Privacy Policy

Effective Date: November 2, 2026

This Privacy Policy explains how Suzhou Guanlan Jianwei Information Technology Studio, the operator of DayTradeDrill ("DayTradeDrill", "we", "us", or "our"), collects, uses, stores, and discloses information when you use DayTradeDrill.

1. Who We Are and How to Contact Us

Operator: Suzhou Guanlan Jianwei Information Technology Studio Place of Registration: Suzhou, Jiangsu Province, People's Republic of China Website: https://daytradedrill.com Privacy and Support Contact: support@daytradedrill.com

2. Information We Collect

Depending on how you use the Service, we may collect the following categories of information.

2.1 Account Information

This may include your email address, account identifier, authentication information or tokens provided by an authentication service, account settings, plan status, and account-creation or login timestamps. When you register, we also keep a limited record of your agreement to the Terms of Service and acknowledgment of this Privacy Policy, including the account identifier, document versions and content hashes, and server-recorded acceptance time. We do not include your IP address or device fingerprint in that consent record.

We do not need or request your payment-card number in order to operate the Service. Payment-card information used at checkout is handled by Paddle and its payment partners.

2.2 Subscription and Transaction Information

We may receive transaction-related information from Paddle, such as a Paddle customer or transaction identifier, subscription status, purchased plan, billing interval, transaction status, renewal or cancellation status, currency, and limited billing or tax-related metadata needed to manage access and support.

2.3 User Content

We do not collect or upload historical K-line or other market-data files that you import for local replay. Those files are processed in your browser and remain on your device.

When you use account features, we store saved replay-session review results, including the session settings, performance summary, and related simulated trade records. Pine scripts remain in your browser unless you choose cloud synchronization; when you use that feature, we store the scripts and related settings needed to synchronize them to your account.

Private strategy code and private indicator code are not used to train general-purpose AI or machine-learning models unless you separately and affirmatively opt in.

2.4 Technical, Usage, and Security Information

Our infrastructure providers may process technical information needed to deliver and secure the Service, such as IP address, browser type, operating system, approximate region derived from IP, request timestamps, error logs, and security events. We calculate performance statistics from your replay sessions to provide your session review. If you use an article like button, we also process the article identifier, reaction state, and a one-way hash of a random first-party browser identifier to prevent duplicate likes and remember your choice. The public count is aggregated; the reaction table does not store the raw browser identifier. Optional, consent-based product analytics are described in Section 2.7. We do not use cross-site advertising tracking.

2.5 Support and Communications

If you contact us, we may collect your email address, message content, attachments, diagnostic information you provide, and records of our communications with you.

2.6 Cookies and Similar Technologies

We use cookies and similar browser storage for authentication, security, session management, and features you choose to use. Authentication and CSRF cookies support sign-in and protect account requests. First-party localStorage stores the selected language and chart preferences; sessionStorage carries replay setup and session state between the training screens. These values support site features and are not used to track your browsing across unrelated websites.

The first-party dtd_cookie_consent cookie stores your separate optional external-media and product-analytics choices as a version and yes/no values for up to six months. It contains no unique visitor identifier and is used to remember and apply your preference. You can change it at any time using Cookie settings in the site footer. YouTube and Vimeo embeds on Blog pages do not load until external media is enabled. Choosing not to enable it leaves the embedded player blocked; an external video link is still available for a user-initiated visit to the provider.

The Blog creates a first-party, HttpOnly blog_visitor cookie containing a random identifier only after you use an article's Like control. It lasts up to 12 months so that the feature can remember that browser's reaction. The reaction service stores a SHA-256 hash of the identifier with the article ID and reaction timestamp; it does not store the raw browser identifier or the visitor's IP address in the reaction table. Reaction records older than 12 months are removed when the service next processes a read request. You can remove a reaction in the same browser while its cookie remains available. Clearing the cookie stops the browser from being recognized but does not immediately delete an existing reaction record, which ages out under the retention period above.

We do not add advertising cookies. Optional product-analytics storage is described in Section 2.7. The account billing interface loads Paddle.js to provide subscription price previews and billing actions; Paddle may process technical data under its own privacy and cookie practices when those features are used. See Paddle's GDPR information. Cookie settings for Blog media do not disable the sign-in, security, or billing features you request. The information and settings in this section describe the current implementation and should be reviewed for the jurisdictions in which the Service is offered.

We do not use these technologies to sell personal information or to share personal information for cross-context behavioral advertising. If our practices materially change, we will update this Policy and provide any controls required by applicable law.

2.7 Optional product analytics (Amplitude)

Product analytics are disabled until configured by us and permitted by you. You can enable or withdraw this separate optional choice in Cookie settings. External-media permission does not enable analytics. Declining or withdrawing analytics does not prevent training, sign-in, saving, or payment.

When enabled and permitted, we send Amplitude a random browser identifier, a pseudonymous site account ID after sign-in, event timestamps, language, known page categories, subscription plan, and limited interaction events such as starting training, viewing a review, importing data, running Pine, sharing/exporting, or completing a subscription payment. We send bounded durations, counts and error codes. We do not send email, passwords, login tokens, complete URLs/query strings, CSV content or filenames, Pine code, notes, or trade-by-trade financial details. Our gateway does not forward your browser IP or user-agent to Amplitude; infrastructure providers still process requests as described above.

The preference cookie lasts up to six months. When analytics are active, first-party localStorage holds the random browser ID, sessionStorage holds a browser-session ID and deduplication/limited training state, and an HttpOnly first-party grant cookie links permitted events to a verified account when signed in (up to six months). Withdrawal removes browser analytics identity and unsent analytics state and stops subsequent collection; requests already in flight may complete. It does not retroactively delete previously received events. Account deletion queues removal from Amplitude; provider processing is asynchronous. Contact us for other deletion requests.

Amplitude processes permitted analytics events in the United States for our US-region project. Events are retained under the retention settings and service terms applicable to that project, unless removed sooner following a deletion request. We do not currently enforce automatic deletion after 180 days. Withdrawing analytics consent stops subsequent collection but does not itself erase previously received events; contact us to request deletion. Delivery queues expire after at most 24 hours. Amplitude privacy information.

3. How We Collect Information

We collect information:

• directly from you when you register and accept the applicable legal documents, save replay-session results, choose to synchronize Pine scripts, configure account settings, or contact us;
• automatically when you use the Service;
• from Paddle in connection with purchases and subscriptions; and
• from service providers that help us operate authentication, hosting, security, monitoring, or other technical functions.

4. How We Use Information

We may use information to:

• create and maintain accounts;
• authenticate users and protect account security;
• provide chart replay, backtesting, code execution, cloud synchronization, storage, and related features;
• determine plan entitlements, quotas, and subscription status;
• process and support subscriptions in coordination with Paddle;
• diagnose bugs, improve performance, and maintain reliability using technical and security information;
• prevent fraud, abuse, unauthorized access, and security incidents;
• respond to support, privacy, and legal requests;
• enforce our Terms of Service and other policies;
• comply with applicable laws, legal process, and lawful requests; and
• calculate and display performance statistics for your saved replay sessions. With your permission and when enabled, we also analyze use of training and subscription features as described in Section 2.7.

5. How We Disclose Information

We do not sell your personal information.

We may disclose information in the following circumstances.

5.1 Paddle

Paddle acts as Merchant of Record for paid subscriptions. Information necessary to complete and manage transactions may be exchanged between DayTradeDrill and Paddle. Paddle processes buyer information under its own privacy notice and buyer terms.

5.2 Service Providers

We rely on the following service providers to operate DayTradeDrill:

• Cloudflare provides website and Worker hosting, edge processing, and related infrastructure. It may process network and request metadata and information handled by those services.
• Supabase provides account authentication and database services. It processes account identifiers and email addresses and stores saved session review results, any Pine scripts you choose to synchronize, and pseudonymous article reaction records.
• Paddle processes checkout, payment, subscription, tax, and transaction-support information for paid plans.
• Resend provides email-delivery services. It may process recipient addresses and delivery metadata for messages sent through its service.
• Amplitude processes optional product-analytics identifiers and limited usage events described in Section 2.7, only with your permission. We use its US data region.

Each provider processes information under its own terms and privacy practices and as needed to provide its services to us.

5.3 Legal, Safety, and Security Reasons

We may disclose information if we reasonably believe disclosure is required by law, legal process, court order, or a lawful government request, or is reasonably necessary to protect users, prevent fraud or abuse, investigate security incidents, or protect our rights and systems.

5.4 Business Transfers

If the Service or its business is reorganized, sold, merged, or transferred, information may be transferred as part of that transaction, subject to applicable law and appropriate protections.

6. No Sale of Personal Information; No Cross-Context Behavioral Advertising

We do not sell personal information for money or other valuable consideration, and we do not share personal information for cross-context behavioral advertising as those concepts are generally used in U.S. state privacy laws.

We do not sell, license, or disclose private User Content to data brokers or advertisers for their independent marketing purposes.

If these practices change, we will update this Policy before the change takes effect and provide legally required choices.

7. Data Retention

We retain information for as long as reasonably necessary to provide the Service, maintain your account, comply with legal and accounting obligations, resolve disputes, prevent abuse, and enforce agreements.

In general:

• account information is retained while your account remains active. When you complete self-service account deletion, your profile and account content are removed from active account systems, subject to reasonable backup cycles and lawful retention;
• a minimal account identifier may remain in the legal-consent record and in deletion or subscription-cancellation audit records to demonstrate which document versions applied, establish that deletion was completed, and reconcile any required subscription cancellation. We retain these records only as reasonably necessary for legal, security, support, accounting, and dispute purposes;
• historical market-data files imported in your browser are not received or retained by DayTradeDrill. Saved session review results and Pine scripts stored through cloud synchronization are removed from active account systems when account deletion is processed; Pine scripts that remain only on your device are not affected;
• technical and security logs may be retained for a limited period appropriate to security, reliability, fraud prevention, and troubleshooting; and
• pseudonymous Blog reaction records are retained while active, can be removed by withdrawing the reaction in the same browser, and are aged out after 12 months when the reaction service processes a subsequent read request; and
• transaction records may be retained by Paddle and may also be retained by us to the extent reasonably necessary for subscription support, accounting, dispute handling, and legal obligations.

We may retain aggregated or de-identified information that cannot reasonably be linked back to you.

8. Security

We use reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure.

No system can guarantee absolute security. You are responsible for using a strong password, protecting your account credentials, and promptly notifying us if you suspect unauthorized access.

9. Your Privacy Choices and Requests

You may request that we, as applicable:

• provide information about the personal information associated with your account;
• correct inaccurate account information;
• request deletion of your account and personal information, subject to lawful retention requirements;
• provide a reasonable export of information or User Content where supported by the Service; or
• stop sending optional marketing communications.

You can delete your account from the Account Dashboard after signing in and confirming the account email. This removes your profile, saved session review results, and cloud-synchronized Pine scripts from active account systems. Active subscriptions are queued for immediate cancellation; provider processing may take time, and deletion does not issue a refund. A minimal identifier may remain in legal-consent or deletion/cancellation audit records, and payment records may be retained or detached where needed for legal, accounting, security, support, or dispute purposes. If you cannot use the self-service flow or want to make another privacy request, email support@daytradedrill.com from the address associated with your account. We may verify your identity before responding.

Even where a particular U.S. state privacy law does not apply to us because of a statutory threshold or exemption, we may choose to honor reasonable access, correction, and deletion requests where technically and legally feasible.

10. California Privacy Disclosures

10.1 California Online Privacy Protection Act (CalOPPA)

If you are a California resident, this Policy is intended to describe the categories of personally identifiable information we collect online, the categories of third parties with whom information may be disclosed, how you may request review or correction of information, how we notify users of material policy changes, and the effective date of this Policy.

10.2 Do Not Track

There is no uniform industry standard for responding to browser "Do Not Track" signals. DayTradeDrill does not currently change its practices in response to a browser Do Not Track signal.

We do not sell personal information or use personal information for cross-context behavioral advertising. If we become subject to a law that requires recognition of a particular legally valid opt-out preference signal for a processing activity we conduct, we will implement the required mechanism.

10.3 Third-Party Tracking

Cloudflare, Supabase, Paddle, Resend, and Amplitude may receive information as described in Section 5. We do not use a third-party advertising or cross-site behavioral tracking service and do not authorize these providers to use information obtained through DayTradeDrill for their own cross-context behavioral advertising.

10.4 California Consumer Privacy Act

The California Consumer Privacy Act, as amended, applies only to businesses that meet statutory criteria. If DayTradeDrill becomes subject to the CCPA, we will provide any additional notices, rights, and mechanisms required by that law.

11. Children

DayTradeDrill is intended for adults and is not directed to children. You must be at least 18 years old to create an account or purchase a subscription.

We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact support@daytradedrill.com so that we can review and, where appropriate, delete it.

12. International Processing

DayTradeDrill is operated by a business registered in the People's Republic of China and uses service providers that may operate infrastructure in other countries. As a result, information may be processed or accessed in the People's Republic of China and in countries where our service providers operate, which may be outside your country or region.

Those countries may have privacy or government-access laws that differ from those in your country or region. We use reasonable contractual, technical, and organizational safeguards appropriate to our operations and the information involved.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version with a revised effective date. If a change materially affects how we use personal information, we will provide additional notice when reasonably appropriate or required by law.

14. Contact Us

For questions, privacy requests, or complaints about this Privacy Policy:

Suzhou Guanlan Jianwei Information Technology Studio Suzhou, Jiangsu Province, People's Republic of China Email: support@daytradedrill.com