Privacy Policy
Quote Path Studio
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Quote Path Studio stores your lesson progress, active training setup, entry and price levels, dated attempts, custom chart names and candle values on your device. Built-in quotes are fictional educational content. If you choose Back up now, the app sends a snapshot of this data to our backend, including your current draft. The server creates a random installation secret; the app stores the secret in the device Keychain and the server stores its cryptographic hash with the snapshots and creation/update timestamps. We do not ask for an account, name, email, password, location, contacts or financial account details. Visiting the website or using backup necessarily sends network information such as your IP address, request time, URL and technical request metadata to the hosting infrastructure. The application server does not intentionally log secrets or snapshot contents.
How we use information
Local data makes lessons, the editor, history and unfinished training available offline and after reopening. Optional server snapshots let the same installation restore a previously uploaded copy while its Keychain secret remains available. Network metadata supports request delivery, security, rate limiting and diagnosis of service failures. Your data is not used for advertising, analytics, trading, profiling or sending email. The public contact email is only for privacy correspondence initiated by you outside the app.
Service providers and sharing
The backend and PostgreSQL database are hosted by Railway, which processes stored snapshots and technical infrastructure data to operate the service. Public HTTPS requests to quote-path-studio.website and api.quote-path-studio.website pass through Cloudflare, which terminates HTTPS and proxies requests to our pinned Railway service origin over HTTPS. Cloudflare processes network and request metadata and the request and response contents needed to proxy the service. Network and connectivity providers also handle traffic needed to deliver requests. There are no advertising, analytics, social sign-in, market-data or messaging SDKs in the app. Opening the Privacy Policy uses your system browser and its normal network processing. We do not sell personal data or publish installation snapshots. We may disclose information if legally required; we do not claim that infrastructure providers retain no logs.
Data retention
Local progress, drafts, history and saved charts remain until you erase local data or remove the app, subject to the operating system's device backup and storage behavior. The Keychain secret may remain after app removal; it is removed by the app when server deletion succeeds. Server snapshots remain until replaced by a new upload or deleted using the installation secret. We have not configured a time-based expiry for installation rows. Railway and Cloudflare infrastructure logs and any infrastructure backup copies follow the relevant provider's settings and operational retention; we do not promise a fixed retention period or immediate removal from provider backups. There is no application-level archive of deleted snapshots, and no scheduled database backup has been enabled by this application.
Deleting your information
Settings and help contains Delete server data, which deletes the installation row, both snapshots and its server authorization, then removes the Keychain secret after the deletion is confirmed. This does not erase local data. Erase local data separately removes progress, attempts, draft and saved charts on the device; it does not delete an existing server copy. Delete the server copy first if you want to remove both. A later manual backup creates a new installation. Deletion removes active database records; provider logs, operating-system backups and any infrastructure backup copies are not edited by that action. If the secret is lost, the app cannot retrieve or prove ownership of the server copy and does not offer account-based recovery. For privacy questions or deletion assistance contact OrdwulfFarnleigh@icloud.com without sending your installation secret.
Permissions and your choices
The app requests no location, camera, microphone, contacts, photo-library or notification permission. All core training features work without a network connection. Backup and restore use internet access only when you choose their controls; you can stop using them at any time without losing local features. No cookie or login is required to read this policy. You can manage system device backups and browser settings through the operating system, and erase local or server data using the separate controls described above.
Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal data and to complain to your local data-protection authority. You can inspect local records in the app, edit or delete saved custom charts, overwrite a server snapshot with corrected local data, restore an existing snapshot, and delete local or server data. Contact OrdwulfFarnleigh@icloud.com to make a privacy request or ask about applicable rights. We may need sufficient information to verify a request; never email the secret. Without the installation secret, we may not be able to associate a server row with you.
Security
Public connections use HTTPS terminated by Cloudflare, with HTTPS forwarding to the pinned Railway service origin. Private API requests require a unique random installation secret in an Authorization header; it is not embedded in a URL or shared across installations. The server stores only a SHA-256 hash of that secret, validates request bodies and limits installation creation. PostgreSQL is accessed by the backend rather than by the phone. Local state uses protected application storage and the secret uses a device-only Keychain accessibility class. These measures reduce risk but cannot guarantee absolute security. Anyone who obtains your installation secret can access or replace that installation's server snapshots; keep your device protected.
Children’s privacy
Quote Path Studio is an educational price-chart utility intended for students and adults learning about fictional market movements. It is not directed to children under 13, offers no real trading or financial accounts, and does not knowingly solicit identifying information from children. If you believe a child has supplied personal information through a custom chart or privacy correspondence, contact OrdwulfFarnleigh@icloud.com so the concern can be assessed.
Changes to this policy
This policy describes the current application and optional backup service. We may update it when functionality, hosting or processing practices change. The effective date at the top identifies the current version, and the latest policy is available through the app's Privacy Policy link and this public page. Material changes will be reflected in the policy and, where appropriate, in the application.