ChartStreak Privacy Policy

Last updated: 16 October 2026

This policy explains what personal data ChartStreak collects, why we collect it, who else sees it, how long we keep it, and what you can do about it. It covers the game on every channel we offer it: the website and installable web app at chartstreak.app, the Telegram Mini App, and the iOS and Android apps.

Two other documents sit alongside this one and are worth knowing about: the Terms of Service, which is the agreement between you and us about using ChartStreak, and the Official Rules of the weekly tournament, which apply if you take part in it.

1. Who is responsible for your data

ChartStreak is built and operated by Pavel Kastsiukou, an individual developer in Cyprus, who is the data controller for the purposes of the GDPR. The same person is named as the developer on the App Store and Google Play listings for ChartStreak.

Postal address: Andrea Zakou 11, 102, Mesa Geitonia 4000, Cyprus.
Privacy questions and requests: [email protected].

2. The short version

We do collect an account identifier and a nickname we generate for you; a device identifier; on Android, a one-way hash of the system device identifier, and on iOS, a one-time Apple DeviceCheck token that we pass to Apple and do not keep — both only until the one-time linking bonus has been given; your e-mail address if you choose to link one; what you played, how you scored, and how you made each prediction; the links you publish to share a game; purchase, prize and payout records; a one-way hash of your IP address and the country derived from it; the country and the app your account was created from; if you turn on streak reminders in the iOS or Android app, a push-notification token and your time zone; and any support message you send us.
We never collect card numbers or bank details, identity documents, precise location, contacts, photos, files, your calendar, advertising identifiers, or anything about what you do in other apps or on other websites.
We never do sell your personal data, hand it to advertising networks, or show you advertising. There is none in ChartStreak.
You can play practice rounds, the simulator and shared charts without giving us an e-mail address at all; turn analytics off; and delete your account yourself at any time, from inside the app or from a browser.

3. Who ChartStreak is for

ChartStreak is an educational trading simulator. You predict where a price went next on a chart that has already happened, using historical market data. Nothing you do in the game is a real trade, and nothing in it is investment advice.

You must be 18 or older to hold an account, and the same applies to the weekly tournament. ChartStreak is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, write to [email protected] and we will delete it.

4. What we collect, why, and on what legal basis

Data Why we need it Legal basis (GDPR Art. 6)
Account and device identifiers. An account identifier and a nickname, both generated by us — you do not enter either. A device identifier generated by the app. In the Telegram Mini App, your Telegram user id. The country your account was created from, as reported by our network provider from your IP address at that moment, and the app it was created in (web, iOS, Android or Telegram); both are recorded once and never updated. To let you start playing without registering and to keep your game when you come back; to sign you in; to tell duplicate accounts apart; to understand where our players come from. Performance of a contract (b); our legitimate interest in keeping the game fair and in understanding where our players come from (f).
Device check — Android and iOS apps. When you link an e-mail address, and when you start a game, the Android app sends us the system identifier Android assigns to it (ANDROID_ID). It is specific to this app: every app gets a different value, so it cannot be used to follow you between apps, ours or anyone else's. We never store it as it is — only a one-way hash made with a secret salt. The app stops sending it once the bonus below has been given to your account, from the next time the app refreshes your account details. If the bonus was refused instead, because this device had already collected it, the app keeps sending the identifier: you can ask us to clear that mark (see section 9), and we would have no way of acting on such a request if the app had already stopped telling us which device you are on. The iOS app sends no identifier at all: at the same moments it asks Apple's DeviceCheck service for a one-time token and sends us that. We pass the token straight to Apple to read, and after the bonus is given to set, a single flag Apple keeps for that iPhone on our behalf — “the linking bonus has been given here” — and we do not keep the token. Apple tells us nothing about the device except that flag, and the flag survives erasing the iPhone. Of an iOS bonus we record only your account, that it was on an iPhone, and when. Browsers and the Telegram Mini App send neither, because a browser has no such identifier. To give the one-time bonus for linking an e-mail address once per device rather than once per reinstall or device reset. Nothing else reads it: it is not used for analytics, profiling or advertising. Our legitimate interest in keeping the game fair (f) — the bonus is paid from real money, and without this the same phone could collect it again after every reinstall.
Streak reminders — iOS and Android apps, only if you turn them on. When you agree to reminders, the app asks your phone for permission to show notifications and, once you allow it, sends us a push-notification token issued by Google's Firebase Cloud Messaging for this installation of the app, whether it is an iPhone or an Android phone, the app version, and your time zone name (for example Europe/Berlin). It sends them again each time the app starts, because the token and your time zone can change. We also record on which day we reminded you, so we never remind you twice about the same day. The app asks for none of this before you agree, and neither the website nor the Telegram Mini App sends it. To send you one reminder a day, in the evening of your time zone, while your streak is alive and today's game is not yet finished — and never more than one a day. Consent (a). You can withdraw it at any time: switch Reminders off in your profile, or turn notifications off for ChartStreak in your phone's settings.
E-mail address — only if you link one. The address, plus one-time sign-in codes stored as hashes, never in readable form. The daily challenge and the tournament are open to accounts with a linked address, because a prize has to reach someone. The address is also how you sign in on a new device, and where receipts, prize notices and notices of changes to our terms, tournament rules and this policy go. Contract (b); legitimate interest in fraud prevention (f); consent (a) for optional product e-mails, which you may withdraw at any time.
Game data. Rounds played, your predictions and scores, streaks, daily and weekly results, practice settings, chart-of-the-day votes. To run the game, the leaderboards and the tournament. Contract (b).
How each prediction was made. Every prediction the app sends carries a few measurements of the round: how long the chart took to draw, how soon after it appeared you first moved the prediction line, how long you took to submit, how many times you moved the line, and whether you last dragged it, tapped the chart or typed a value. We keep them with the submission, whatever its outcome — including a submission that came too late or was sent twice. To review a disputed result, and to tell a person playing from automated play: our own clock decides the timer, and a large gap between it and the app's measurement, or a prediction submitted without the line ever being moved, is what we look at. Our legitimate interest in a fair competition and in protecting the prize fund (f).
Links you publish. When you share a game with “play my chart”, the link is published: anyone who has it can open it and see the charts of that game, your nickname and score, and the nickname and score of everyone who played through it. We record that the game was published and when. To let others play the charts you shared and compare results with you. Contract (b).
Purchases. Channel, plan, amount, currency, status, subscription period, and the transaction identifier issued by the payment channel. For payments made in Telegram Wallet, also the invoice asset, amount, deposit address, memo and transaction hash. To give you the subscription you paid for, to handle refunds and disputes, and to keep the books. Contract (b); legal obligation for accounting records (c).
Prizes and payouts. Prize awards — including the record of a weekly prize withheld or withdrawn — and the entries our payout ledger makes for partner prizes. A prize is paid in days of ChartStreak Premium added to the account that won it. There is no cash option, so there are no payout details to collect: we never ask you for a wallet address, an exchange handle or a recipient name. To award prizes and to keep the record of what was awarded and what was given out. Contract (b); legal obligation for accounting records (c).
Anti-fraud signals. A one-way hash of your IP address, computed with a secret salt — we do not store the address itself, and the hash cannot be turned back into it. From the address we also derive and store the country and the network operator (ASN). A one-way hash, computed the same way, of your device identifier — the random identifier in the score.device cookie on the web, or the one the app creates when it is installed — so that we can see several accounts being signed in to from one device. Plus the channel you played on, how many requests came in, and any risk flag raised on the account. To spot multi-accounting, automation and prize farming, so that the competition and its prizes stay honest. Our legitimate interest in a fair competition and in protecting the prize fund (f).
Bot check on web sign-in. When you ask for a sign-in code in a browser, Cloudflare Turnstile looks at signals from your browser and passes us a one-time token. We send the token back to Cloudflare and receive only whether the check passed; we store neither the token nor the answer. To keep automated sign-ups and floods of sign-in codes out. Our legitimate interest in protecting accounts and our e-mail service from abuse (f).
Support requests. The text of your message, the address you ask us to reply to, and the app version, language, channel and screen it was sent from. To answer you and to reproduce the problem you describe. Contract (b); legitimate interest in running support (f).
Session data. Session tokens stored as hashes, with their issue and expiry times. To keep you signed in, to rotate credentials, and to let you revoke other sessions. Contract (b); legitimate interest in security (f).
Analytics and error reports. Product events from a fixed dictionary — no free text, and no automatic capture of page views or clicks. Error reports carry your account identifier and the technical detail of the failure, including the device model and system version. Events sent from our servers are not tied to a person at all. To see which parts of the game are used and to find crashes before you have to report them. Error reports: legitimate interest in maintaining the service (f). Analytics: legitimate interest in improving the service (f); in the European Union, the European Economic Area and the United Kingdom — your consent (a), and until you answer the question the app asks, analytics is not started. You can switch both off in every channel — see section 10.

5. What we do not collect

This list is as much a part of the policy as the one above, and it is deliberately specific:

The historical market data the game is built on describes instruments and prices. It contains nothing about you.

6. Cookies and on-device storage

ChartStreak sets no advertising cookies and no cross-site trackers. What it does set:

Name Kind What it is for
score.session First-party cookie, HttpOnly Keeps you signed in. Essential.
score.device First-party cookie, HttpOnly Recognises your device so a guest game is not lost when you come back. Essential. A hash of it is also kept as an anti-fraud signal (section 4).
score.chart.indicators Local storage Remembers the chart tools you switched on. Essential.
score.telemetry-opt-out Local storage Remembers your choice about analytics — allowed or not. Essential.
score.error-reports-opt-out Local storage Remembers that you turned error reports off. Essential.
PostHog keys Local storage The analytics identifier. Written only while analytics is on.
score.review-request App storage, iOS and Android apps only Remembers when the app last requested a store review on this installation, to limit how often it asks. The timestamp is kept in app storage and is not sent to our servers.
score.reminder-prompt App storage, iOS and Android apps only Remembers that you already answered the offer to turn on streak reminders, so it is not shown again. Essential.
score.reminder-prompt-shown App storage, iOS and Android apps only Remembers that the offer to turn on streak reminders was already counted as shown, so showing it again is not counted twice. Essential.
score.chart-tap-hint Local storage; app storage in the iOS and Android apps Remembers that you closed the "tap the chart" tip or already placed a forecast on the chart, so the tip is not shown again. Essential.
score.session-token Local storage, Telegram Mini App only Keeps you signed in inside Telegram, where the cookies above are not available to us. Essential.

In the iOS and Android apps there are no cookies. The session token and the device identifier are held in the iOS Keychain and the Android Keystore instead. In the Telegram Mini App the page runs inside a frame on Telegram's own domain, so our cookies do not reach it: the session token is kept in the page's local storage, and no device identifier is stored at all — Telegram identifies you to us itself.

7. Who else sees your data

We do not sell personal data and we do not give it to advertising networks. We use the processors below. Each of them acts only on our instructions and is bound by a contract to protect your data to at least the standard set out in this policy.

Processor What it receives Why
PostHog (analytics, EU region by default) Product events. No name, no e-mail address, no message text. To understand how the game is used.
Sentry (error monitoring, EU region) Technical error reports carrying your account identifier. To find and fix failures.
Twilio SendGrid (e-mail delivery) Your e-mail address and the letter being sent. Sign-in codes, receipts, prize and balance notices, notices of changes to our terms, tournament rules and this policy.
Paddle (merchant of record for web subscriptions) What you enter at their checkout, plus a reference that lets us match the payment to your account. To take payment and issue an invoice.
Apple, Google In-app purchase and subscription data. To take payment through the store you bought from.
Apple (DeviceCheck) The one-time DeviceCheck token your iPhone produced, until the linking bonus has been given. To read and set the flag that the linking bonus has been given on that iPhone.
Google (Firebase Cloud Messaging); on iPhones also Apple The push-notification token of your app installation and the text of each reminder — only if you turned reminders on. To deliver streak reminders. On iPhones Firebase hands the reminder to Apple's push service, which delivers it.
Telegram Your Telegram user id, and the invoice if you pay in Telegram Wallet. To run the Mini App and to accept payment there.
Cloudflare, Inc. (network and bot protection) Every request to chartstreak.app passes through it, with your IP address. On the web sign-in form its Turnstile check also reads signals from your browser to tell a person from a bot. To deliver the site and to keep automated sign-up and sign-in attempts out.
DigitalOcean, LLC Everything held in our database and server logs. To run the servers the game lives on.

Beyond that, we disclose data only where we have to:

8. Where your data is processed

Our servers are in Amsterdam, the Netherlands; analytics is configured to the EU region by default, and error reports are stored in the EU region. Some of the processors above may process data outside the European Economic Area; where they do, the transfer is covered by the European Commission's Standard Contractual Clauses or another mechanism permitted under Chapter V of the GDPR.

9. How long we keep it

Data Kept for
Anti-fraud observations (hashed IP, hashed device identifier, country, ASN) Deleted 30 days after they were recorded.
Sign-in codes and e-mail linking requests Valid for minutes; the record is removed by a daily clean-up once it has expired.
Sessions Removed by the same daily clean-up once they have expired or been revoked.
Account (including the country and app it was created from), identities, e-mail address, support messages Until you delete your account.
Salted hashes of an e-mail address — one caps how many letters we send to it, the other records that the one-time bonus for linking it has already been given — and, in the same record as the second, a salted hash of the device or Telegram identity the bonus was granted to Kept indefinitely, including after an account is deleted. All of them are hashes made with a secret salt and cannot be turned back into the address or the identity behind them; the first one is written for any address a sign-in code is requested for, even if no account is ever created.
A salted hash of the Android system device identifier, recording that the linking bonus has been given on this device Kept until the bonus is no longer restricted on that device — in practice, indefinitely. It is a hash made with a secret salt and cannot be turned back into the identifier. If you share a device with someone else who now cannot get the bonus, write to us and we will clear the mark.
A record that the linking bonus was given to your account on an iPhone, and when; Apple's flag for that iPhone Our record is kept indefinitely, like the hash above. Apple keeps its flag under its own rules, and we cannot clear it for one device: there is no list of flagged devices to clear it from. If you share an iPhone with someone who now cannot get the bonus, write to us and we will allow the bonus for their account instead.
Push-notification tokens and your time zone, if you turned streak reminders on; the record of the days we reminded you Until you delete your account. A token is removed sooner when Firebase reports it is no longer valid — for example after the app is uninstalled — or when you have used the app on more than five devices and it is the one used longest ago. Switching reminders off stops them at once, but keeps the token so they can be switched back on.
Game, streak and leaderboard history, including the measurements sent with each prediction and the links you published Kept — but once you delete your account it no longer points to an identifiable person. A published link keeps working after you delete your account, under your generated nickname.
Purchase, prize and payout records As long as accounting and tax law require. These survive account deletion: a prize that was paid has to stay in the books.
Backup copies of our database Kept for up to 28 days, then deleted. Anything you delete, or that is deleted with your account, can remain in these copies until they expire; we use them only to restore the service after a failure.

10. Your choices

Analytics and error reports

If you are in the European Union, the European Economic Area or the United Kingdom, the app asks before it starts analytics. Until you answer, analytics is not started; closing the question without an answer leaves it off, and the app asks again next time. We tell where you are from the country of your connection, as reported by our network provider. Error reports do not wait for this question: they rely on our legitimate interest in keeping the app working, and you can object to them with the switch below. Answering the question affects analytics only: declining it leaves error reports on.

On the website, in the installable web app, in the Telegram Mini App and in the App Store and Google Play apps there is a switch in Profile. Turning it off does not merely silence the reports: neither the analytics nor the error-reporting SDK is started at all, so no analytics identifier is written to your device.

The switch covers analytics and error reports only. It does not change what the game itself needs to work: your predictions, and the measurements described in section 4 that travel with each of them, are still sent to our servers and kept, because a prediction cannot be scored, or a disputed result reviewed, without them.

Product e-mails

Sign-in codes, receipts, notices about your prizes and balance, and notices of changes to our terms, tournament rules and this policy are part of the service and are sent regardless. Optional product e-mails are sent only if you agreed when linking your address, and you can withdraw that agreement by writing to [email protected].

11. Deleting your account

You can delete your account yourself, without asking us:

What deletion removes: your identities (device, e-mail, Telegram), e-mail linking requests and sign-in codes, all sessions, your agreement to product e-mails, the country and app your account was created from, and your support messages.

What stays, and why: purchase, prize and payout records stay because the law requires them to. Your generated nickname and your placements in finished leaderboards stay because rewriting weeks other players already played is not something we are willing to do. The salted hashes in section 9 stay as well — of an e-mail address, of the device or Telegram identity the linking bonus was granted to, and, on Android, of the system device identifier it was granted on; so do the record that the bonus was given on an iPhone and Apple's flag for it: together they are what stops the same address or the same phone from collecting that bonus over and over, and none of them can be turned back into what it was made from. A link you published with “play my chart” stays too, and keeps opening for anyone who has it: the charts of that game, your score and the results of everyone who played through it, under your generated nickname — deleting the account does not take the link down. After deletion, none of it points to you: the identities that said who you were are gone. The one exception is our backup copies of the database: whatever deletion removed can remain in them for up to 28 days, until they expire, and they are used only to restore the service after a failure (section 9).

Deletion is final — you cannot sign back in afterwards. If you have an unclaimed prize, a balance or a payout in flight, collect it first; the app will not let you delete the account until you have.

12. Your rights

Under the GDPR you have the right to access your data, to have it corrected, to have it erased, to restrict or object to how we process it, to receive it in a portable form, and to withdraw any consent you gave. We apply these rights to everyone who plays ChartStreak, not only to people in the EEA.

To exercise any of them, write to [email protected]. We answer within one month. We may ask you to confirm the e-mail address linked to the account, because we have no other way of telling that the account is yours.

If you think we have handled your data badly, you can complain to the data protection authority where you live, work, or where the problem happened.

13. How we protect your data

No system is perfect, and we will not pretend otherwise. If a breach ever affects your data, we will notify the competent supervisory authority and, where the law requires it, you.

14. Changes to this policy

When this policy changes, the new version is published at this address with a new date at the top. If a change materially affects how we use your data, we will say so before it takes effect, by e-mail to the address linked to your account, if there is one, and at the top of this page.

15. Contact

Privacy questions and requests about your rights: [email protected]
Anything else: [email protected]
Post: Pavel Kastsiukou, Andrea Zakou 11, 102, Mesa Geitonia 4000, Cyprus.