Privacy Policy

MarketsEasy is built and run by a small team based in India, operating the site at marketseasy.in. There is no VC funding, no data-broking business behind it. We started it because we wanted a free, honest tool for Indian F&O traders that wasn't buried in ads or upsells.

When this policy says "we" or "us," it refers to the team that builds and operates MarketsEasy. If something in this policy is unclear, email us at marketseasy.dev@gmail.com and we'll answer within a few days.

This policy applies to everyone who visits marketseasy.in — whether or not you sign in. Using the site means you're okay with what's described here.

Only the minimum needed to run the site. We're listing everything, including things people usually skip.

Straight list of what your data is used for:

• Sign you in and remember your watchlist, alerts, and preferences across devices
• Send the daily digest email if you opted in (unsubscribe link in every email)
• Answer contact-form messages you send
• Find bugs, understand which features get used, and decide what to build next
• Stop bots, abuse, and rate-limit misuse of the free AI features
• Comply with anything Indian law actually requires us to comply with

We do not sell your data. We do not use your data to train AI models. We do not build behavioural profiles to resell. If those things ever change, this policy will change first, and you'll get an email.

India's Digital Personal Data Protection Act, 2023 (DPDP Act) applies to how we handle your data. For each activity, the lawful basis we rely on is:

• Consent — when you sign in with Google, opt into the daily digest, or fill in the contact form. You can withdraw consent at any time (unsubscribe / delete account / stop using the site).
• Legitimate use — for security, fraud prevention, and analytics needed to keep the site running. Under the DPDP Act, this covers the minimum operational logging described in Section 2.
• Compliance with law — when Indian law (including the Information Technology Act, 2000 and the SPDI Rules, 2011) requires disclosure or retention.

If you're outside India, equivalent laws (GDPR in the EU, UK GDPR, CCPA in California, etc.) may also apply and give you similar rights, which we honour in the same way.

Several MarketsEasy features are powered by third-party large language models. Here's exactly what happens:

• When you use the AI Trading Assistant, click AI Suggestion on a stock page, or trigger any AI feature, MarketsEasy sends the necessary market data + a short prompt to one of the following AI providers to generate a response: Groq, Google Gemini, Cerebras, OpenRouter, or NVIDIA (whichever answers fastest via our fallback chain).
• The prompts contain the market data (indices, option chain, news headlines) and — for signed-in features — your user ID (not your name or email) for rate limiting. Providers are contractually barred from using this data to train their models.
• AI responses are cached briefly on our servers to keep costs down. Cached responses expire within 2 minutes for live analysis and 24 hours for slower-changing content.
• The ChatBot on the site also uses these providers — do not paste sensitive personal information (PAN, Aadhaar, account numbers, passwords) into it. Anything you type is sent to the AI provider.

If you'd rather not have prompts sent to AI providers, avoid the AI features — the option chain, OI tracker, screener, calculators, and news feed all work without them.

We share data with the third-party services required to run the site. Each is listed with what they see:

• Google (OAuth + Analytics) — receives your sign-in identity from Google and aggregate visitor telemetry via Google Analytics 4.
• Vercel — hosting provider. Sees request logs (IP, path, response code) as part of normal serverless function operation.
• Supabase — the managed Postgres database where your account, watchlist, and preferences are stored.
• Brevo — sends the daily digest email (if you opted in) and the one-off welcome email.
• Groq, Google Gemini, Cerebras, OpenRouter, NVIDIA — receive prompts when you use AI features (see Section 5).
• Google AdSense — if ads are enabled, Google and its advertising partners use cookies to serve and measure ads (see the advertising disclosure in Section 7).

We do not sell personal data to any of these providers — they receive only what's needed to deliver their service. If law-enforcement or a valid court order requires disclosure, we'll comply, but we'll tell you unless legally forbidden from doing so.

Cookies we set ourselves (or our direct providers set) are:

• Session cookie — required for sign-in. If you block it, sign-in stops working.
• Preference cookies — theme (dark/light), last-viewed market, watchlist cache.
• Analytics cookies — anonymous visitor ID from Google Analytics 4 and Microsoft Clarity (aggregate scroll/click heatmaps).
• Signup attribution cookie — records the referrer + UTM tags of your first visit, in case you sign up later. Deleted after sign-up.
• Advertising cookies — set by Google AdSense and its partners if ads are enabled on a page (see the advertising disclosure below).

You can clear cookies from your browser at any time. Blocking session cookies will sign you out; blocking advertising cookies will still show ads but they'll be less relevant.

Third-party advertising (Google AdSense)

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website and other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
• Google uses the DoubleClick DART cookie to serve ads based on your visit to this and other sites.
• You may opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of a third-party vendor's use of cookies for personalised advertising at aboutads.info.
• For more detail on how Google uses data when you use our site, see How Google uses information from sites or apps that use its services.

• Account data — as long as your account is active. On deletion request: within 30 days.
• Contact form submissions — up to 24 months (for support follow-up + spam tracking).
• Admin audit log — up to 24 months.
• Server logs — 30 to 90 days (depending on the hosting layer).
• Analytics — Google Analytics' default 14-month retention.
• AI response cache — 2 minutes to 24 hours.

Under the DPDP Act (and equivalent laws in other countries), you can:

• Ask for a copy of the data we hold about you
• Ask us to correct anything wrong
• Ask us to delete your account and everything tied to it
• Withdraw consent for the daily digest (one-click unsubscribe in every email)
• Nominate a person to exercise these rights on your behalf if you can't (DPDP Act Section 14)
• Complain to the Data Protection Board of India (or your local authority) if you think we've mishandled something

Just email marketseasy.dev@gmail.com or use the contact page. We aim to respond within 7 days and complete the action within 30.

We take security seriously because we'd be equally upset if our data leaked from a site we used. In practice:

• HTTPS everywhere — enforced via HSTS.
• Session cookies are signed and HTTP-only. No plaintext passwords are ever stored (sign-in is delegated to Google).
• Database access uses connection pooling with least-privilege credentials.
• API keys are rotated when incidents are suspected.
• Public endpoints have rate limits to make bulk scraping expensive.

Our database is hosted on Supabase's Mumbai (ap-south-1) region so most personal data stays inside India. Some providers (Vercel edge, Google Analytics, the AI providers, Brevo) operate global infrastructure and may process your data in other jurisdictions including the EU and the US. Standard contractual clauses and each provider's own compliance frameworks apply to those transfers.

MarketsEasy is meant for adult traders. We do not knowingly collect data from anyone under 18. If you're a parent/guardian and you believe your child signed up, email us and we'll delete the account within a few days.

Privacy policies date. If we change how data is handled, we'll update the "Last updated" date at the top and (for anything material — new data being collected, new sharing) send a heads-up to signed-in users. Small clarifications don't get an email. Continuing to use the site after a change means you accept the update.

Any question, complaint, or data-rights request — please email us directly:

Or use the contact page. We read every message ourselves.