Privacy Policy
Last updated: September 5, 2026
The short version: Exactick runs on your machine, and the only personal data we ask you for is an email address — for the waitlist, or to send you your licence key. If you buy, Stripe collects a little more in order to charge you and to calculate tax; section 5 says exactly what. There is no account, no tracking cookie, and no telemetry in the app. This page explains the details.
1. Who is responsible
Exactick is built and operated by marusabaki, an independent solo developer based in Japan, who is the data controller for the processing described here. The contact point for any privacy question or request is [email protected].
2. What the application collects: nothing
The price data you import, the sessions you run, your trades, your statistics and your drawings are stored in your browser’s own storage on your own device. They are never uploaded to us. Exactick contains no analytics, no telemetry, no crash reporting and no usage tracking. We cannot see what you test, when you test it, or how it went.
The one exception is licence verification: a licensed copy periodically sends your licence key to our licensing endpoint to confirm it is still valid, together with the technical information any web request carries (IP address, user agent, timestamp). We use that only to validate the key. It is not linked to your testing data, because your testing data never leaves your device.
3. What we collect, and why
| Data | Why we have it | Legal basis (GDPR) |
|---|---|---|
| Email address (waitlist) | To tell you when Exactick launches and to send occasional progress notes, plus your optional one-question survey answer. | Consent (Art. 6(1)(a)) — withdrawable at any time. |
| Email address (purchase) | To deliver and re-send your licence key, and to contact you about that purchase — for example a security or licensing notice. | Performance of a contract (Art. 6(1)(b)). |
| Support correspondence | To answer you, and to keep a record of what was agreed. | Contract and legitimate interests (Art. 6(1)(b), (f)). |
| Licence key checks | To confirm a licence key is still valid (see section 2). | Performance of a contract (Art. 6(1)(b)). |
| Aggregate website statistics | To see how many people visit which page (see section 4). | Legitimate interests (Art. 6(1)(f)). |
We do not ask you for your phone number, date of birth or any government identifier, and we never see your card details. If you buy, Stripe collects a billing name and address at checkout so that it can calculate tax — see section 5. We do not sell or rent personal data, we do not share it for advertising, and we do not use it to build profiles or to make automated decisions with legal effects.
4. Cookies and website analytics
This website sets no cookies of its own and does not use advertising or cross-site tracking. Visitor numbers are measured with Cloudflare Web Analytics, which is cookieless: it does not fingerprint visitors and does not track people across sites or over time. Page loads are counted, and we see aggregate figures such as page, referrer, country and browser.
The site loads its typefaces from Google Fonts. Doing so means your browser makes a request to Google’s servers, which receives your IP address and user agent. If you prefer to avoid that, a content blocker will stop it; the site remains readable.
5. Who else processes your data
- Kit — email service provider. Holds the waitlist and announcement list; the list lives in their system, not in a database of ours.
- Resend — sends transactional email, such as licence-key delivery and re-sends.
- Cloudflare — hosts and delivers this website, and provides the cookieless analytics described above.
- Stripe — processes payments, through its Link service. Stripe is the merchant of record for your purchase and is an independent controller of the payment data you give it, including your card details, which we never receive or store. Because Stripe has to calculate sales tax, the billing name and address you enter at checkout are also held in our Stripe account; we do not copy them into any system of our own, and we use them only where an order, a refund or a tax obligation requires it. Stripe’s own privacy notice governs that data; otherwise we see only what we need to fulfil and support the order.
These providers are located outside Japan, mainly in the United States and the European Union, so your data is transferred internationally. Where the GDPR applies, those transfers rely on the transfer mechanisms in each provider’s data processing agreement, normally the European Commission’s Standard Contractual Clauses. We share data with no one else, except where we are legally required to.
6. How long we keep it
- Waitlist email: until you unsubscribe or ask us to delete it. Every email we send carries a one-click unsubscribe link.
- Purchase email and licence records: for as long as the licence is valid, so that we can re-send your key and honour the licence. Transaction records that Stripe or tax law require us to keep are kept for the period the law prescribes.
- Support email: up to two years after the thread closes.
- Licence check logs: a rolling window of no more than 12 months.
- Website analytics: aggregate only, retained by Cloudflare under their own retention policy. There is nothing in it that identifies you.
7. Your rights
Wherever you live, you can write to [email protected] and ask us to give you a copy of the data we hold about you, correct it, delete it, or stop using it. If you are in the EU, the UK, Japan or another jurisdiction with comparable law, you also have the rights to access, rectification, erasure, restriction, portability and objection, and you may withdraw consent at any time without affecting processing already carried out. California residents may exercise the equivalent rights under the CCPA/CPRA; we do not sell or share personal information as those terms are defined there.
We answer within 30 days. Because we hold so little, deleting your data is usually as simple as removing your email address — note that we may need to keep a record of a purchase for as long as tax or payment rules require, and that deleting the email tied to a licence means we can no longer re-send that key to you.
If you think we have handled your data badly, please tell us first — but you always have the right to complain to your local data protection authority.
8. Security
The site is served over HTTPS, and access to the provider dashboards listed above is protected with multi-factor authentication. The strongest protection here is structural: the data we hold is limited to an email address, and the sensitive material — your market data and your trading records — never leaves your device in the first place. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. Children
Exactick is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, write to [email protected] and we will delete it.
10. Changes to this policy
We may update this policy. The date at the top always shows the current version. If a change materially affects how we handle your data, we will give notice on this website and, where we have your email address, by email.
11. Contact
Privacy questions and requests: [email protected].