Privacy policy

1. At a glance

ShareMarkets is a non-commercial information service: no advertising, no sale of data, no third-party tracking, no profiling. We process as little personal data as possible and keep it only as long as the respective purpose requires.

This statement fully describes which data arise when you visit, when you use the site without an account and with an account, what they are needed for, on which legal basis, how long they are stored and which rights you have.

2. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is the operator of ShareMarkets. For all data-protection requests you can reach us via the e-mail address given in the legal notice.

3. Hosting, server logs and security

The site runs on our own server. When you open a page, your browser necessarily transmits your IP address, the requested address, time, browser identifier (user agent) and, where applicable, the referring page.

We keep no permanent access logs containing IP addresses. The IP address is only used transiently in memory for protective mechanisms: limiting requests per address (rate limiting; counters expire within one hour at most), protection against abuse of login/registration and against guessing access codes. For the operator’s admin access, failed login attempts are counted for 15 minutes using an irreversible hash of the IP address (SHA-256).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation). Security measures: encrypted transport (HTTPS, HSTS), Content Security Policy, protection against embedding in third-party pages, passwords stored exclusively as scrypt hashes, no plaintext passwords, uploaded images checked for their actual file type.

4. Cookies

We only set technically necessary cookies and one language-preference cookie. There are no advertising, analytics or third-party cookies. Under § 25(2) TDDDG (German digital services data protection act) no consent is required for these, which is why we show no cookie banner.

• sm-session — login session (accounts only). Random token, httpOnly, SameSite=Lax, 90 days from last use (extended on use). Deleted on logout or password change.
• sm-visitor — anonymous visitor ID, set only if you create a portfolio without an account so that you can keep editing it. Random value, no link to your identity.
• sm-lang — chosen language (de/en/zh).
• sm-seen — remembers that you have already seen the landing screen so it is not shown again.
• sm-admin — operator only: separate admin session, 12 hours, bound to account, IP hash and browser hash.

5. Local storage in your browser

For convenience features the site stores settings in your browser’s local storage. These data do not leave your device (exception: when you log in, news terms and map trackers created in the browser are transferred once into your account). You can delete them at any time via your browser settings.

• Theme (light/dark), map panel collapsed/expanded, chart legend and sidebar.
• Alert settings (which notification types are active), watched news terms, timestamps of last seen stories.
• Map trackers (area and event types) and their last seen state — without an account; with an account they are stored with the account.
• Chart drawings, layouts and templates if you use the chart without an account.
• A portfolio draft cached during registration (session storage, expires with the tab).

6. Account and content

An account is optional and only needed for your own portfolios, watchlists, alerts, trackers, notes and chart settings. We require neither an e-mail address nor a real name: a freely chosen username and a password (at least 10 characters) are enough. Purpose: performance of the contract (Art. 6(1)(b) GDPR).

Stored: username, password hash (scrypt), registration time, time of last use (rounded to 10 minutes), optionally a profile picture, your portfolios with positions, categories, notes, forecasts, access codes and visibility settings, watchlists, price alerts, news terms, map trackers, chart drawings/layouts/templates, self-written indicators as well as folders and notes.

Visibility: portfolios are private by default. Only what you explicitly share as “public”, “by link” or “by code” is visible to others — then including your username and profile picture. Public indicators appear in the library with your username.

Deletion: you can delete portfolios, positions, alerts, trackers, notes, indicators and the profile picture yourself at any time. Complete deletion of the account with all content is carried out without delay upon your message to the e-mail address given in the legal notice; there is no retention period beyond that. Blocked accounts are kept only as long as necessary to prevent abuse.

7. Visitor counting without tracking

We count unique visitors per day using a pseudonymous daily hash: a truncated SHA-256 hash is built from the date, IP address and browser identifier; it is valid only for that day and cannot be traced back to you; the IP address itself is not stored. In addition we count page views per path and day, and how often which securities are opened — as plain totals without personal reference. Known bots are excluded. No third-party analytics services are used. Legal basis: Art. 6(1)(f) GDPR (interest in reach measurement with minimal intrusion).

8. Notifications

Price, news and tracker notifications are generated exclusively in your browser (Notification API) after you have granted the browser permission. There is no push service, no transfer to third parties and no notification by e-mail or SMS. For this the browser polls our own API once a minute in the background while a tab is open.

9. External services your browser loads directly

For the following content your browser connects directly to third-party servers; this necessarily transmits your IP address to the respective provider. We have limited these connections to what is necessary via Content Security Policy and use them because operation without them would be impossible or disproportionately costly (Art. 6(1)(f) GDPR). Where providers are located in the USA, the transfer relies on the EU-US Data Privacy Framework or the providers’ standard contractual clauses.

• Map tiles of the live map: Esri / ArcGIS Online (server.arcgisonline.com), data by Esri, HERE, Garmin and OpenStreetMap contributors.
• Python runtime for your own chart indicators: Pyodide via jsDelivr (cdn.jsdelivr.net) — loaded only when you run a Python indicator.
• Flags on the map: flagcdn.com.
• Company and coin logos: icon.horse, DuckDuckGo icons, Parqet assets and the image CDNs of Binance and OKX for crypto symbols.
• The Inter typeface is served from our own server; there is no connection to Google Fonts.

10. Data sources queried by our server

Prices, news and map data are fetched by our server itself; no data about you is transmitted in the process. Publishers and data providers remain the authors of their content; we show headlines and very short teasers (at most 100 characters) with attribution, without images, and link to the original. Sources (as of the date above): Yahoo Finance (prices, delayed), CoinGecko and CoinPaprika (crypto), 33 newsrooms via RSS, 27 OSINT sources (public Telegram channels via the web view, specialist RSS), GDELT (events), NASA FIRMS (thermal hotspots), USGS and GDACS (natural hazards), OpenSky Network and adsb.lol (aircraft), adsbdb (flight routes), AISStream (ships), USNI (fleet tracker), OFAC sanctions list, tak-shadowfleet (shadow fleet), ubilling.net.ua, neptun.in.ua and tzevaadom.co.il (air/rocket alerts).

Translations: news texts and our own research texts (no user data) are sent to translation services (Google Translate; optionally DeepL or Anthropic if configured by the operator). Translated texts are marked as such.

Your own chart indicators (JavaScript, a Pine subset, Python) run exclusively locally in your browser in a sandbox without network access. Code is only stored if you explicitly save it.

11. Operator admin access

For maintenance and to prevent abuse the operator can view accounts, portfolios and usage statistics, block and delete accounts. Each of these actions is logged with a timestamp (audit). This access is protected by a second login and invisible to everyone else.

12. Legal bases and retention

• Account and content: Art. 6(1)(b) GDPR — until deleted by you or at your request.
• Security, rate limits, abuse prevention: Art. 6(1)(f) GDPR — transient in memory, at most one hour; admin login attempts 15 minutes; operator audit entries permanent but without a plaintext IP address.
• Visitor counting: Art. 6(1)(f) GDPR — daily hashes kept permanently as plain counts, not traceable.
• Cookies and local storage: § 25(2) TDDDG (technically necessary) — lifetimes as stated above.
• Browser notifications: your permission granted in the browser, revocable there at any time.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Please contact the address given in the legal notice; we respond without undue delay and at the latest within one month. Since we store no e-mail address, please identify yourself by logging into your account or by a message sent from there.

You also have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence. The authority responsible for the controller is the data-protection authority at its seat in Germany.

14. Further notes

• No automated decision-making, no profiling, no transfer or sale of data to third parties. Data are disclosed only where we are legally obliged to do so.
• The service is not directed at children under 16.
• Exchange prices are shown with a delay of at least 15 to 20 minutes depending on the exchange (crypto and FX live). All content is for information only and does not constitute investment advice.
• This statement is updated whenever the processing changes. The version published here applies; the date is shown at the top.