1. Who controls your data
TickRun was created and is operated by Joel Suosaari, an individual who acts as the controller of personal data processed through the service.
- Creator, operator, and controller
- Joel Suosaari
- Country or region
- Finland
- Privacy email
- Jsuosaari@gmail.com
2. Scope
This policy applies to the TickRun website, browser backtester, accounts, saved backtests, and messages sent through official contact channels. It does not apply to independent websites linked from TickRun.
3. Data TickRun processes
Website and security data
The web server or reverse proxy may process IP address, request date and time, requested path, response status, user agent, and diagnostic or security information. TickRun also temporarily uses IP address and normalized account identifiers to limit repeated registration and login attempts.
Account data
When you create an account, TickRun stores your email address, verification status, a salted scrypt password hash, and account-creation time. TickRun does not store your readable password.
Email verification and password-reset links use random, single-use tokens. The database stores only SHA-256 token digests, their purpose, and creation and expiry times—not the readable token sent in the link. Verification links expire after 24 hours and password-reset links after 30 minutes. Resetting or changing a password revokes existing sessions.
Session data
When you sign in, TickRun creates a random session token. The browser receives it in an essential HttpOnly, SameSite=Strict cookie; the server stores only a SHA-256 digest of the token, a CSRF token, and creation and expiry times. Sessions are configured to expire after 30 days and can be revoked on sign-out.
Saved backtests
If you choose to save a result, TickRun stores its name, ticker, strategy, tested dates, configuration, summary metrics, completed trades, and creation time. It does not store the complete daily price or equity frame with each result.
Market calculations in your browser
Indicators, backtests, metrics, comparisons, optimization, and charts run locally in your browser. The selected ticker’s saved price history is transmitted from the TickRun server to your browser on request. These calculations do not require browser local storage or session storage.
Optional Google Analytics
If you accept analytics, TickRun uses Google Analytics 4 to measure page views and basic website interactions. Google may process online identifiers, cookie identifiers, IP-derived approximate location, browser and device information, referring pages, requested pages, and event times. TickRun does not deliberately send account email addresses, saved-backtest contents, or entered strategy parameters to Google Analytics.
Analytics is disabled by default and its Google script is not requested until you select Accept analytics. It also remains disabled during local development. You can reject analytics or later change your selection using the Analytics choices control. See Google’s Privacy Policy.
Contact messages
When you contact TickRun by email, TickRun and its mailbox provider, Google Gmail, process the information you send, such as your email address, message, attachments, and relevant support history.
4. Cloudflare Turnstile
Registration uses Cloudflare Turnstile to distinguish legitimate visitors from automated abuse. The Turnstile widget runs in the browser and produces a short-lived token. TickRun sends that token and the registering IP address to Cloudflare’s Siteverify service for validation. Cloudflare may process browser, device, network, and challenge information under its own terms and privacy documentation.
See Cloudflare’s Privacy Policy and Data Processing Addendum.
5. Why data is processed
TickRun processes data to provide accounts and saved results, authenticate users, protect the service from abuse, respond to requests, diagnose failures, maintain security, comply with legal obligations, improve reliability, and—only with consent—understand website usage.
Account, authentication, and saved-result data are processed to provide the service requested by the user. Security, rate limiting, diagnostics, and reliability work are based on legitimate interests in protecting and operating TickRun. Optional Google Analytics processing is based on consent. Data may also be processed to comply with legal obligations.
6. Service providers and disclosures
Personal data may be processed by infrastructure and security providers strictly as needed to operate TickRun:
- Namecheap provides VPS hosting in the United States.
- Cloudflare Turnstile provides registration bot protection.
- Google Analytics provides consent-based website audience measurement.
- Google Gmail provides the public contact mailbox.
- Resend provides transactional verification and password-reset email in production.
TickRun may also disclose information when reasonably necessary to comply with law, protect users or the service, investigate abuse, or establish and defend legal claims. TickRun does not currently sell personal data or use it for behavioral advertising.
7. International transfers
Namecheap hosts the production VPS in the United States. Cloudflare, Google, and Resend may also process data outside Finland. Where applicable law requires transfer safeguards, TickRun relies on the relevant provider terms, data-processing arrangements, and legally recognized transfer mechanisms.
8. Retention
- Session records expire after 30 days, although expired records may remain until routine cleanup.
- Account information and saved results are retained until the user deletes the account. Self-service deletion permanently removes the account, active sessions, and all saved backtests from the active database.
- Authentication rate-limit entries are held temporarily in memory and disappear when the server restarts or the moving window expires.
- Unused verification links expire after 24 hours; unused password-reset links expire after 30 minutes.
- Server logs are retained for 30 days unless a specific security incident or legal obligation requires longer retention.
- Support messages are retained for 12 months after the latest message unless they are needed longer to handle a request, protect the service, or meet a legal obligation.
- The analytics-consent preference and Google Analytics cookies are configured to expire after no more than 12 months. User-level Analytics event data is configured for a 14-month retention period; aggregated reporting may remain available longer.
9. Your choices and rights
Depending on applicable law, you may have rights to access, correct, delete, restrict, or object to processing; receive a portable copy; withdraw consent; and complain to a supervisory authority. Exercise applicable rights through Jsuosaari@gmail.com. TickRun may need to verify the request before acting.
10. Cookies
TickRun uses the essential authentication cookie described above and a first-party preference cookie that remembers whether you accepted or rejected optional analytics. If you accept, Google Analytics may set first-party cookies such as _ga and a property-specific _ga_* cookie. TickRun does not use advertising cookies or enable Google Signals or advertising-personalization signals.
Rejecting analytics prevents the Google Analytics script from loading. Withdrawing previously granted consent disables further Analytics collection in the page and attempts to remove its accessible first-party cookies. Withdrawal does not retroactively erase measurements already transmitted; contact TickRun to exercise applicable data rights.
11. Security
TickRun uses password hashing, opaque sessions, CSRF protection, same-origin checks, rate limiting, access controls, security headers, and restricted database permissions. No system is completely secure. Report suspected vulnerabilities privately to Jsuosaari@gmail.com.
12. Policy changes
Material changes will be reflected by updating the effective date and, where legally required, providing additional notice. Previous versions should be retained or summarized when practical.
13. Contact
Privacy questions and requests: Jsuosaari@gmail.com.