Legal
Privacy Policy
What MarketPD collects, why, and your rights.
Last updated: 2026-10-14.
Who is the data controller
The data controller is the operator of MarketPD, an independent solo builder based in the EU (see the Legal notice). For any privacy request, email [email protected].
What we collect
Account data — your email address and a hashed password, handled by our authentication provider (Supabase). Alert settings — the assets you choose to watch and whether alert emails are on. Subscription data — your subscription status and a payment-processor customer ID, received from Stripe when you subscribe. Basic technical logs, including IP address, kept by our hosting and security providers. Aggregate page and performance analytics from Cloudflare Web Analytics and Google Analytics, used to understand page views, visitor experience, and site speed. We do not ask for your name or address, and we never receive your full card details (Stripe handles those).
Why, and the legal basis
We use this data to provide Posture Terminal and process your subscription (performance of our contract with you), to send the trend-flip alert emails you set up by watching an asset (performance of our contract with you; every email has a one-click unsubscribe, and you can pause or remove alerts on your account page), and to keep the service secure and working (legitimate interests). We do not sell your data or use it for third-party advertising, and alert emails contain no marketing.
Processors we use
Supabase (authentication + database hosting), Stripe (payments), Resend (delivery of alert emails), Cloudflare (DNS, security, and web analytics), and Google Analytics (aggregate site analytics). Each processes data on our behalf under their own terms and security. Data may be processed outside the EEA under appropriate safeguards (e.g. Standard Contractual Clauses).
Retention
We keep account data while your account exists; when you delete your account we remove or anonymise it. Billing and accounting records are kept for as long as EU tax law requires (typically up to 10 years), after which they are deleted.
Your rights (GDPR)
You can request access, correction, erasure, restriction, portability, or object to processing — email [email protected]. You may also complain to your local EU data-protection supervisory authority.
Cookies & local storage
The site itself sets no advertising cookies. Cloudflare Web Analytics runs a small, cookieless browser beacon for aggregate site metrics and is always on. Google Analytics is off by default and loads only after you accept it in the cookie banner — it is what sets analytics cookies (e.g. _ga), so nothing from it runs until you opt in. You can decline, or change your mind anytime via “Cookie settings” in the footer (declining or clearing the choice stops Google Analytics). Your login session is stored in your browser by Supabase so you stay signed in. Stripe may set cookies during checkout for fraud-prevention and to operate its payment flow. The login session and checkout cookies are strictly necessary; Google Analytics runs only on your consent.
Contact
Privacy questions: [email protected].