Privacy Policy

This Privacy Policy applies to Obelion Terminal (the “service”), operated by Obelion Inc. (“we”, “us”, or “our”), including our website at https://obelion.net and our desktop and mobile applications. For the purposes of applicable data protection laws, Obelion Inc. is the data controller responsible for your personal data processed through the service.

This policy does not apply to third-party websites, products, or services that we do not own or control, even where they are linked from within the service. We encourage you to review the privacy practices of any third-party services you use.

We collect the following categories of information:

• Account data. When you register, we collect your email address and authentication credentials. Authentication is handled through Supabase Auth; we do not store your raw password.
• Profile and preferences. Settings, watchlists, saved layouts, indicator configurations, and other preferences you create while using the service.
• Usage, device, and log data. Information automatically collected when you interact with the service, such as IP address, browser and device type, operating system, pages and features used, timestamps, and diagnostic or crash data.
• Content you post. Chat messages, images you upload, replies, likes, your username and avatar, and your Arena rounds, trades and scores. Chat and Arena activity is visible to other users by design.
• Linked accounts. If you sign in with Google or link Discord, we receive the basic profile those services share (such as your email address, name and account id).
• Session replay and analytics. With your permission, a record of how you use the platform: pages viewed, clicks, scrolls and a visual replay of the session. See “Session replay and analytics” below.
• Security logs. Technical records of requests made to our servers. See “Security logging” below.
• Referral data. If you arrive through a partner’s link, the referral code and the partner it belongs to.
• Support content. The content of support tickets, correspondence, and any information you voluntarily provide when contacting us.
• Payment data. Subscription and billing transactions are processed by Stripe. We receive limited information such as your subscription status and the last four digits of your card and billing metadata. We do not store full payment card numbers.
• Cookies and local storage. We use cookies and similar technologies to keep you signed in, remember preferences, and operate the service. See “Cookies and tracking” below.

We use the information we collect to:

• provide, operate, and maintain the service;
• authenticate you and secure your account;
• process subscriptions, billing, and related transactions;
• detect, prevent, and respond to security incidents, fraud, abuse, and other harmful activity;
• respond to your support requests and communicate with you;
• investigate bug reports, feedback and other submissions you send us, including by reviewing the session in which the problem happened;
• analyze usage to understand, maintain, and improve the service and develop new features;
• comply with our legal obligations and enforce our agreements, including the Terms.

If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases to process your personal data:

• Performance of a contract. To provide the service you have requested, manage your account, process your subscription, run the Arena and chat, and handle the bug reports and support requests you send.
• Consent. Session replay, product analytics, A/B testing and long-lived referral cookies, given in the cookie banner or Cookie settings, and optional communications. Consent is separate from accepting the Terms, using the platform never depends on it, and you can withdraw it at any time from Cookie settings in the footer.
• Legitimate interests. To keep the service and its users secure (including the security logging described below), prevent fraud and abuse, and maintain the service, where those interests are not overridden by your rights.
• Legal obligation. To comply with applicable laws, regulations, and lawful requests.

We do not sell your personal data. We share information only in the following circumstances:

• Service providers and sub-processors who process data on our behalf and under our instructions, including: Supabase (database and authentication), Stripe (payment processing), Resend (transactional email), PostHog (product analytics and session replay, only with your consent), Backblaze (file storage), Google and Discord (only if you sign in or link through them), and our hosting providers.
• Legal and safety disclosures. Where required to comply with applicable law, legal process, or enforceable governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others, and to investigate fraud or security issues.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to this policy.

With your permission, we use PostHog to record how the platform is used: pages viewed, clicks, scrolls and a visual replay of the session. We use it for two things: to investigate bug reports, feedback and other submissions you send us, by looking at what happened on screen when the problem occurred; and to find broken or confusing parts of the platform and improve them.

• Private. Recordings are viewed only by Obelion staff working on support and product. We never sell them, never share them with advertisers, and never publish them.
• Masked. Text you type into fields, including passwords and payment details, is masked before it leaves your device, and chart canvases are not captured.
• Your choice. Nothing is recorded until you allow analytics in the cookie banner or Cookie settings, and you can switch it off at any time, which stops recording immediately.
• Retention. Recordings are kept for up to 90 days, then deleted. A recording attached to an open bug report may be kept until the report is resolved.

To protect the service and its users, our servers log technical details of the requests they receive: IP address, the page or endpoint requested, the time, the response, and your browser’s user agent. We use these logs only to detect and block attacks such as injection attempts, credential stuffing, scraping and abuse, to rate-limit traffic, and to investigate security incidents.

We do not use security logs for analytics or marketing, we do not log passwords, tokens or payment details, and we keep the logs for up to 90 days unless one is needed to investigate a specific incident. This processing is based on our legitimate interest in keeping the service secure (GDPR Recital 49), happens on our own servers, and does not store anything on your device, so it does not depend on cookie consent.

We are based in the United States, and your information may be processed and stored in the United States and in other countries where we or our sub-processors operate. These countries may have data protection laws that differ from those in your jurisdiction.

Where we transfer personal data across borders, we take steps to ensure appropriate safeguards are in place, such as standard contractual clauses or other lawful transfer mechanisms, to protect your information consistent with this policy and applicable law.

We retain your personal data for as long as your account is active or as needed to provide the service to you. We may retain certain information for longer where required to comply with legal, tax, or accounting obligations, resolve disputes, or enforce our agreements.

• Session replays and analytics events: up to 90 days.
• Security logs: up to 90 days, longer only for an open incident.
• Payment and tax records: as long as tax and accounting law requires.
• Records of your acceptance of our Terms and Privacy Policy: for as long as your account exists and for the period afterwards in which a claim could be brought.

Record of consent. When you accept our Terms and this Privacy Policy, for example by ticking the agreement box during sign-up or onboarding, we record your account ID, the date and time of acceptance, and the version of the documents you accepted. We keep this record to show that you agreed, to know which version applies to you, and to defend legal claims. We rely on our legitimate interest, and on our legal obligations where they apply, for this processing.

You may request deletion of your account and associated data (see “Your rights and choices” below), or delete it yourself from your account settings. We will honor such requests subject to information we are legally required or permitted to retain.

We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. These include encryption in transit, access controls, and authentication safeguards.

However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee its absolute security, and you provide information to the service at your own risk.

Depending on your location, you may have the following rights regarding your personal data.

GDPR / UK GDPR rights

• access to the personal data we hold about you;
• rectification of inaccurate or incomplete data;
• erasure of your data in certain circumstances;
• restriction of processing in certain circumstances;
• data portability;
• objection to processing based on legitimate interests;
• withdrawal of consent where processing is based on consent.

California (CCPA / CPRA) rights

• the right to know what personal information we collect and how it is used;
• the right to request deletion of your personal information;
• the right to correct inaccurate personal information;
• the right to opt out of the “sale” or “sharing” of personal information. We do not sell your personal data or share it for cross-context behavioral advertising, and we honor Global Privacy Control signals.

You can change your cookie and analytics choices at any time from Cookie settings in the footer. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, contact us at privacy@obelion.net. We will respond consistent with applicable law. You will not be discriminated against for exercising your rights, and you may have the right to lodge a complaint with your local data protection authority.

We use cookies, local storage, and similar technologies to operate the service, keep you signed in, remember your preferences, and understand usage. Anything beyond what the service strictly needs waits for your consent. For the full list, how long each lasts and how to manage them, see our Cookie Policy.

The service is not directed to, and is not intended for use by, anyone under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at privacy@obelion.net and we will take steps to delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy here, revise the “Last updated” date above, and tell account holders by email or in the app before the change takes effect. Your continued use of Obelion Terminal after an update becomes effective constitutes your acceptance of the revised policy.