Privacy Policy

Last updated: 24 August 2026

This policy explains how Tremor handles personal data when you use the website, account dashboard, payment flow, API and browser extension.

1. Who is responsible

The data controller is Tremor — legal business name required before launch, registration number Registration number required before launch, at Postal address required before launch. Privacy requests can be sent to Support email required before launch.

2. Data we process

• Account data: email address, Supabase user identifier and authentication/session records.
• Subscription data: Stripe customer and subscription identifiers, plan, status, renewal or cancellation dates and transaction-related status. Tremor does not receive or store your full card number.
• Extension access data: an irreversible HMAC digest and short prefix of your extension key, creation/revocation dates, last-use time and daily request count.
• Risk requests: the ticker visible on the TradingView chart or entered manually, the requested endpoint and time of the request. The extension does not transmit your complete browsing history.
• Technical data: IP address and limited request, security and error logs that may be generated by our hosting providers.
• Support and withdrawal data: messages, withdrawal requests and the information needed to respond.

3. Why we process data

• To create and secure your account, deliver Tremor and verify paid access — performance of our contract.
• To operate, troubleshoot, prevent abuse and protect the service — our legitimate interests in security and reliable operation.
• To administer payments, refunds, accounting and consumer requests — performance of contract and compliance with legal obligations.

4. Browser-extension data

The extension reads the current ticker from supported TradingView pages. When Tremor is connected, it sends that ticker and your extension key to Tremor's API to authenticate the request and return a risk assessment. The key is stored locally using browser extension storage. Tremor does not sell this data, use it for advertising or use it to build a general browsing profile.

5. Service providers

We use Supabase for authentication and database services, Vercel for the website, Fly.io for the risk API, and Stripe Managed Payments for payment and transaction services. These providers process data under their own terms and applicable data-protection arrangements. Data may be processed outside the EU/EEA using legally recognised transfer safeguards where required.

6. Retention

Account and entitlement data is retained while your account is active and afterwards only as needed for security, disputes and legal obligations. Payment and accounting records are retained for legally required periods. Revoked key metadata, webhook records and security logs are retained only for operational, fraud-prevention and audit needs. Withdrawal requests are retained as evidence that the request was handled.

7. Cookies and local storage

The website uses essential authentication cookies. The extension uses browser extension storage for its key and connection settings. Tremor does not currently use advertising or cross-site tracking cookies.

8. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, objection or portability of your personal data. You may also complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority. Some information may need to be retained to comply with law or resolve transactions.

9. Security and changes

We use access controls, server-only credentials, signed payment webhooks and hashed extension keys. No online service is completely secure. Material policy changes will be posted here with an updated date.