Privacy Policy

Who is responsible

ESVARA is operated as an independent product. For any question about your data, or to exercise any right described below, write to support@getesvara.com.

ESVARA is not a broker, an exchange, or a financial institution. It does not hold, move, or invest money on your behalf.

What we store

Your account: email address, an optional display name, and your preferences (language, display currency, timezone).

Your password is never stored. What is stored is a scrypt hash from which the password cannot be recovered — see "How it is protected" below.

What you write in the product: journal entries, trades, goals, routines, trading rules, mistakes, notes, and backtests. This is your content, and most of it is written by you rather than collected about you.

Connections you choose to add: for an exchange, API credentials encrypted at rest; for a wallet, a public blockchain address only — never a private key or seed phrase; for an AI provider, your own key, encrypted.

Security records: each account has an audit log of sensitive actions, which includes the IP address and browser user-agent of the request. This exists so that suspicious access to your own account can be investigated, and for no other purpose.

Why we store it, and on what basis

To give you the account and the features you signed up for. Legal basis: performance of a contract with you.

To keep the account secure — detecting and investigating unauthorised access, and rate-limiting abuse. Legal basis: our legitimate interest in protecting accounts, and yours.

To send you the emails the product needs to work: address verification and password reset. Legal basis: performance of a contract.

We do not use your data to train models, we do not sell it, and we do not share it for advertising.

Cookies and tracking

ESVARA sets one cookie: a session cookie that keeps you signed in. It is strictly necessary for the service to function, so no consent banner is required for it.

There is no third-party analytics, no advertising pixel, and no tracking script from anyone else anywhere on this site, and we do not follow you across other sites.

Inside the app we count, per day, which of its sections you open — the journal, the portfolio and so on — to see which parts are used and which are not. Only the section and the day are counted, never what you do or write there. The counts are kept for 180 days and are deleted with your account. Legal basis: our legitimate interest in improving the service.

Who else sees data

Email delivery: Resend, configured in the EU (Ireland) region. It receives the recipient address and the message content for verification and password-reset emails.

Domain and mail routing: Cloudflare handles DNS for getesvara.com and forwards mail sent to support@getesvara.com.

Password breach checking: when you choose a password, we check whether it appears in a known public breach using the Have I Been Pwned range API. Only the first five characters of a hash of the password are sent — the password itself, and enough of its hash to identify it, never leave the server.

Market and blockchain data: public market data and, for wallet accounts, public on-chain data are fetched from third-party providers using our own credentials. Your identity is not sent with those requests.

Exchanges and AI providers: only if you connect one yourself, and only within the scope you grant. An AI provider you connect receives the data you scope to it, under that provider's own terms.

Payments: Stripe (Stripe Payments Europe, Limited, Ireland) processes subscription payments. It receives your email address, your name and the card details you enter on its payment page. ESVARA keeps only Stripe's identifiers for you and your subscription, the plan, its status and its renewal date — never card details.

Hosting and database: the application and its database run on third-party infrastructure. The specific providers are named here once production hosting is finalised; until then ESVARA runs locally only.

How it is protected

Passwords are hashed with scrypt at OWASP-recommended work parameters, with a unique salt per password, and the parameters are stored alongside each hash so they can be raised over time. If the database were ever exposed, the hashes would still not reveal the passwords.

New passwords are additionally checked against known public breach corpora and rejected if they appear in one.

Exchange and AI provider credentials are encrypted with AES-256-GCM before being written to the database.

Session and reset tokens are stored only as hashes. A stolen database row cannot be replayed as a valid session.

No safeguard is absolute. These are the measures actually implemented, described so you can judge them.

How long it is kept

Account data and your content are kept while your account exists.

When you delete your account, the records linked to it are deleted with it — this is enforced by the database itself, not by a cleanup job that might not run.

Verification and password-reset tokens are single-use and are removed as soon as they are used or expire.

Backups, once production hosting exists, may retain data for a limited period after deletion before being overwritten.

Your rights

If you are in the EU or EEA you have the right to access your data, correct it, delete it, obtain a copy in a portable form, restrict or object to certain processing, and withdraw consent where processing relies on it.

To exercise any of these, write to support@getesvara.com.

You also have the right to complain to a data protection authority. In Sweden that is Integritetsskyddsmyndigheten (IMY).

Children

ESVARA is not intended for anyone under 18, and accounts should not be created by or for them.

Changes

If this policy changes in a way that affects you, the date above changes and the change is announced in the product before it takes effect.