Privacy at a glance
- Checkout requires a TradingView username and email address. An X username and newsletter subscription are optional.
- We keep order, payment and entitlement records to provide access, handle support and honour your purchased benefits.
- Payments are handled through NOWPayments. We do not ask for wallet seed phrases, private keys or online-banking passwords.
- Hidden Trades does not add advertising trackers, behavioural analytics or session-replay tools to the website. Necessary session cookies, external fonts and the embedded payment provider’s own data practices are described below.
- Newsletters are optional and include an unsubscribe mechanism. Necessary order and access messages are separate.
- The Chrome extension has its own version-specific privacy notice. Its local chart processing is different from the website’s customer database.
1. Who is responsible
Hidden Trades, the operator of hiddentrades.com, is responsible for the website and customer processing described here. You can reach us at hello@hiddentrades.com; please include “Privacy” in the subject for a privacy request.
This notice covers the current website, beta checkout, customer administration, access management, support and communications. It applies whether or not you complete a purchase. Separate services such as TradingView, NOWPayments, your email provider and Chrome are also governed by their own privacy notices. Where an activity is handled independently by one of those services, this notice does not replace that service’s policy.
2. Information we handle
Information you provide
- TradingView username: the profile name used to identify where indicator access should be granted.
- Email address: for your customer record, order/access communication, support and, if you choose, newsletters.
- Optional X username: if you add it during checkout.
- Your contribution: the amount you choose, priced in US dollars, and your newsletter preference.
- Support correspondence: messages, attachments and other information you voluntarily send to us, including any diagnostic report you choose to share.
Typing into the checkout form does not itself submit these fields through our checkout JavaScript. Once you submit, the server validates them and may keep an unpaid order and contact record even if you do not finish payment. Values from an unsuccessful submission can also be retained temporarily in your session so you can correct the form.
Order and access records
We generate and store order references, dates, amounts, invoice references, payment and refund status, tier/discount entitlements, extension or lifetime-script eligibility, access-activation status and relevant expiry dates. Our team may add internal support notes. Customer records are grouped by email address, and records can show your highest qualifying paid tier and earlier earned benefits.
Private order-status links use random access tokens. The database stores a hash of the receipt token; an active checkout session and the payment return URL may contain the usable token. Anyone with a valid order-status link can view the limited order information it unlocks, so treat that link as private.
Payment information returned by the provider
NOWPayments notifications and status responses can include invoice/payment identifiers, transaction status, selected cryptocurrency, quoted and received amounts, payment addresses, fees, transaction or parent-payment references and other provider metadata. We store verified event payloads and payment records to reconcile payments, identify underpayments and refunds, and investigate problems. These records can be linked to your order and contact details.
Technical and security information
Our hosting infrastructure processes connection and request information needed to serve the site, such as IP addresses, request times, requested URLs, response codes, browser/user-agent information and referrers when supplied. The web server may retain this information in access or error logs.
The application also stores anti-abuse counters identified by a keyed hash derived from an IP address and the relevant action; sign-in limits can additionally use the entered username. These identifiers are pseudonymous, not necessarily anonymous. They are separate from any raw IP addresses in hosting logs. Administrative activity logs record actions, an administrator identifier, dates and, where relevant, the affected order.
Email records
We keep subscription/unsubscribe preferences and dates, message templates, campaign selections, message content, personalization details and delivery records such as queued, sent, failed or skipped, attempt counts and delivery errors. A “sent” record means acceptance by the configured SMTP service, not confirmation that you opened or read an email.
3. Why we use information
We use information for the following purposes. Where the EU or UK GDPR applies, the relevant legal grounds generally include:
| Purpose | Information used | Legal ground, where applicable |
|---|---|---|
| Provide checkout, process your chosen contribution and supply access/entitlements | Identity/contact details, order and payment records | Steps at your request before a contract and performance of the contract — Article 6(1)(b) |
| Send order, payment, activation or other necessary service messages; answer support requests | Contact details, order context and correspondence | Contract performance; legitimate interests in responding to relevant non-contractual enquiries — Articles 6(1)(b) and 6(1)(f) |
| Send optional newsletters, beta updates and release news | Email, subscription preferences and relevant tier/customer information | Your consent — Article 6(1)(a); you may withdraw it at any time |
| Operate, present and secure the website; prevent repeated or abusive requests; diagnose errors | Technical request data, essential session information and security counters/logs | Legitimate interests in a functioning, secure service — Article 6(1)(f), subject to applicable cookie/electronic-communications requirements |
| Meet applicable financial, accounting or other legal obligations and deal with claims | Records necessary for the particular obligation or dispute | Legal obligation or legitimate interests in establishing, exercising or defending claims — Articles 6(1)(c) and 6(1)(f) |
TradingView username and email are necessary for the checkout and manual access workflow. If you do not provide them, we cannot complete that workflow. Your X username and newsletter choice are optional and are not required to purchase.
We do not sell customer information, use it for targeted advertising, or share it for cross-context behavioural advertising.
4. Payments and TradingView access
NOWPayments
When you continue to payment, our server requests a hosted invoice. We send the chosen amount/currency, an internal order reference, a generic product description and callback/return URLs. A return URL contains the private receipt token needed to bring you back to your order. Our current invoice request does not add your TradingView or X username, or your website email field, as invoice customer fields.
You then interact with NOWPayments on its own website. It may process your IP address, device data, payment details, wallet/transaction information and any information it independently requests for its service or legal checks. Its return URL can give it access to the limited order-status page. Please review the NOWPayments privacy policy for its processing and retention.
We receive payment status and related metadata to confirm settlement and handle exceptions. Returning from the provider alone does not mark an order paid. We do not receive your wallet’s seed phrase or private signing key through this integration.
Cryptocurrency transactions may be recorded on public blockchains. Such records can be visible to third parties and generally cannot be erased or changed by Hidden Trades, even if a website record is later deleted.
TradingView
We use the TradingView username you provide to grant or manage invite-only script access. That process may involve entering the username into TradingView and recording the access action with that service. TradingView separately processes account, chart and platform data under its privacy policy. We do not ask for your TradingView password or authentication cookies.
6. Service emails, newsletters and your choices
Order and access messages help us provide the service you requested. Administrators can enable template-based emails for a first checkout registration, a completed payment or access activation. A signup message, if enabled, can arrive before you pay. These service messages are distinct from optional marketing newsletters.
Newsletters and release updates require an opt-in. You can unsubscribe using a message’s unsubscribe link or contact us directly. The preference is checked again before queued newsletter delivery. Unsubscribing does not cancel a purchase or prevent necessary order, security, support or access communication.
Messages are sent individually through our configured SMTP provider; other recipients are not exposed through a shared address list. Emails may be personalized with your username, relevant order, tier or entitlement information.
Our built-in mailer does not insert recipient-specific open-tracking pixels or tracking redirects. Emails can contain the shared Hidden Trades logo hosted on our website; if images are loaded, the email client or its image proxy requests that asset and ordinary server request data may be recorded. Unsubscribe URLs contain a signed recipient-specific token to apply the correct preference.
8. How long information is kept
Retention depends on the purpose rather than one fixed period for all information:
- Orders, payments and entitlements: retained for the time needed to fulfil access, honour lifetime or future-release benefits where purchased, deal with refunds/disputes and meet applicable accounting or other legal requirements.
- Unpaid orders and customer/support records: retained while needed to resolve the checkout, support the relationship or investigate an issue. You can ask us to review or delete an abandoned checkout.
- Subscriptions and email records: retained to manage preferences, deliver messages, handle failures and document communications. A limited unsubscribe/suppression record may remain to avoid sending unwanted newsletters.
- Anti-abuse counters: the application’s maintenance task deletes rate-limit buckets older than 48 hours when it runs. This does not set the retention period for the hosting provider’s separate access/error logs.
- Sessions, infrastructure logs and backups: follow their technical lifecycle and the hosting/backup retention arrangements. Removing an active record may not immediately remove an older backup copy.
The current application does not apply a universal automatic deletion schedule to customer, order and email-history records. We review deletion requests against the purpose of the record, continuing entitlements and applicable obligations. Where a record must be kept, we can explain the relevant reason and restrict unnecessary use.
9. Security
We use safeguards appropriate to the service, including HTTPS, protected administrator sessions, server-side validation, anti-forgery controls, verified payment signatures and restricted access to configuration and administration. Integration credentials saved through the backend are encrypted; receipt-link tokens are hashed in the order database. These measures do not mean that every stored customer field or browser-local extension record is separately encrypted.
No online service or device can be guaranteed completely secure. Keep private order links confidential and use a secure email account and browser. We will address a personal-data breach in accordance with applicable notification obligations.
10. Your choices and privacy rights
Depending on the laws that apply to you, you may have rights to obtain information and a copy of your personal data, correct inaccurate information, request erasure, restrict processing, receive portable data, object to processing based on legitimate interests, and withdraw consent. You may object to direct marketing at any time. Withdrawing consent does not retrospectively invalidate processing already based on it.
Send requests to hello@hiddentrades.com, ideally from the email used for the order. An order reference or TradingView username can help us locate the record. We may ask for proportionate confirmation of identity before disclosing or changing data. Do not send passwords, wallet private keys or seed phrases.
Some requests are subject to exceptions, for example records required by law or necessary for legal claims. We respond within the applicable statutory time limits—normally one month for GDPR requests, with any permitted extension explained. You may also complain to the competent data-protection authority, including in your usual place of residence or work where applicable.
For records controlled independently by NOWPayments, TradingView, Google or another provider, you may also need to exercise your rights directly with that provider. For extension data kept only on your device, see the extension deletion and control instructions.
11. Automation and planned features
Current automation applies the contribution tier you select, verifies payment states, sends configured messages and limits repeated requests. It is not behavioural advertising or credit scoring. TradingView access is activated manually. Please contact us if you think an automatic check or record is wrong.
References on the homepage to a future trading journal, AI analysis/companion, account dashboard or additional notification channels describe a roadmap. The current checkout does not import your executed trades or send them to an AI service. The extension version covered by its own notice does not send chart data to an AI service either. New features involving materially different information handling will need an updated notice and, where required, additional permission or consent before that processing begins.
12. Younger users
Hidden Trades is designed for adult traders and is not directed at children. We do not knowingly solicit personal information from children. If you believe a child has provided information to us, contact the privacy address so we can assess the situation and take appropriate action.
13. Customer accounts and the referral program
A verified paid purchase or an administrator's tier grant creates a customer account linked to your email. Admin-created accounts record the assigned tier, grant or recorded contribution, creation date and administrative audit history. We keep the account identifier, password hash if you set a password, email-verification state, sign-in/activity dates, account status and administrative support records. We do not send a plaintext password. Magic sign-in links use random, single-use tokens stored as hashes and expire after 60 minutes; opening a link alone does not consume it. Customer sessions are limited to two hours of inactivity and twelve hours overall. Current administrator sessions use a separate four-hour inactivity limit within that twelve-hour maximum.
Account access and a one-time referral-program introduction may be sent as account-feature messages. Their template delays are configurable. These messages do not subscribe you to ongoing marketing newsletters, which remain optional.
If you follow a valid referral link, a first-party cookie named ht_ref can remember the first eligible referrer for up to 30 days. It contains a referral code, expiry and integrity signature, and is configured Secure on HTTPS, HttpOnly and SameSite=Lax. It is used to attribute a purchase and calculate the direct referrer's commission; it is not used for cross-site behavioural advertising. You can remove the applied referral using the checkout's Remove control or your browser's cookie settings. Attribution already recorded on a completed order may remain in the financial ledger.
For referral partners we store a public referral code, eligible referred-order references, USD sale/commission amounts, reversals, payout requests and payout records. Partners see their own amounts and statuses, not referred buyers' email addresses or TradingView usernames. Administrators can review the underlying records to administer the program, prevent self-referrals, reconcile refunds and send or record payments.
Payout destinations and providers
You can provide a PayPal receiving email or a crypto receiving address, asset/network and memo or destination tag. We store these instructions encrypted, together with an encrypted destination snapshot for each prepared transfer. Changing your current destination does not alter transfers already prepared. We do not automatically reuse a checkout payment's sending address.
When an administrator sends a payout through PayPal, our server sends your receiving PayPal email, USD payout amount, an internal payout reference and a generic commission description to PayPal. When using NOWPayments, it sends your receiving address, asset/network, memo/tag if supplied, the instructed USD equivalent and internal payout references. We retain provider batch/item identifiers, status, transaction references, amounts, environment (sandbox or live) and administrative audit entries to reconcile transfers and avoid duplicates. We poll provider status from our server; these payout integrations do not embed provider tracking scripts in the dashboard. External manual transfers may also be recorded.
PayPal and NOWPayments independently process receiving account and transaction information under the PayPal privacy statement and NOWPayments privacy policy. Their services can involve international processing and their own verification, retention and legal obligations. Crypto transfers may also be recorded on public blockchains. Sandbox transfers use the selected provider's test service and do not settle real commission balances.
The dashboard can create promotional images locally in your browser containing your public referral link. They are downloaded or shared only when you choose to do so. Using the referral program is optional, and your participation does not change the price charged to a referred customer.
Account and referral processing supports the customer/referral relationship, fulfilment of requested features, security, dispute handling and applicable financial obligations. Relevant legal grounds may include contract performance, legitimate interests and legal obligations as described above, with applicable cookie/consent requirements also relevant. Financial referral/payout records may need to be retained after an account or marketing preference changes. You can contact us using the privacy-request process above.
14. Changes to this notice
We may update this notice as the service, data flows or applicable requirements change. The date at the top identifies the current published version. Where required, we will provide additional notice or obtain consent for a material change; publication of an updated page does not by itself create consent for an unrelated new use.