Cookie & Local Storage Policy

01The short version

Everything else we store in your browser is strictly necessary to deliver a service you explicitly asked for — keeping you signed in, remembering your settings, and holding your own records. That is the exemption in Article 5(3) of the ePrivacy Directive and in regulation 6(4) of the UK Privacy and Electronic Communications Regulations, and it is why we do not ask permission for those.

One thing on the public pages falls outside that exemption and we are not going to pretend otherwise: the Tidio chat widget, described below. It loads on the marketing pages so you can ask a question before signing up, it never loads on the desk, and it is listed in the sub-processor register.

Clarity does not qualify for that exemption, so we ask. Until you accept, the Clarity script is not loaded, no request is made to Microsoft, and no analytics cookie exists. Declining costs you nothing: no feature depends on it, and we do not ask again.

The second tool, Vercel Web Analytics, stores nothing in your browser at all — so nothing on the list below belongs to it, and strictly the cookie rules do not reach it. It is behind the same switch regardless. A single control in Settings that stopped one of two analytics tools would be a worse thing to offer than no control at all, and it is described in full in the Privacy Policy.

You can verify every item below yourself: open your browser’s developer tools, look at Application → Storage, and compare. A policy you can check beats one you have to believe.

02Everything we store, item by item

Cookies specifically. Our authentication provider may set a cookie to maintain your session where local storage is unavailable. It is a first-party, strictly necessary session cookie carrying no advertising identifier.

Live chat. On the public pages — not on the desk and not during onboarding — we load Tidio’s chat widget. If you open a conversation it stores an identifier in your browser so the thread survives a page reload, and Tidio receives your IP address, browser and the page you are on. It is a third-party tool: what it stores is set by Tidio rather than by us, which is why it is described here rather than listed line by line above. It is named in the sub-processor register with what it receives.

Server logs. Separately from browser storage, our hosting and database providers record request logs containing your IP address and user agent, as any web server does. Those are covered by the Privacy Policy, not by this page.

03Microsoft Clarity, and what it actually sees

Clarity is a session-analytics product from Microsoft. With your agreement it records how you interact with this site — clicks, scrolling, mouse movement, page transitions, screen size, browser and approximate location derived from your IP address — and reconstructs it as a replay and as aggregate heatmaps.

If you are in the EEA or the UK, the ePrivacy rules give you the right to be asked before a non-essential cookie is set, and we are not currently asking. Switching analytics off in Settings, or blocking it in your browser, has the same effect as declining would — it stops both tools. You can also email us and we will delete what has been recorded. Vercel Web Analytics sets no cookie at all, so the cookie rule does not reach it; we hold it behind the same switch anyway, because a single toggle that stopped only one of two tools would be the more misleading arrangement.

What it does not see. The entire signed-in desk is marked in our markup as masked, so Clarity records that a region was there and not what it said. It does not receive your journal, your positions, your account size, your risk settings or the substance of your analyses. Those live in your account and are covered by the Privacy Policy. Clarity records the shape of your interaction with the interface, not the trading record inside it.

Withdrawing. Settings → Data & privacy → Product analytics turns it off, deletes the two cookies and reloads the page so the script stops running. Withdrawal is as easy as consent, which Article 7(3) of the GDPR requires. You can also block it in your browser, and we honour Global Privacy Control signals where your browser sends one.

Microsoft as a recipient. Clarity data is processed by Microsoft Corporation in the United States under Standard Contractual Clauses. Microsoft is listed on our sub-processor register, and Microsoft states that Clarity data is not sold and is not used for advertising targeting.

04The Reddit Pixel, and what we share

Reddit Pixel — measuring advertising, and the one thing we share. We advertise ORIN on Reddit, and the Reddit Pixel tells Reddit when someone who saw an ad went on to create an account or subscribe. Without it we would be paying for advertising with no way to know which of it works. It sets one cookie, _rdt_uuid, and it is the only thing on this site that qualifies as "sharing" personal information for cross-context behavioural advertising under California law — so it is named plainly rather than filed under analytics.

What Reddit receives is the page you were on, the fact that a signup or a subscription happened, and a one-way hash of your account id. It does not receive your email address, your phone number, any advertising device id, or anything at all from inside the product — not your journal, not your positions, not the instruments you look at. We chose the hash over the email address Reddit’s own setup guide suggests, because the whole authenticated desk is deliberately hidden from our analytics and handing an ad network the identifier we withhold from ourselves would make that pointless.

Turning analytics off in Settings → Data & privacy stops it and deletes its cookie, and a browser sending Global Privacy Control is treated as having opted out before anything loads. Under the CCPA that switch is your "Do Not Sell or Share My Personal Information" request, and we honour it as one.

There is a second half you cannot see, and it should be described anyway: when a subscription completes, our server reports that one sale to Reddit directly, carrying the same hashed account id and the same reference number as the pixel so the two are counted once rather than twice. It exists because ad blockers stop the pixel for a large share of Reddit’s audience. It sends nothing the pixel would not have sent, and it is skipped entirely for anyone who has turned analytics off or whose browser sent Global Privacy Control — that choice is recorded at checkout and travels with the payment, precisely so the server does not have to guess.

Full detail of what Reddit receives and how long it keeps it is in the sub-processor register and in Reddit’s own privacy policy.

05What we deliberately do not use

• No Google Analytics.
• One advertising pixel, Reddit’s, described in full below — and no others. No Meta pixel, no Google Ads tag, no LinkedIn Insight, no TikTok pixel.
• No fingerprinting, no data brokers, and nothing sold for money — ever, by anyone, in any form.
• No advertising identifier that reaches us: no IDFA, no AAID, and your email address is never sent.
• No A/B testing tools that profile you.
• No third-party script beyond the three named below — the two analytics tools and the one advertising pixel — and not one of them that a single switch in Settings does not stop.

This list used to include analytics of every kind, and it no longer does. We added Microsoft Clarity because we could not otherwise see where the product confuses people, and Vercel Web Analytics because we could not otherwise count how many people reach each step. They are the only such tools, both are on by default and switchable off in one click, and both are described in full below rather than folded into a sentence about improving your experience.

06Clearing or blocking it

You can clear everything above at any time from your browser’s settings, and you can block storage for this site entirely.

With an account, your records live in our database and clearing browser storage only signs you out. This is the main practical reason to create one.

Blocking storage for this site entirely will prevent sign-in from working, because there is nowhere to keep the session.

07Changes

If we ever introduce a tool that is not strictly necessary, we will update this page and implement a proper consent mechanism before that tool ships — not after — and we will remove the claim in the Privacy Policy that we set no trackers at the same time. Questions to privacy@tryorin.xyz.