Legal

Privacy Policy

Last updated: October 29, 2026

The privacy of your data, and it is your data, not ours, is a big deal to us. This policy explains what we collect, why we collect it, who we share it with and what you can do about it. We try to keep it short and honest. If something is unclear, email [email protected].

When we say “Moolish”, “we”, “our” or “us”, we mean the operator of the Moolish service. When we say “Services”, we mean the moolish.com website, the Moolish web application, the alerts we send and everything else we run for you. This policy applies to the Services and to every brand we operate on the same platform.

1. What we collect and why

Our guiding principle is to collect only what we need to run the Services. Here is everything.

Identity and access

When you sign up we ask for an email address and a password, or you can sign in with Google. With Google sign-in we receive the email address, name, profile picture and Google account identifier that Google shares with us; we never see your Google password. We store your password only as a salted hash. We use this information to create your account, let you log in, verify your email, reset your password, send you service messages (for example a verification link, an alert you configured, or a notice that something changed) and to protect your account from abuse. We will never sell your personal information to third parties, and we will not use your name, email or company in marketing statements without your permission.

Accounts whose email is never verified are deleted automatically after a short period.

Alert delivery details

To deliver alerts you may give us a Telegram bot token and a chat or channel identifier. If you send webhooks into Moolish (for example TradingView alerts), we store the webhook address we issued to you and the payloads you send, because they become events in your account. We use these only to send the alerts you configure. Anything you paste into a webhook secret or header is stored so we can send it with each alert; treat it as sensitive and rotate it if you think it has leaked.

Your product content

The things you build in Moolish, such as event chains, candle definitions, presets, watchlists, chart drawings and layouts, and the methods you subscribe to, are stored so the Services can work. They are yours. We access them only to run the Services, to fix a problem you ask us to look at, or as described in section 2. Your workspace is private; it is not shown to other users or to search engines.

Billing information

Every new account gets one 7-day free trial when it signs up; it does not require a credit card. Paid plans carry no trial and are charged when you buy them. If and when you move to a paid plan, payment details are handled by a payment processor and we store only what we need to manage your subscription and comply with tax and accounting law (for example the plan you chose, invoice history and the country used for tax purposes). We never store full card numbers.

Product interactions and logs

Like almost every online service, our servers record technical information about each request: your IP address, browser and device type, the pages or API calls you made, timestamps and error details. We use these logs to keep the Services running, to debug problems, to detect abuse and to enforce rate limits and fair use. Logs are kept for a limited period and are not used to build advertising profiles.

Website analytics

Inside the app we use a privacy-focused analytics tool (Plausible) that counts page views and aggregate usage without cookies and without tracking you across sites. It does not collect personal identifiers. Our marketing website at moolish.com currently runs no analytics or advertising scripts at all.

Cookies and local storage

We use browser storage (cookies or local storage) to keep you signed in and to remember your preferences such as chart settings, layout and theme. If you open a link that carries a discount code or an affiliate referral code, that code is kept in your browser for 30 days. If you are signed in, the referral code may also be stored on your account so that a later purchase is credited to the referrer, and at checkout the referrer’s Whop username is passed to Whop. We do not use third-party advertising cookies and we do not run retargeting pixels.

Voluntary correspondence

When you email us, report a bug, answer a survey or talk to us in a community channel, we keep that correspondence so we can help you and refer back to it later.

Market data is not personal data

Prices, candles and other market data that flow through Moolish come from exchanges and data providers and contain nothing about you. See our Disclaimer for what that data is and is not.

2. When we share your information

We do not sell or rent your personal information, and we do not share it with anyone except in the situations below.

• To deliver alerts you configured. Sending a Telegram alert means sending the message to Telegram through the bot token you connected. Each of those services receives only what is needed to deliver that message.
• To run the Services. We use a small number of third-party providers to host our infrastructure, deliver email (currently Resend), protect against attacks and serve traffic (currently Cloudflare), and sign you in with Google when you choose to. These providers process data on our behalf, under contracts that restrict what they may do with it.
• To help you when you ask. If you ask us to investigate a problem, a member of our team may look at your account and content to the extent needed to help.
• To investigate abuse. If we believe an account is being used to break our Terms or the law, to attack the Services or to harm other users, we may inspect the relevant data and, where appropriate, share it with the affected parties or authorities.
• When the law requires it. We may disclose information if we receive a lawful court order, subpoena or equivalent request from a competent authority. Where we are permitted to, we will tell you first so you can challenge it. We will push back on requests we think are overly broad.
• If Moolish changes hands. If we are acquired or merge with another company, your data would move with the Services. We would notify you before any new policy applies to you.

3. Your rights

Wherever you live, you have these rights over the personal data we hold about you, and we honour them for everyone, not only where the law requires it:

• Access. You can ask what personal data we hold about you.
• Correction. You can update your email, name and alert settings in the app, or ask us to correct anything else.
• Export. You can ask for a copy of your data in a machine-readable form.
• Deletion. You can delete your account from the app or by emailing us. When you do, we delete your account and content as described in section 5.
• Objection and restriction. You can ask us to stop or limit a particular use of your data.
• Withdrawal of consent. Where we rely on your consent, you can withdraw it at any time.
• Complaint. If you are in the European Economic Area, the United Kingdom or another jurisdiction with a data-protection authority, you have the right to complain to it. We would appreciate the chance to address your concern first.

To exercise any of these rights, email [email protected] from the address on your account. We may ask you to confirm your identity before acting. We will respond within 30 days, and we will never discriminate against you for exercising a right.

For people in the EEA and UK. We process your data because it is necessary to provide the Services you signed up for (performance of a contract), because we have a legitimate interest in keeping the Services secure, reliable and improving, because you consented (for example, when you connect Telegram), or because the law requires it. We do not make automated decisions about you that have legal or similarly significant effects.

For California residents. We do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of. The categories we collect are listed in section 1 and the purposes in sections 1 and 2.

4. How we secure your data

All data is encrypted in transit between you and the Services using TLS. Passwords are stored only as salted hashes. Access to production systems is restricted to the people who need it to operate the Services, and administrative access is protected by strong authentication. We keep backups so we can recover from failures. No system is perfectly secure, so if we learn of a breach that affects your personal data we will tell you and, where required, the relevant authority, without undue delay.

5. How long we keep it

• Your account and content are kept for as long as your account exists. When you delete your account, your personal data and content are removed from our live systems promptly and from backups within 30 days.
• Unverified accounts are deleted automatically if the email address is not verified within a short period after sign-up.
• Server logs are retained for a limited period, typically no longer than 90 days, unless we need a specific record longer to investigate abuse or comply with the law.
• Billing records are kept for as long as tax and accounting law requires.

6. Where your data lives

Our infrastructure is hosted with third-party providers. Your data may be stored and processed in countries other than the one you live in, and those countries may have different data-protection laws. When we transfer personal data out of the EEA or UK, we rely on the receiving country’s adequacy decision where one exists, or on standard contractual clauses approved by the European Commission or the UK, together with the security measures in section 4.

7. Children

The Services are not directed at, and may not be used by, anyone under 18. We do not knowingly collect personal data from children. If you believe a child has created an account, email us and we will delete it.

8. Changes and questions

We may update this policy as the Services change or the law requires. The date at the top tells you when it last changed; for significant changes we will also notify you by email or in the app before they take effect. Earlier versions are available on request.

Questions, requests or concerns: [email protected].

Parts of this policy are adapted from the 37signals policies, used under CC BY 4.0.