Privacy Policy

Last updated: July 5, 2026

Open Market Terminal ("we", "the service") is a market research and education tool. This policy explains what we collect, why, and what stays on your device.

1. What we collect

• Account data — email address, display name, and (for email accounts) a salted PBKDF2-SHA256 password hash. We never store plaintext passwords.
• Sign-in identity — if you sign in with Google or GitHub, we receive only your verified email address and display name from that provider. We do not receive or store their passwords or tokens beyond the sign-in exchange.
• Workspace preferences — watchlist symbols, panel layout, theme, language, and accent color, synced to your account so they follow you across devices.
• Support & feedback messages — messages you send through the in-app support widget, kept so we can follow up.
• Technical data — your IP address is used in memory for rate limiting and abuse prevention; server logs record requests for operations. A single HttpOnly session cookie keeps you signed in. We use no advertising or tracking cookies and no third-party analytics.

2. What stays on your device

• Custom AI modules — modules you build are stored only in your browser's localStorage and run sandboxed in your browser. Their code is never uploaded to or stored on our servers.
• Your own API keys — if you add a personal OpenRouter key, it is kept in your browser. It is transmitted with each AI request so we can proxy the call, but it is never written to our database or logs.
• Guest settings (theme, language, watchlist before signing in) also live only in your browser.

3. Third-party processors

• OpenRouter — AI features send the market-data snapshot and your request text to OpenRouter (and through it, the model providers) to generate a response.
• Stripe — paid subscriptions are processed by Stripe Checkout. Card details never touch our servers.
• Google / GitHub — optional sign-in, as described above.
• Market data providers — price and news requests are made server-side; your identity is not attached to them.

4. Retention & deletion

Account data is kept while your account exists. To delete your account and its data, contact us through the in-app support widget and we will remove it within 30 days. Backups roll off automatically on a short cycle.

5. Security

All traffic is served over HTTPS. Passwords are salted and hashed (PBKDF2-SHA256), session cookies are HttpOnly and Secure, and admin access is restricted. No system is perfectly secure; use a unique password.

6. Children

The service is not directed to anyone under 18 and we do not knowingly collect data from minors.

7. Changes

We may update this policy; material changes will be reflected by the date above. Continued use after a change means you accept the updated policy.

8. Contact

Questions or requests: use the in-app support widget (bottom-right of the terminal).

隐私政策

更新日期：2026 年 7 月 5 日

Open Market Terminal（"我们"、"本服务"）是一个市场研究与学习工具。本政策说明我们收集什么、为什么收集，以及哪些数据只保留在你的设备上。

1. 我们收集什么

• 账户数据——邮箱、显示名称，以及（邮箱注册时）加盐的 PBKDF2-SHA256 密码哈希。我们从不存储明文密码。
• 第三方登录身份——使用 Google 或 GitHub 登录时，我们仅从对方获取你已验证的邮箱和显示名称，不会获取或存储其密码或登录令牌。
• 工作区偏好——自选列表、面板布局、主题、语言与配色，随账户同步以便跨设备使用。
• 客服与反馈消息——你通过站内客服组件发送的消息，保留用于跟进。
• 技术数据——IP 地址仅在内存中用于限流与防滥用；服务器日志记录请求用于运维。一枚 HttpOnly 会话 Cookie 用于保持登录。我们不使用任何广告或跟踪 Cookie，也不接入第三方统计。

2. 哪些数据只在你的设备上

• 自定义 AI 模块——你生成的模块只存储在浏览器 localStorage 中，并在浏览器沙箱内运行，其代码不会上传或存储到我们的服务器。
• 你自己的 API key——如果你填入个人 OpenRouter key，它保存在你的浏览器里；每次 AI 请求会随请求发送用于代理调用，但不会写入我们的数据库或日志。
• 游客状态下的设置（主题、语言、自选）同样只保存在浏览器本地。

3. 第三方处理方

• OpenRouter——AI 功能会把行情快照与你的请求文本发送给 OpenRouter（及其对接的模型提供方）以生成结果。
• Stripe——付费订阅由 Stripe Checkout 处理，银行卡信息不经过我们的服务器。
• Google / GitHub——可选登录方式，见上文。
• 行情数据源——行情与新闻请求由服务端发起，不附带你的身份信息。

4. 保留与删除

账户数据在账户存续期间保留。如需删除账户及数据，请通过站内客服组件联系我们，我们将在 30 天内删除；备份会在短周期内自动滚动清除。

5. 安全

全站 HTTPS；密码加盐哈希（PBKDF2-SHA256）；会话 Cookie 为 HttpOnly 且 Secure；管理员权限受限。没有绝对安全的系统，请使用独立密码。

6. 未成年人

本服务不面向 18 岁以下人士，我们不会有意收集未成年人数据。

7. 变更

我们可能更新本政策，重大变更以顶部日期为准。变更后继续使用即视为接受更新后的政策。

8. 联系

如有问题或请求，请使用终端右下角的站内客服组件联系我们。