Privacy policy

What we collect

• Account: your email address and sign-in details, held by our sign-in provider. We store your email and an account id.
• What you make: strategies, backtest settings and results, and how many backtests and Soros messages you’ve used.
• Soros messages: what you write to the Soros assistant, the strategy it’s looking at, and any chart screenshot you attach.
• Plan and payments: your plan, its price, currency and renewal date, and the payment provider’s subscription and payment ids. Card, UPI and bank details go straight to the payment provider; we never see or store them.
• Technical: the country your connection comes from (to show prices in rupees or dollars), and server logs of requests, errors and account actions such as starting a plan or deleting an account.
• Usage (if enabled): anonymous product events such as “backtest started”, tied to a random per-browser id, not to your email or account.

Why we use it

• To run the service: sign you in, save and backtest your strategies, answer Soros messages and apply plan limits.
• To bill you for a paid plan and keep the records the law requires.
• To keep the service secure and working: rate limits, abuse prevention and fixing errors.
• To improve Rule Audit, using anonymous usage data only.

We don’t sell your data, show ads, or use your strategies or messages to train AI models.

Who else handles it

These providers process data for us, only to provide their part of the service:

• Clerk: sign-in and account security.
• Supabase: our database (strategies, results, plan and usage).
• Railway and Vercel: hosting for our servers and website.
• Razorpay: payments and subscriptions.
• Anthropic: the AI behind Soros, which receives your Soros messages, the strategy in view and any screenshot you attach.

Some of these providers store data outside India. Market data providers receive no personal data. We share data with authorities only when the law requires it.

Shared results

Every backtest result has a link. Anyone with the link can see that result, including the strategy that produced it, but not your name or email. Results aren’t listed or searchable; only people you give the link to can find them.

Cookies and storage

We use cookies needed to keep you signed in, and your browser’s storage for preferences such as the theme and whether you’ve seen the tour. We use no advertising or cross-site tracking cookies.

How long we keep it

We keep your data while you have an account. When you delete your account (Account → Delete account), any paid plan is cancelled and your strategies, results, usage and profile are deleted straight away, along with your sign-in. Payment records are kept by us and Razorpay for as long as tax and accounting law requires. Server logs are kept for a limited period and then deleted.

Your choices and rights

• See and change your email, password and signed-in devices under Account → Security.
• Delete your account and data at any time from the Account page.
• Ask us for a copy of your data, to correct it, or how it’s used, by emailing support@ruleaudit.com. We reply within 30 days.

You can also raise a concern with us under India’s Digital Personal Data Protection Act, 2023, and with the Data Protection Board of India once it accepts complaints.

Security

Data is encrypted in transit, the database refuses access except from our servers, and sensitive actions such as deleting an account need a fresh sign-in. No system is perfectly secure; if a breach affects your data, we’ll tell you and the authorities as the law requires.

Children

Rule Audit is for people 18 and over. We don’t knowingly collect data from children.

Changes

If we change this policy, we’ll update the date above, and for important changes we’ll tell you by email or in the app before they apply.