Privacy policy

Controller

Thomas Stickel
Schönblickstraße 18, 72770 Reutlingen
Email: contact@edgevor.com

For questions about data protection you can also reach us via the contact form (topic “Privacy”). No data protection officer has been appointed, because there is no obligation to do so.

Summary

• No tracking, no advertising, no analytics services. Fonts, scripts and our own charts are served from this server. The only exception is content from TradingView – and only after your click (see TradingView).
• Without signing in, this site itself sets no cookie. Exception: when you open a form page (newsletter, contact, registration, forgot password, sign-in), a technically necessary session cookie is created to protect against forged forms.
• For an account we store only what is necessary for its use. You can download your account data as a file at any time under Settings; you can obtain information about other data (such as logs) on request.
• Your data is not a commodity: we pass it on neither for money nor for advertising.
• No automated decision about you: the analysis assesses stocks and crypto assets, not people (Art. 22 GDPR does not apply).

Visiting the site: hosting and server logs

The site runs on a rented server of Hostinger International Ltd. (Larnaca, Cyprus) in a data center in Düsseldorf (Germany). A data processing agreement (Art. 28 GDPR) is in place with Hostinger.

With every request, the web server processes technically necessary data: IP address, time, requested address, status code, amount of data transferred, the page you come from (referrer, if your browser sends it) and the browser identifier. The purpose is to deliver the site, find errors and fend off attacks. The legal basis is our legitimate interest in a secure, functioning service (Art. 6(1)(f) GDPR). We delete the access logs after 14 days. Error logs of the application usually contain no personal data, but in individual cases an email address (for example after a failed delivery); they are deleted after 8 weeks.

Guests receive some pages from a short-lived cache; it only contains the page that is the same for everyone, no data about you.

Protection against abuse

• Rate limiting: For chart requests without signing in, we count requests per network address in time windows of 10 minutes; for newsletter, contact, registration and “forgot password” in windows of one hour. Only a check value of the address is stored (HMAC with a secret key, for IPv6 only the connection part), from which the address cannot be recalculated. For account actions (new alerts, saved zones, test messages, confirmation links) we count in the same way with a check value of your account number. The counters are deleted on the following day at the latest.
• Sign-in protection: We store failed sign-in attempts with IP address, entered username and time, to slow down password guessing. The entries are deleted after one day (checked daily).
• Form protection: Every form carries a security token (CSRF protection) and an invisible field against spam bots.

Legal basis: legitimate interest in the security of the site and the accounts (Art. 6(1)(f) GDPR).

Cookies and storage in the browser

• Session cookie (sct_session): created only when you sign in or open a form page. It keeps you signed in (at most 30 days, deleted immediately when you sign out) or protects forms against forgery. It can only be read by this site (HttpOnly, SameSite) and is technically necessary (Section 25(2) no. 2 TDDDG; Art. 6(1)(b) or (f) GDPR). The cookie comes with a session file on the server containing your account number or the form protection and short notices of the site; it is deleted when you sign out, otherwise at the latest around 30 days after last use.
• Local storage of your browser (Local Storage): only settings you choose yourself, so that the site still knows them on your next visit – light/dark, “Compact” view, expanded or collapsed sections, selected columns in the screener, layers and timeframe in the chart, last selected favorites list, showing or hiding saved zones, the filter “only tradable zones”, whether the tour on the home page has already been shown, your learning progress in the Academy and the choice “always load TradingView content”. This information does not leave your browser (Section 25(2) no. 2 TDDDG). With an account we also store light/dark and “Compact” in your account.
• Cookies from TradingView: After you have loaded TradingView content, TradingView may use its own cookies or similar technologies (see TradingView).

You can delete all of this at any time in your browser settings.

TradingView widgets

Without signing in, we show you prices and charts via widgets from TradingView: price chart on the chart pages, heatmaps (S&P 500, crypto), ticker and gainers/losers list on the overview, screener in the scanner. Provider: TradingView.com, Inc., 23rd Floor, 1330 Avenue of the Americas, New York, NY 10019, USA (according to TradingView’s privacy policy, as of Aug 31, 2026). The purpose is to display price histories; prices and license come from TradingView, stock prices may be delayed.

The widgets are only loaded when you click “Load” or “Load chart”. Before that, no connection to TradingView is established. One click applies to all widgets of the page you are on. After the click, your browser loads scripts and data directly from TradingView servers; in particular your IP address, browser details and the page you visited are transmitted to TradingView. TradingView may use its own cookies or similar technologies; we have no influence on this. The legal basis is your consent by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Transfer to the USA: The data may be transferred to TradingView servers in the USA. The basis for this is your explicit consent (Art. 49(1)(a) GDPR). Please note: the USA does not have a level of data protection equivalent to EU law. US authorities may under certain circumstances access the data without effective legal remedies being available to you.

Withdrawal: You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR). The withdrawal does not affect the lawfulness of the processing carried out until then. If you choose “always load”, only this choice is stored with a date in your browser’s local storage; it then applies to all pages and all widgets, for at most 12 months, after which we ask again. You can withdraw under every widget (“Stop loading automatically”) or here:

Details: TradingView privacy policy. Our own analysis (buy zone, stop, targets, waves) is calculated on our server and is not transmitted to TradingView.

Account

Registration: For an account we need a username, email address and a password, optionally a display name. We store the password only as a secure hash (Argon2id), never in plain text. We also store the time and wording of your confirmation at registration (notices, terms of use, privacy). To confirm your address we send you a link that is valid for 48 hours. We delete an account that is not confirmed after 7 days.

Account emails: confirmation, “forgot password” (link valid for 60 minutes), “password changed” and the notice if an account already exists for an address. For each email we store the recipient address, type, times, status, a check value of the link (never the link itself) and a check value of the requesting IP address (HMAC). We delete these entries after 30 days – even if the account was deleted earlier (until then without reference to the account), so that the email limits per address remain effective. If you change your email address, the new one only applies after confirmation via a link. Before the introductory phase ends, we send you a one-time information email about what applies to your account afterwards (legal basis: contract, Art. 6(1)(b) GDPR); for this we store the status and time of sending with your account, deleted together with the account.

Stored in the account: your settings (display, notifications), your plan (Free, Watcher, Premium) with its term, time of registration and of the last sign-in. After a password change, all other signed-in devices are signed out.

The purpose is to provide your account and the functions you choose (Art. 6(1)(b) GDPR). The details at registration are required for this; without them we cannot create an account. All other details are voluntary. The data remains stored until your account is deleted. You can request deletion at any time via the contact form or by email. We then delete your account with all personal functions. The following remain, without reference to the account, until their period expires: your contact messages, entries on account emails and – if you had the newsletter – the proof of your earlier consent (the newsletter is unsubscribed in the process).

Personal functions

If you use them, we store with your account: favorites lists, notes and drawings in the chart, chart settings per symbol, saved buy zones, your own alerts (symbol, type, price if applicable, note, trigger) and saved screener filters. Notes that you explicitly share are visible to other signed-in users with your display name. The purpose is to provide these functions (Art. 6(1)(b) GDPR). You can delete each entry yourself; everything is deleted with your account at the latest.

Portfolio: If you use it, we store your portfolios (name) and the positions you enter yourself (symbol, purchase date, quantity, purchase price). There is no connection to your broker or bank; we only learn what you enter. No one but you sees the details; they only serve to display value, profit and position relative to the buy zone (Art. 6(1)(b) GDPR) and are part of your data export. You can delete any position and any portfolio at any time; everything is deleted with your account at the latest.

Backtest of your list: If you start a backtest, we store the request (selected list or portfolio with name, the symbols in it, timeframe, period, times and status) and the calculated result. The purpose is to calculate and display the result (Art. 6(1)(b) GDPR); no one but you sees it. A result remains stored until you delete it – at most the 20 most recent; when another one is started, the oldest are deleted. If your Premium access ends, we delete your backtests after 90 days (you can delete them yourself beforehand). If you delete a backtest (or it drops out when a new one is started), we remove list, symbols, period and result immediately; the remaining entry (only time, timeframe and status, for the daily limit) is removed by the next run of the queue after 2 days. The requests are part of your data export; everything is deleted with your account at the latest.

Notifications

• Email: If you switch it on, we send you messages about your alerts and favorites, with Premium on request also the weekly and the daily email (off by default). Each message is recorded in the delivery log (time, channel, type, count, success and, in case of errors, the error message of the delivery service) so that nothing is sent twice. The log remains as long as your account exists. You can switch off each type in the settings.
• Telegram: If you connect Telegram, we store your chat ID; the messages are then sent via the Telegram service, whose provider is based outside the EU. Only the chat ID and message text are transmitted, and only because you have set it up that way (Art. 6(1)(b), Art. 49(1)(b) GDPR). Telegram’s own terms also apply. You can disconnect at any time in the settings; the chat ID is then deleted.

Posts

Signed-in users can write posts under stocks and crypto assets. We store the text, the optional assessment (bullish, neutral, bearish), the time (creation and editing), the author (your account; your display name is shown), your “thumbs up” and your reports with reason and time. Posts are only visible to signed-in users; guests only see the count. The purpose is exchange among users (Art. 6(1)(b) GDPR) and protection against abuse and unlawful content (Art. 6(1)(c) and (f) GDPR). Rules: Community rules.

• Display name: Your display name (not your username) appears next to your posts. You choose it in the settings; it must be unique. Posts by the operator carry the label “Operator”.
• Retention: until you delete the post or your account is deleted. When a post is deleted, the text is removed immediately; only an empty row remains so that other users’ replies stay in context.
• Deletion of your account: Your posts, assessments, “thumbs up” and reports are removed. Your posts are no longer displayed immediately; their text is also cleared in the database after one hour at the latest – together with the text snapshot in reports and the beginning of the post in the moderation log (exception as when deleting a post: posts hidden by the operator, see “Moderation”). The rows themselves remain without reference to you (“deleted account”), so that other users’ replies are not lost. Entries in the moderation log concerning your account lose their reference to your account immediately upon deletion.
• Moderation: If the operator hides a post, deletes it, resolves a report or blocks an account from posting, this is logged with time, reason and the beginning of the post (at most 200 characters). The beginning of the post is deleted from the log after 12 months; the entry itself (who, when, what) remains as proof. If you delete a post yourself, its beginning is also deleted from the log immediately – unless the operator had hidden it: then the beginning remains as proof of the moderation decision (to defend against legal claims, Art. 6(1)(f) GDPR) until the 12 months expire.
• Reports: If you report a post, only the operator sees who reported it. We store the reason, time, your optional comment (at most 300 characters) and the text of the post at the time of the report. Comment and text snapshot are deleted after 12 months, the text snapshot also immediately if the author deletes the post (exception as above). If someone reports your post, we receive this data about you from the reporting person (Art. 14 GDPR).
• Notice to the operator: For every new report, the operator receives an email with the symbol, display name of the author, reason and the beginning of the post (at most 10 per hour), without the name of the reporting person; via Telegram only “New report” with the reason, without names and without post text. These messages are deleted there after 180 days.

Newsletter and waiting list

If you sign up for the newsletter or the waiting list, we store your email address, the list, the wording of your consent, the time of sign-up and of confirmation as well as a check value of your IP address (HMAC) as proof. Every sign-up, confirmation and unsubscription is recorded with its time in a proof log that is not changed afterwards. The legal basis is your consent (Art. 6(1)(a) GDPR); for the proof, our legitimate interest (Art. 6(1)(f) GDPR). Sending is switched off until the legal review.

• Double opt-in: After signing up, you receive an email with a confirmation link (valid for 48 hours). Only after the click are you subscribed. We delete unconfirmed sign-ups after 30 days.
• Delivery log: We record every confirmation email and every newsletter issue with type, issue, time and success, so that no one is contacted several times or too often. The log is deleted together with the entry.
• Content: about once a week market situation, new buy zones, dates and a tip from the Academy; the waiting list only receives one message when the paid plans start. No third-party advertising, no open or click tracking.
• Withdrawal: at any time with one click via the unsubscribe link in every email, with an account also under Settings. After that you receive no more emails. We keep the proof of your earlier consent (address, wording, times, log) for 3 years after unsubscribing in order to be able to prove an earlier consent; after that we delete the entry including the log automatically.

Contact form

If you write to us via the contact form, we store your name (voluntary), your email address, the topic, your message, the time, your account if you are signed in, and a check value of your IP address (HMAC, protection against abuse). The purpose is to answer your request (Art. 6(1)(b) GDPR if it concerns your account or a contract, otherwise (f)). The operator receives a notice by email with topic, name, address and the beginning of the message; via Telegram only “New contact message” with the topic, without personal data. We delete messages automatically 6 months after the reply or – if they remain unanswered – after receipt; the notices to the operator after 180 days. If your account is deleted, your messages remain without reference to the account until this period expires.

Sending emails

We send all emails of the site (account, notifications, newsletter, contact) via the mailbox of our domain at Hostinger International Ltd., Larnaca (Cyprus) (data processing, Art. 28 GDPR). In doing so, the provider processes the recipient address and the content of the message.

Non-personal data: prices, news, AI

Our server retrieves prices, fundamentals and news from data providers (including Binance, Finnhub, SEC EDGAR, alternative.me, public news feeds). No data about you is transmitted in the process. For short summaries of news and for drafts of the market analysis we only send the texts of the news or market data to an AI service (Anthropic, USA) – no data about you and nothing you enter on the site. Exception with personal data of third parties: insider filings.

Insider filings (third-party data)

On the “Insider” page and on the stock pages we show transactions by officers, directors and major shareholders of US companies. For this we store from their mandatory filings (Form 4) with the US Securities and Exchange Commission (source: SEC EDGAR, publicly accessible): name of the filing person, their SEC identification number, role or title in the company, date, type, quantity, price and value of the transaction, holdings afterwards and the indication of a 10b5-1 plan. The data was not collected from the data subjects (Art. 14 GDPR). The purpose is to inform our users about these public filings; the legal basis is our legitimate interest and that of our users in the evaluation of public capital market information (Art. 6(1)(f) GDPR). We do not use the information for other purposes and do not pass it on. Filings are deleted automatically 24 months after their filing date. Data subjects can object to the processing at any time (Art. 21 GDPR) – via the contact form or by email; their further rights are listed under Your rights. After an objection we delete all stored filings of the person and only record their SEC identification number with a date, so that new filings are discarded as soon as they are read in and are no longer displayed; we keep this record as long as the objection applies.

Recipients at a glance

• Hostinger as processor for the server and Hostinger International Ltd., Larnaca (Cyprus) for sending emails (see Visiting the site and Sending emails).
• Telegram, if you connect it (Notifications), and for short notices to the operator without content about you (Reports, Contact).
• TradingView, only after your click (TradingView).
• Authorities, if we are legally obliged to do so.

Other users only see what you publish yourself: display name, posts and shared notes.

Transfers to third countries

Server and database are located in Düsseldorf (Germany). Data about you only leaves the EU in the following cases: when loading TradingView content (consent, Art. 49(1)(a) GDPR) and for Telegram messages you have set up (Art. 49(1)(b) GDPR). Notices to the operator via Telegram contain no data about you. No personal data is sent to the AI service.

Backups

So that nothing is lost in the event of a failure, we back up the database daily. The backups are stored on the server and as a copy with the controller and are deleted after at most 30 days. Deleted data therefore also disappears from the backups by then at the latest (Art. 6(1)(f) GDPR).

Retention periods at a glance

Your rights

• Access to your data (Art. 15 GDPR) and a copy. With an account you download your account data yourself: Settings → “My data” (download file, machine-readable, which is also your right to data portability, Art. 20 GDPR). You can obtain information about other data (such as logs or contact messages) on request.
• Rectification of incorrect data (Art. 16) – you change most details yourself under Settings.
• Erasure (Art. 17) and restriction of processing (Art. 18).
• Objection (Art. 21): Insofar as we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation.
• Withdrawal of consent (Art. 7(3)) at any time with effect for the future – for example for the newsletter or for TradingView.
• Complaint to a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the alleged infringement. The authority responsible for us is: The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

For all requests, a message to the address above or via the contact form is sufficient (topic “Privacy”). So that no one requests other people’s data, we first check whether the request comes from you – for example by asking back at the email address of your account.

Changes

If what the site processes changes, we adapt this policy. The version published here applies; the date is at the top. See also the terms of use and the legal notice.