Privacy Policy

Who looks after your data

Alchemy Intelligence Ltd (UK, company number 17128184, registered office 5 Brayford Square, London, E1 0SG, United Kingdom) runs Wickproof and is responsible for your personal data.

Data Protection Lead (our Information Officer under South Africa's POPIA): contact support@wickproof.com for any question or request about your personal data, and put "Privacy" in the subject so it reaches the right person.

What we collect

• Account: your email address, and the name, location and "about" text if you add them.
• What you create: your practice journal, chart drawings, indicator and strategy setups, and saved AI chats, so they follow you between devices.
• AI requests: the questions you ask the AI and the chart facts sent with them. They go to Anthropic to be answered. We don't store them unless you save the chat or rate the answer; our AI cost log records only the size, cost and time of each request, never your words.
• Trading profile (optional): if you tell the AI how you trade (markets, style, experience, risk per trade, timeframe, focus), we store that profile with your account and send it to the AI with your questions to tailor its answers. You can change or clear it at any time, and deleting your account removes it.
• Terms: which version of our Terms you agreed to when you signed in, and when.
• Usage counts: how many people open our public pages each day (no cookies, no IP addresses), and whether your account has opened the chart and logged a practice trade, so we can see where Wickproof needs to get easier.
• AI ratings: if you tap or on an AI answer, we keep your rating with that question, the answer and the chart facts, to find and fix answers that were wrong. Screenshots are never kept.
• AI answers: each question you ask the AI chat, the market it was about and the AI's answer, kept for 90 days so we can check the answers are right and improve them. Screenshots are never kept. If you switch on trade calls, we also keep when you accepted the risk statement.
• Payments: your plan and payment status. Card details are handled by Stripe and never reach us. For USDT we keep the transaction ID you give us.
• Security: your IP address, held briefly in memory to stop abuse such as repeated sign-in attempts, and basic server logs of errors.

Cookies and browser storage

• Sign-in cookie (30 days): keeps you signed in. Needed for the service to work.
• Trial cookie (2 years): notes that this browser has already signed in to an account, so each person gets one free trial. Holds no personal details.
• Google sign-in check (10 minutes) and chosen plan (1 hour): short-lived cookies that make Continue with Google safe and take you to the plan you picked after you sign in.
• Referral cookie (90 days): only if you arrive through a partner's link AND tap Accept when we ask. It records which partner sent you, so they can be credited if you subscribe.
• Error reports: if a page breaks in your browser, it tells us the error message, the file and line, the page and your browser type (for example "Chrome mobile"), so we can fix it. No account details, cookies or chart contents, and reports are deleted after 14 days.
• Browser storage: your practice journal, drawings, chart settings, layouts and saved AI chats are kept on your device as well as in your account, so the chart works quickly and offline. If you're signed out, changes stay only in this browser until you sign in again.

We don't use advertising or third-party tracking cookies.

Why we use it

To run your account and the features you use, take payments, keep the service secure, credit partners for customers they refer, and answer your messages. We rely on providing the service you signed up for, our legitimate interest in keeping it secure and working, and legal duties such as keeping payment records.

Who we share it with

• Service providers that process data for us: Stripe (card payments), Paynow (EcoCash and local payments), Resend (sign-in emails and our encrypted backups), Zoho (our business email), Anthropic (the AI that analyses charts), DigitalOcean (hosting, in the United States), Cloudflare (network security) and a proxy service used only to fetch YouTube captions you ask us to read.
• Your browser also connects directly to Deriv for live market prices and to Google Fonts for the typeface, so those services see your IP address. Messages you send us from the app are stored with your account and delivered to our support inbox by email.
• If you use the microphone in the AI chat, your browser turns your speech into text using its own speech service (for Chrome and Edge, run by Google or Microsoft). We only receive the text, never the recording.
• If you choose Continue with Google, Google tells us your name and email address, and nothing else. If you set a password, we store only a scrambled (hashed) version that can't be turned back into your password.
• USDT payments are recorded on the public TRON blockchain, and we look up the transaction you send us on Tronscan.
• Partners: if you joined through a partner's link, that partner sees an anonymous numbered entry showing the month you joined, your plan, whether you're paying, cancelled or refunded, how many months you've paid and the commission they earned. Never your name or email.
• We don't sell your data.

How long we keep it, and your rights

We keep your data while your account is open. You can delete your account yourself at any time under Profile, which cancels a card subscription and removes your data straight away, or ask us and we'll do it within 30 days. We keep only anonymous payment records we must keep by law, and a one-way scrambled (hashed) copy of your email address so the same inbox can't start a second free trial. Our nightly backups are encrypted and kept for up to 90 days, so deleted data leaves them within that time.

Messages you send us (by email or from Support in your account) are kept in our support inbox (Zoho) for as long as we need them to help you, and then deleted, at the latest 24 months after the conversation ends.

Our server logs and our AI cost log record an anonymous account tag, never your name, email or words. The AI cost log is deleted after 13 months, and older server log entries are removed automatically as their storage space fills up.

Our servers are in New York, in the United States (DigitalOcean), and some of the providers above process data in other countries. Where UK data-protection law applies, each transfer is covered by that provider's data processing terms: the UK-US data bridge where the provider is certified under it, or standard contractual clauses with the UK International Data Transfer Addendum.

If you are in South Africa, your personal information leaves South Africa only to providers bound by rules or contracts that protect it to a standard comparable to POPIA, or where the transfer is needed to give you the service you signed up for, as POPIA allows.

You can ask to see, correct, export or delete your data, or object to how we use it. You can export your journal and setups yourself from your account. You can also complain to a data protection regulator where you live, for example the UK Information Commissioner's Office, POTRAZ in Zimbabwe, or the Information Regulator in South Africa.

Wickproof is for people aged 18 and over.