them, and only for answering them and fixing what you report.
• Minimal collection. We ask for the least information needed to reply. Optional fields and screenshots are just that: optional.
• Accountability. One person at Tickspycorp is responsible for personal-information protection (see below), and we can answer for our providers' handling.
• Safeguards. Messages travel over HTTPS and live in a provider mailbox with its own access controls. No system is perfectly secure, but we do not operate our own database of visitors to lose.
• Rights. You can ask to see the information we hold about you, correct it, delete it, or receive it in a structured electronic form — see Your rights.
• Privacy impact. Because our only collection is a form you choose to submit, and any processing outside Québec is limited to delivery providers under contract, we assess the risk to your privacy as low and proportionate to the purpose.

Where your information is handled

Tickspycorp holds support correspondence in Canada, but some of the services used to deliver it may process and store information outside Québec and Canada, including in the United States — in particular FormSubmit and Google Gmail. Providers outside Canada are subject to the laws of their own jurisdictions, and their authorities may be able to obtain disclosure of information held there. Where we rely on such a provider, we choose one that offers contractual privacy commitments, and we do not send more than the message needs.

Retention

Support messages are kept only as long as needed to answer your request, resolve the reported issue, and meet any applicable legal or accounting obligation. When that is done, we delete them. You can ask us to delete a message sooner (see below). Hosting logs and the calendar/news providers keep their own operational or security records for their own periods, which we neither control nor read as a profile of you.

Your rights

Under PIPEDA and Québec Law 25 you may contact us to:

• Access the personal information we hold about you, and be told how it has been used and to whom it has been communicated.
• Correct information that is inaccurate, incomplete or ambiguous.
• Delete information where the law allows, including a support message you no longer want us to keep, and to have a copy of it first.
• Withdraw consent to optional processing, and to object to processing you consider excessive.
• Portability — receive the computerized information you provided to us in a structured, commonly used format.
• De-indexing / cease dissemination of information in defined circumstances, subject to the conditions and exceptions in the law.

Send any request to tickspysupport@gmail.com. We may ask for enough information to verify your identity before acting, so that we do not disclose someone else's correspondence to you. We answer within the time the applicable law requires and, where we refuse a request, we explain why and tell you how to challenge it.

Privacy officer and complaints

The person with the highest authority at Tickspycorp is responsible for the protection of personal information, unless that responsibility is delegated in writing. That person is the privacy contact for this site, reachable at tickspysupport@gmail.com. If you are not satisfied with our response, you may contact the Commission d'accès à l'information du Québec, and for matters within federal jurisdiction, the Office of the Privacy Commissioner of Canada.

Information this site handles without collecting it

Learning exercises and Market Structure: practice inputs, chart gestures, recalculations and historical studies run in your browser. These features do not transmit your entered numbers or record your cursor movements. Practice values are not saved by the application; browser form-restoration behavior may retain them. Opening a page or following a reference link still makes ordinary web requests to its host. Market Structure uses the bars already loaded for the selected symbol; its research controls do not submit those bars to an AI service.

The landing page saves your language choice as tickspy-locale. Remove it by clearing this site's browser data. Translated navigation and introductory text do not mean all desk or legal content has been translated or professionally reviewed.

The desk stores your watchlist, alerts, preferences, and any optional Alpaca API keys in your browser's local storage. Those values are not stored by TickSPY. Alpaca keys are sent only to Alpaca when you choose to connect live data.

Desktop alerts, and the permission they need

Every alert in the desk is made by your browser, in your browser. The desk checks its own rules on the page's clock and, when one is met, your browser shows a system notification, plays a sound you chose at a volume you set, and adds a count to the Alerts tab. Nothing about an alert is sent to TickSPY or to any other server, there is no account, and no third party is told that an alert fired.

The permission belongs to your browser, not to us. The desk asks once, through the standard browser prompt, before any system notification can appear; until you allow it, only the sound and the badge are used. Granting, blocking or withdrawing it is done in your browser's own site settings, and Do Not Disturb or per-site blocking on your system can still suppress a notification. We never receive the choice you made.

The settings are stored locally. Your notification switch, tone, volume, badge and quiet hours are saved in this browser under the single key deskalerts, listed below. No audio file is downloaded: each tone is synthesised in the page. Clearing this site's browser data removes them, and an alert stops working the moment the page closes — an in-page alert cannot reach you with the desk closed, and we say so rather than implying otherwise.

Community comments

The landing page has a public comment wall. It is anonymous by design: there is no sign-up, no email field, no cookie and no profile. When you first open it, your browser generates a random 32-byte key and keeps it in local storage under tickspy-community-key. That key is sent with your posts so the server can recognise your own comments; the server stores only a one-way SHA-256 hash of it, never the key itself. The nickname you see (for example, “Quiet Otter #4821”) is derived from that hash, so it is stable for this browser without being tied to you.

For each comment the server stores: the text you wrote, the generated nickname, the hash of your key, a hash of the text used to detect repeated spam, a timestamp, and a moderation status. It does not store your name, email address, IP address, location, or any advertising identifier. A comment is public the moment it is posted, so write it as something you are content for anyone to read.

Comments are kept until you delete them or we remove them under the moderation rules. The Delete button on your own comment replaces the text with an empty value on the server and marks the row deleted; the row keeps only the keyed hash and a timestamp so the rate limiter cannot be reset by deleting. If you clear this site's browser data, the key is destroyed — the comments stay public, but no browser can prove they are yours, so they can no longer be deleted from the page. There is deliberately no recovery channel, because a recovery channel would require collecting something that identifies you.

An automated filter holds comments that contain slurs, excessive links, shouting, repeated text or injection-shaped markup. Held comments are not public and are reviewed by a person. The moderation console is private and protected by a server-side token; it shows the comment text, the generated nickname, a short prefix of the key hash and timestamps. Do not post personal information, API keys, account numbers or anything about another person.

Google AdSense and cookies

No advertising runtime or advertising cookies are loaded in the current release. If a future deployment enables Google AdSense, the following choices apply. Enabling advertising requires an updated deployment and any consent platform required by Google and applicable law.

Advertising is optional. Until you choose Allow ads, the landing page does not load the Google AdSense runtime or request an ad. If you choose No thanks, no AdSense ad units are requested for that browser.

If you allow ads, this site asks Google for non-personalized ads. Google and its vendors may nevertheless use cookies, local storage, IP address, browser and device data, and similar technologies for ad delivery, frequency capping, fraud prevention, security, and aggregated measurement. Google controls those technologies and may process data under its own policies.

Read Google's Privacy Policy and advertising technology information for details. There is no advertising choice to change in this release because advertising is disabled.

Service providers

Netlify hosts the website and proxies public edge requests to Cloudflare. Both process request information such as IP addresses, requested paths, timestamps, and browser details and may retain operational or security logs according to their own policies. Tickspycorp does not operate an account database or independent analytics system.

Cloudflare also runs the comment API and stores the comment database (D1). Comment text and the pseudonymous record described above are therefore processed and stored on Cloudflare's infrastructure, which may be outside Québec and Canada, under Cloudflare's own privacy and lawful-access terms. The Worker keeps per-IP counters in memory for a few minutes to stop flooding; those counters are never written to the database and disappear with the process.

Google Fonts receives your IP address and browser details when typefaces load. jsDelivr provides TensorFlow.js when the volatility model runs. The model trains in your browser; your credentials and watchlist are not sent to jsDelivr.

With your own credentials, your browser contacts Alpaca directly for data and streams; Tickspycorp's edge proxy does not receive those credentials. Without credentials, your browser loads a replay file from this site's hosting. The currently bundled files contain generated demonstration data, not real market prices. If replaced with verified HF Data Library files, the price source is IEX exchange data. Headlines from public feeds and calendar entries from FairEconomy are requested by our edge server, not your browser. Google Gemini receives public headlines and calendar information from the edge server to produce a shared overview; no user-entered prompts or credentials are sent.

FormSubmit and Gmail process submitted messages as described above. Providers can process and store information outside Québec and Canada, including in the United States. Their privacy practices and lawful access rules may differ from those in Québec.

Choices and browser storage

The calendar normally uses the site's edge service or bundled file. A fallback can request calendar data directly from FairEconomy, in which case that provider receives your browser's normal request information. This release does not include session recordings or a client-side visitor-analytics beacon. Hosting-provider traffic statistics and server logs are separate from those browser features.

Your advertising choice, if made, is saved under tickspy-ad-consent. Desk and landing-page storage includes cfg (optional Alpaca keys), wl (watchlist), deskprefs (your default symbol, timeframe and opening tab), alerts, calalert, calfired, calc (calendar cache), legal (disclosure acceptance), wiz (setup preference), tickspy-community-key (your anonymous comment identity, described above), and deskalerts (how you want alerts to reach you: notification, tone, volume, badge, quiet hours). Storage remains until you clear this site's browser data or remove the relevant item in the desk. Browser-stored keys are not encrypted by TickSPY. Use Paper-account keys and avoid shared devices. If storage is unavailable, preferences are held only for the current page session.

Eligibility and security

The desk is intended for people aged 18 or older. We do not knowingly solicit children's personal information. If such information was submitted, contact us to request its removal. HTTPS and browser security controls reduce risks, but no website or browser storage can be guaranteed completely secure.

Contact and changes

For support and privacy questions, email tickspysupport@gmail.com. This policy may change when site functionality or providers change; this page will show the updated date.