Privacy Policy

Last updated 24 August 2026

What OI Trader stores about you, why, who else can see it, and how to have it removed.

OI Trader (oitrader.in) is operated by Ranjit Randive, an individual, referred to below as "we" or "us". This policy explains what personal data the service handles and on what terms. It applies to the website and to the OI Trader Android app, which are one service sharing one account.

In short. We collect what an account needs to work: who you are, how you signed in, the broker credentials you choose to connect, and the trading data the service produces for you. We do not sell it, we do not advertise, and we run no analytics or tracking. Access to your Zerodha account exists only because you connected it, and you can disconnect it at any time.

1. What we collect

Account and identity

Your name and email address, given at sign-up or when an administrator invites you.
Your password, stored only as a bcrypt hash. We cannot read it, and neither can an administrator.
Your account status and role (pending, active or suspended; user or administrator), and who approved the account and when.

Sign-in and devices

One-time codes sent to your email for two-factor authentication, and when they were last verified. Codes are short-lived and are cleared once used or expired.
Web session records, each holding your IP address, your browser's user-agent string, and the time it was last active. These are what let you see and sign out your own devices.
App session tokens, one per phone you sign in on, labelled with the device name.
Push notification tokens issued by Google for your device, if you allow notifications, plus a record of notifications sent to you.
Your last sign-in time.

Broker connection (Zerodha Kite)

Only if you choose to connect a broker account:

Your Kite API key and API secret, and the access, public and refresh tokens Zerodha issues when you log in through them.
Your Kite user ID and the account name Zerodha reports back.
A postback token used to recognise order updates Zerodha sends us.

These credentials let the service read market data and, only if you separately arm live trading, place orders on your behalf. We never see your Zerodha password: you enter it on Zerodha's own login page, and we only ever receive the tokens it hands back.

Trading and usage data

Paper trades the strategy engine records for you, including entries, exits and simulated P&L.
Strategy configurations — which strategies you deploy, in what mode, and their risk limits.
Live order records for orders actually placed at your broker, if you enable live trading.
Backtest runs you request and their results.
Engine decision logs recording why a strategy did or did not act on a given cycle.

What we do not collect

We run no analytics, advertising or tracking of any kind, and set no cookies beyond the one session cookie that keeps you signed in. We do not collect your location, contacts, files or anything else from your device. We do not ask for and do not store your PAN, bank details, Aadhaar, or any other identity document.

2. Why we hold it

Data	Purpose
Name, email, password	To create your account, sign you in, and contact you about it.
Two-factor codes	To verify it is you signing in.
Session and token records	To keep you signed in, and to let you and an administrator see and revoke active sessions.
Kite credentials	To fetch market data for your account and, if armed, to place the orders you have configured.
Trading and strategy data	To run the service, show your history and reports, and let you audit what the engine did.
Push tokens	To send the alerts you have opted into.
IP address and user agent	Security: recognising sessions, rate-limiting, and investigating abuse.

Under India's Digital Personal Data Protection Act, 2023, we rely on your consent, given when you create an account and again when you connect a broker or enable notifications, and on the necessity of processing to provide the service you have asked for.

3. Who else sees it

We do not sell, rent or trade personal data, and we share it only with the parties needed to run the service:

Zerodha Broking Ltd. (Kite Connect) — your broker. Requests we make on your behalf carry your tokens. Your relationship with Zerodha is governed by their own terms and privacy policy.
Google (Firebase Cloud Messaging) — delivers push notifications to your device. Google receives the device token and the notification content.
Our email provider — delivers sign-in codes, invitations and alerts, and therefore handles your email address and the message body.
Our hosting provider — operates the virtual server the application and its database run on.

Administrators of this deployment can see your account details, active sessions, open positions and trade history, and can suspend or delete your account. This is an operational necessity of a hosted, approval-gated service; it is not a marketing function.

We may also disclose data where the law requires it, or to protect the service or its users from abuse or harm.

A note on assets loaded from other domains

Our pages load a stylesheet and fonts from Google Fonts and a script from the Tailwind CDN. Your browser contacts those services directly when a page loads, so they can see your IP address. We send them nothing about you and receive nothing back.

4. Where it lives, and for how long

Data is stored on a virtual server rented from a cloud hosting provider, in a database that is not reachable from the public internet. We keep it for as long as your account exists.

Two-factor codes — minutes; cleared on use or expiry.
Web sessions — treated as inactive after two hours; removed when you or an administrator signs the device out, or when the record is cleaned up.
Broker tokens — until you disconnect the broker, or the token expires (Zerodha access tokens expire daily), whichever is first.
Push tokens — until the device unregisters or the token stops working, after which it is deleted automatically.
Trading, strategy and log data — for as long as the account exists, so your history stays intact. Engine decision logs are pruned on a rolling basis.

When an account is deleted, its personal data and trading records are deleted with it. Backups, if any exist at that moment, age out on their own cycle.

5. How it is protected

All traffic is served over HTTPS.
Passwords are stored as bcrypt hashes, never in a readable form.
Signing in requires a one-time code sent to your email in addition to your password.
Live trading is disarmed by default and must be deliberately enabled per account.
The Android app forbids OS-level backups, so its stored token cannot be lifted out of app storage by a device backup.
You and an administrator can revoke any session or device at any time.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the Data Protection Board of India as the law requires.

6. Your rights

Under the Digital Personal Data Protection Act, 2023, you may:

Access a summary of the personal data we hold about you and what we do with it.
Correct anything inaccurate, incomplete or out of date.
Erase your data, by asking us to delete your account.
Withdraw consent — disconnect your broker, turn off notifications, or close the account entirely.
Nominate another person to exercise these rights if you die or become incapacitated.
Complain to the Data Protection Board of India if we have not resolved your grievance.

Some of these you can do yourself from the Profile and Settings pages. For anything else, write to us at the address below and we will respond within a reasonable period.

7. Children

The service is not intended for anyone under 18, and trading in Indian markets requires you to be an adult with your own broker account. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will remove it.

8. Changes

If this policy changes materially we will update the date at the top and, where the change affects how your data is used, tell you by email or in the app. Continuing to use the service after a change means you accept the updated policy.

9. Contact and grievances

For any privacy question, request or complaint — including anything you would raise with a grievance officer — write to support@oitrader.in. Please say which account you are writing about.