Privacy Policy

1. Who is responsible for your data

Rishmon is operated by an individual in India, who is the data fiduciary for the purposes of the Digital Personal Data Protection Act, 2023. For any privacy question or request, write to support@rishmoninfo.in.

2. What we collect

Account data. Your email address, and a password stored only as a cryptographic hash by our authentication provider. We never see or store your password in readable form.

Trading data. The orders (simulated in paper mode, real in live mode), positions, trade history, virtual balance and preferences you create by using the platform. This is the substance of the product — it exists so your desk still has your trades in it tomorrow.

Broker connection data, if you choose to connect one. An access token issued by your broker, its expiry time, and your broker user identifier. We do not receive or store your broker password, your holdings, your bank details or your real trading history.

Technical data. Standard server logs generated by our hosting provider, including IP address, browser type and request times, kept for security and debugging.

We do not collect your name, phone number, address, PAN, Aadhaar, date of birth or any financial account details, and you should not send them to us.

3. Why we use it

To create and secure your account and sign you in. To store and display your practice trades. To fetch market data on your behalf if you have connected a broker. To keep the platform working and investigate faults and abuse. To contact you about your account, including confirmation and password reset emails. We do not use your data for advertising or profiling, and we do not sell or rent it to anyone.

4. Where it is stored, and who processes it

Supabase hosts our database and authentication and therefore stores your email, password hash and all your trading data. Vercel hosts the application and processes requests, generating the server logs described above. Both are third-party processors acting on our instructions under their own security and privacy terms, and both may process or store data outside India.

By using Rishmon you consent to that cross-border processing. If that is not acceptable to you, please do not create an account.

5. Cookies and similar technologies

Rishmon uses only what it needs to keep you signed in: a session token held in your browser's local storage by our authentication provider. There are no advertising cookies, no analytics cookies, and no third-party trackers, which is why you are not being asked to dismiss a consent banner. Clearing your browser storage signs you out.

6. How long we keep it

Account and trading data are kept for as long as your account exists. If you ask us to delete your account, the login and all associated trading data are removed. Server logs are retained by our hosting provider on their own schedule, typically a short rolling window. Backups may persist for a limited period after deletion before being overwritten.

7. Your rights

Under the Digital Personal Data Protection Act, 2023 you may ask us to give you a copy of the personal data we hold about you, correct anything inaccurate, delete your account and its data, or withdraw a consent you previously gave — for example by disconnecting your broker, which deletes the stored token immediately. You may also complain to the Data Protection Board of India.

To exercise any of these, email support@rishmoninfo.in from the address your account uses. We will respond within 30 days.

8. Security

All traffic is encrypted in transit over HTTPS. Passwords are hashed by our authentication provider and are never visible to us. Database access is restricted per user by row-level security, so one account cannot read another's data. Broker tokens are stored server-side and are not exposed to the browser.

No system is perfectly secure, and Rishmon is early-stage software maintained by one person. Please use a password you do not use anywhere else, and do not store anything sensitive here.

9. Children

Rishmon is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

10. Administrative access

We think you should know this rather than discover it. While Rishmon is in limited testing, the operator can see the list of registered accounts — email address, when each signed up and last signed in, and summary counts of simulated orders and trades — and can reset or delete an account. This exists to manage a small closed test group and to spot faults. It is not used to read the content of your individual trades for any other purpose.

11. Changes

We may update this policy. The "last updated" date at the top will change, and for material changes we will make reasonable efforts to notify registered users by email.