Privacy Policy

About this policy

S7 Markets is a market-observation product by Septentrio: live quotes, a market map, an economic calendar, daily briefs, watchlists, and alerts. This policy explains what personal data the product handles, why, and the choices you have.

It applies to the S7 Markets web app and the account features inside it. All public surfaces work without an account; an account is only needed for the watchlist, alerts, and event reminders.

Data we collect

Account data. When you register we store your email address, display name, and optional avatar. If you sign in with Google or Facebook, we receive your name, email address, and profile picture from that provider.

Product data. Your watchlist follows, alert rules, alert inbox, and event reminders are stored with your account so they work across devices.

Push subscription. If you enable notifications, your browser’s push subscription (endpoint and delivery keys) is stored so we can deliver the alerts you asked for.

Technical logs. The access log of our interface records the path requested, the time, the address the request came from and the browser’s user-agent string, for reliability and abuse prevention. How long each log is kept is set out under Retention and deletion.

Phone number. We do not need one for you to use the product or to hold an account. Where the app offers to take one, it says at that point what it is for, and giving it is your choice.

Data that stays on your device

Two values are saved in your browser’s local storage and never sent to us: theme, the appearance you chose (light, dark, or system), and cal-density, the calendar row spacing you chose.

Three more values stay in your browser and never reach our servers: s7-search-history keeps your own last few search terms so the search box can offer them again, and you can clear it there; s7-vapid-key caches the public key used for notifications, so the app can tell when it has changed; s7-inbox-read remembers which alerts you have read in the current tab, and is discarded when you close it.

Your language choice is carried in the page address (for example /en or /vi), we do not set a language cookie.

How we use data

To provide the product: signing you in, syncing your watchlist and alert rules, evaluating alerts, and delivering the notifications you enabled.

To keep the service reliable and secure: monitoring errors, preventing abuse, and protecting accounts.

We do not use your data for advertising, we do not build advertising profiles, and we do not sell personal data.

Cookies

Cookies are small files a site stores in your browser. Every cookie this app sets is our own, on our own domain, and is read only by us. None is used for advertising and none follows you to other sites. You can delete them at any time in your browser settings; the app then falls back to its defaults and, if you were signed in, asks you to sign in again.

s7_token holds your sign-in session. It is written when you sign in, lasts up to 30 days, is sent only to this site, travels only over an encrypted connection, and is httpOnly: scripts running in the page cannot read it. Signing out deletes it.

Apart from the three measurement cookies, which are set only if you allowed measurement and are described in the next section, the others remember a choice you made, so the page can be drawn that way before it reaches you. They are written only when you change something: a visit where you change nothing sets no cookie at all. Each holds a short code, such as which tab, which size or which currency, and never your name, your email or anything you typed. The page can read them, they are sent only to this site, and they expire twelve months after they are written. They are:

• s7-map-tab · s7-calendar-tab · s7-brief-tab · s7-watchlist-tab: the view you last chose on the Map, the Calendar, the Brief and the Watchlist.
• s7-font-size: the reading size you chose.
• s7-currency-on · s7-currency: whether a second display currency is on, and which one.
• s7-map-onboarding: whether you have started, dismissed or finished the short introduction to the Map.
• s7-cols-markets · s7-cols-watch · s7-cols-rule: the columns you hid in the Markets, Watchlist and Rules tables.
• s7-consent: whether you allowed analytics and measurement or chose essential only, and which version of the notice you answered.
• s7_vid · s7_ft · s7_lt: only if you allowed measurement. What they hold and how long they last is set out under Analytics and measurement.

Analytics and measurement

We do not measure how people use the app without asking first. Nothing described in this section happens unless you have been asked and have agreed; where no such choice has been offered, none of it is running. You are asked once, in a notice on your first visit, and you can change your answer at any time in Settings, under Legal & Privacy.

If measurement is on, three further first-party cookies are set. s7_vid is a random identifier for a browser, not for a person: it is not your name, your email or your account, and it expires after 180 days. s7_ft records how you first arrived, such as the campaign or the site that linked to you, the page you landed on and the date; it is httpOnly, so no script in the page can read it, and it expires after 30 days. s7_lt holds the same kind of record for your most recent arrival from a campaign or another site: it is replaced each time you arrive that way, is httpOnly too, and expires 30 days after it was last written.

Measurement records which screens are opened and which actions are taken, together with the language, the surface and whether you are signed in. It never carries your email address, your phone number, or anything you typed.

Those records are processed for us by PostHog, our analytics provider, on its servers in the European Union, under a data-processing agreement. PostHog is used only after you choose “Allow” in the notice, or turn Analytics and measurement on in Settings, and the records reach it through a path on our own domain rather than through a third-party script in the page. In your browser it keeps a session identifier in session storage, which is cleared when you close the tab, and it sets no cookie of its own. Your IP address reaches PostHog only as part of the connection; PostHog is set to discard it, so it is not stored with the records. To withdraw, turn Analytics and measurement off in Settings, under Legal & Privacy: measurement stops at once, PostHog’s session identifier is cleared, and the three cookies above are deleted.

The same choice would cover session recording, which replays pointer movement and clicks to show how a screen was used. It is limited to pages that need no account, everything you type is masked, and recordings are deleted after 30 days.

Signing in with Google or Facebook

Signing in with Google or Facebook shares your basic profile (name, email, picture) with us, as described on the provider’s consent screen. We use it only to create and sign in to your account.

We never receive your password from these providers, and we do not post or read anything on your social accounts.

Push notifications

Notifications are strictly opt-in: they only start after you grant your browser’s permission prompt.

You can stop them at any time, disable notifications in the app’s settings or revoke the permission in your browser; either removes the subscription.

Third parties

Hosting and delivery. The website runs on Vercel. The service behind it, including the database, runs on Amazon Web Services in Singapore. Both process requests on our behalf and under contract.

Market data. Quotes, calendar events, and editorial content come from our own systems; requests for public data are not tied to your account.

We share personal data with no one else, except where the law requires it.

What else runs in the page. Fonts and country flags are served from our own domain, not from an outside network. Signing in with Google or Facebook loads that provider’s code, and only on the sign-in screen. Nothing else third-party runs while you read.

Automated abuse protection

Sign-in and other form submissions pass through automated bot detection, provided by Vercel, to protect accounts from abuse. Its code is served from our own domain and runs on every page, not only on the form. It inspects request signals, not your content.

Retention and deletion

Account data is kept for as long as your account exists.

You can delete your account yourself in Settings, under Account. Deletion is immediate and cannot be undone: it removes your profile, watchlist, alert rules, alert inbox, event reminders and push subscriptions. It also clears the record of failed sign-in attempts held against your email address.

Technical logs are deleted on a fixed schedule. The access log of our interface is deleted after 14 days. The application logs behind it are deleted after 30 days.

To slow down password guessing we count failed sign-in attempts against the email address used and the address the attempt came from. A successful sign-in clears the count, stale counts are deleted automatically, and deleting your account clears the one held against your email address.

If you turn measurement on, behaviour records would be kept for 12 months and any session recording for 30 days. A phone number, if the app asks for one and you give it, is kept no longer than the purpose stated at that point requires, and is deleted sooner if you ask.

Security

All traffic is encrypted in transit (HTTPS). Your session token lives in an httpOnly cookie, is never exposed to page scripts, and expires after 30 days.

No method of storage is perfectly secure, but the product is designed so your browser never handles your credentials directly.

Your rights

You can view and edit your profile, manage your watchlist and alert rules, change your notification settings, and delete your account yourself in Settings, under Account.

You may request access to, correction of, or deletion of your personal data at any time through support; we respond as required by applicable law.

Children

S7 Markets is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us through Settings, then Support, and we will delete it.

Changes to this policy

We may update this policy as the product evolves. The date above reflects the latest revision.

For meaningful changes we will give notice in the app before the new policy takes effect.

Contact

For any question about this policy or your personal data, contact us through the app: open Settings, then Support.

Data controller: Septentrio, the operator of S7 Markets.