Legal
Privacy Policy
Effective 4 October 2026 · Last updated 4 October 2026 · Applies to the Tradivo mobile app and tradivo.in
1. Who we are
Tradivo is a trading-education and paper-trading app for Indian equity-derivative markets. It is operated by the Tradivo team in India ("Tradivo", "we", "us"). You can reach us at support@tradivo.in.
For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data described here. You are the Data Principal.
2. The short version
We collect the least we can to run an account-based learning and simulation app:
• We store your name, email address and a one-way hash of your password. We never store your password itself.
• We store your learning progress and your simulated trading activity, so your account works across devices.
• Tradivo involves no real money. We do not collect payment details, bank accounts, PAN, Aadhaar or any KYC documents, because we never need them.
• We run no advertising networks and no third-party analytics or tracking SDKs in the app.
• We do not sell your personal data, and we do not share it for anyone else's marketing.
3. Data we collect, and why
Account
Name, email, password hash (bcrypt), email-verified flag, account created/updated time.
Why we need it: To create and secure your account, sign you in, verify that the email is yours, and let you recover access.
Retained: While your account is open, then deleted within a reasonable period after you close it
Learning progress
Lessons completed, the lesson and topic you are on, experience points earned.
Why we need it: To resume you where you stopped and show your progress.
Retained: With your account
Simulated portfolio
Virtual balance, virtual orders and positions (contract, strike, expiry, quantity, simulated entry and exit prices, timestamps), virtual deposits and withdrawals.
Why we need it: To run the simulation and show your performance history. All amounts are virtual.
Retained: With your account
One-time passcodes
Your email address and the code, during sign-up or password reset.
Why we need it: To confirm you control the email address. Codes are short-lived.
Retained: Only until the code expires
Notification identity
An identifier linking your account to your device's push subscription, held by our notification provider.
Why we need it: To send you notifications you have asked for. We store no device token ourselves.
Retained: Until you sign out or disable notifications
Technical logs
Request method, path, response status and duration; your email address appears in logs when a passcode is sent.
Why we need it: To keep the service running, diagnose faults and investigate abuse.
Retained: For a limited period, then deleted
Abuse prevention
Your IP address and browser/app user-agent, held briefly in memory to apply rate limits.
Why we need it: To protect the service from automated abuse. Not written to our database.
Retained: Seconds, in memory only
Error reports
Diagnostic information when something fails on our servers.
Why we need it: To find and fix faults. Our error monitoring is configured not to attach personal data.
Retained: For a limited period, under the provider's retention policy
We do not collect your location, contacts, photos, microphone or camera data, and the app does not ask for those permissions.
4. Why we are allowed to use it
Under the DPDP Act we process your personal data on the basis of the consent you give when you create an account and accept this policy, and for the legitimate uses that Act permits, such as keeping the service secure and complying with law. Where we rely on consent you may withdraw it at any time, as described in section 8. Withdrawing consent means we can no longer provide you an account.
5. Who else processes your data
We use a small number of service providers ("Data Processors") who act on our instructions and are not permitted to use your data for their own purposes:
Database hosting provider
Receives all account, learning and simulated-trading data at rest.
Application hosting provider
Receives data in transit while the service runs.
Email and push notification provider
Receives your email address, your account identifier and message content.
Error monitoring provider
Receives technical error data; configured to exclude personal data.
Market data provider
Receives nothing about you. Price data flows one way, from the provider to us.
We may also disclose personal data where the law requires it, to respond to a valid legal request, or to establish or defend a legal claim. If our business is transferred, your data may transfer with it under this policy.
6. Where your data is held
Our providers may store or process data outside India. Where that happens, we transfer data only to countries not restricted by the Central Government and require contractual protections from each provider.
7. How we protect it
• Passwords are stored only as bcrypt hashes and are never recoverable by us or sent to your device.
• Traffic between the app and our servers is encrypted in transit over HTTPS, and market data over a secure WebSocket.
• Access to production data is limited to people who need it to operate the service.
• Requests are rate-limited, and sign-up and password reset require control of your email address.
No system is perfectly secure. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the DPDP Act requires.
8. Your rights
As a Data Principal you may:
• Access a summary of the personal data we hold about you and how we process it.
• Correct or complete inaccurate data, and update it.
• Erase your personal data, unless we must keep it to comply with law.
• Withdraw consent and close your account.
• Nominate another person to exercise these rights if you die or become incapacitated.
• Raise a grievance with us, and escalate to the Data Protection Board of India if you are not satisfied.
How to exercise a right
Email support@tradivo.in from the address on your account. We will respond within a reasonable time. We may ask you to confirm your identity before we act, and we will tell you if we cannot meet a request and why.
9. Children
Tradivo is not intended for anyone under 18, and we do not knowingly collect personal data from children. Under the DPDP Act, processing a child's data requires verifiable parental consent, and we do not operate that process. If you believe a child has created an account, contact support@tradivo.in and we will delete it.
10. The website
On tradivo.in we use only the cookies and local storage needed to make the site work and to remember your preferences. We do not run advertising or cross-site tracking cookies. If you use the contact form, we collect your name, email address and message so that we can reply to you, and we keep them only as long as needed to handle your enquiry. If you opt in to updates, we use your email address to send them until you unsubscribe.
11. Changes to this policy
If we change how we handle personal data we will update this page, change the "last updated" date, and — for a change that materially affects you — tell you in the app or by email before it takes effect.
12. Contact and grievances
For any question about this policy, or to exercise a right, contact us using the details below. We acknowledge every grievance and aim to resolve it promptly.
Contact: Tradivo Support
Email: support@tradivo.in
Escalation: Data Protection Board of India, if our response does not resolve your grievance
Tradivo is an educational simulator. It does not execute trades on any exchange, does not handle real money, and is not registered with SEBI in any capacity. © 2026 Tradivo.