Your data, plainly explained.

Prometra is operated by MegaCharts Inc, a California corporation. You can reach us at david@megacharts.com for any privacy question, request, or concern. We respond to every privacy request, usually within a few business days and always within the timelines required by applicable law.

This policy applies to the Prometra website and web application, and to any related services we provide that link to this policy. It does not cover third-party services you choose to connect to Prometra (such as your brokerage). Those services have their own privacy policies, which we encourage you to read.

We try to collect as little as possible. The categories of information we handle are:

Account information

Your email address and authentication identifiers, handled through our authentication provider (Supabase). If you sign in with an identity provider (e.g., Google), we receive only the basic profile information you authorize.

Brokerage account data (via SnapTrade)

When you connect a brokerage, we receive read-only data about that account through our brokerage-aggregation provider, SnapTrade (operated by Passiv Technologies Inc.). This typically includes:

• account name, institution name, account type, and (where provided) a masked account number;
• positions: ticker symbol, units held, price, market value, open profit/loss, asset type/description, and currency;
• cash balances per currency;
• connection status (connected, disabled, sync errors).

Prometra never sees or stores your brokerage login credentials. Authentication with your broker happens between you, your broker, and SnapTrade. The connection scope is read-only: Prometra cannot place trades, transfer funds, change account settings, or otherwise modify your brokerage account.

Identifiers we store on our servers

To keep your brokerage connections working across sessions, we store on our servers a SnapTrade user ID, a SnapTrade user secret, and brokerage-connection metadata (broker identifier, connection status). These identifiers are kept server-side and are never exposed to your browser.

Technical data

Like any web service, our hosting and database providers (Vercel and Supabase) generate basic request logs that may include IP address, user agent, request path, and timestamps. We use these for security, debugging, and abuse prevention.

Cookies

We use only first-party cookies that are strictly necessary to keep you signed in and to maintain your session. We do not use advertising cookies, cross-site tracking cookies, or third-party analytics that profile you.

We use the information described above only to:

• authenticate you and keep your account secure;
• fetch and display your portfolio and produce the analyses you ask for;
• maintain, debug, and improve the reliability and security of the Service;
• communicate with you about the Service (e.g., security alerts, policy updates, account-related messages);
• comply with our legal obligations and enforce our Terms of Service.

What we do not do: we do not sell or rent your personal information; we do not use your brokerage data to advertise to you; we do not use your brokerage data to train machine-learning models; and we do not share your information with third parties for their own marketing.

We rely on a small number of vendors that process information on our behalf, under written agreements that restrict their use of that information to providing services to us:

• SnapTrade (Passiv Technologies Inc.)— brokerage account aggregation and broker authentication. See SnapTrade’s privacy policy.
• Supabase— authentication, database, and file storage. See Supabase’s privacy policy.
• Vercel— web hosting and edge logging. See Vercel’s privacy policy.

We may add or change processors over time. Material changes will be reflected here with an updated “Last updated” date.

We do not share your personal information with third parties except in these limited cases:

• with the processors listed above, strictly to operate the Service;
• when required by law, valid legal process, or to protect the rights, property, or safety of our users or the public;
• in connection with a corporate transaction (merger, acquisition, financing, or asset sale), in which case we will require the recipient to honor this policy or notify you and give you the option to delete your data first.

We do not sell personal information. We do not disclose personal information for cross-context behavioral advertising.

We retain your account information and brokerage data for as long as your account is active, plus the period reasonably necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we delete or anonymize your personal information within 30 days, except where law requires longer retention (for example, certain log or transactional records).

You have the following rights with respect to your data:

• Access & portability— request a copy of the personal information we hold about you;
• Correction— ask us to correct information that is inaccurate or incomplete;
• Deletion— ask us to delete your account and personal information;
• Withdraw consent— disconnect any brokerage at any time, either from your broker’s connected-apps settings or by emailing us, which terminates Prometra’s access to that account’s data;
• Object or restrict— ask us to limit certain processing.

To exercise any of these rights, email david@megacharts.com. We will verify your request using your account email and respond within 30 days. We will not discriminate against you for exercising any of these rights.

You can also revoke Prometra’s access at the broker’s end — most brokers expose connected-app management in their settings. Revoking at the broker terminates the connection immediately.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), gives you the rights described below.

Categories of personal information we collect. In the past 12 months we have collected the following CCPA categories: identifiers (e.g., email, account ID, IP address); commercial information (your brokerage holdings and balances, received in read-only form); internet/electronic activity (basic request logs); and inferences derived from the above (e.g., your asset allocation summary).

Sources. Directly from you, from your authorized brokerage connections via SnapTrade, and automatically from your interactions with the Service.

Purposes.The purposes described in Section 4.

Recipients.The processors listed in Section 5, and the limited disclosures described in Section 6.

Sale or sharing. We have not sold or shared (within the meaning of the CCPA) personal information in the past 12 months, and we do not intend to.

Sensitive personal information.Brokerage financial-account information is treated as sensitive personal information. We use it only for the purposes described in Section 4 and do not use or disclose it to infer characteristics about you.

Your CCPA rights. You have the right to know, access, correct, delete, and limit the use and disclosure of your sensitive personal information, and the right to be free from discrimination for exercising these rights. You can exercise these rights yourself or through an authorized agent by emailing david@megacharts.com. Authorized agents must provide written authorization, and we may require you to verify your identity directly.

We protect your data with commercially reasonable technical and organizational safeguards, including:

• TLS encryption for data in transit;
• encryption at rest for our database (provided by Supabase);
• SnapTrade user secrets and other credentials kept server-side only and never exposed to the browser;
• role-based access controls and least-privilege access for our engineering operations;
• read-only brokerage connections, by design.

No method of transmission or storage is 100% secure. If we discover a security incident affecting your personal information, we will notify you and any required regulators consistent with applicable law.

Prometra is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.

The Service is operated from the United States and is currently intended for U.S. users. If you access it from outside the United States, you understand that your information will be processed in the United States, which may have different data-protection laws than your jurisdiction.

We may update this policy from time to time. When we do, we will post the new version here with a new “Last updated” date. If the changes are material, we will provide reasonable advance notice (for example, an in-product notice or email) so you can review them before they take effect.

For any privacy question, request, or complaint, please email david@megacharts.com.

MegaCharts Inc
Attn: Privacy
United States