Privacy Policy

Who we are

Meror, Toronto, Ontario, Canada, operates Meror and is the organisation accountable for your personal information. Privacy questions: the contact address shown on the site.

What we collect

Account information: your email address, display name and a one-way hash of your password (never the password itself); if you sign in with Google or GitHub, the identifier and email those providers return. Optional two-factor secrets, encrypted.

Service information: the traders you follow or copy, your allocations, limits and simulated portfolio; your theme and preferences; notifications we sent you.

Venue connections: when you connect a brokerage or exchange, the tokens or API credentials that venue issues, encrypted at rest with AES-256-GCM. We never ask for or store your venue username or password. Account balances and positions the venue reports are stored to run your copies.

Billing: your Stripe customer identifier and subscription status. Card numbers are entered on Stripe's pages and are never sent to or stored by us.

Security and legal records: network address, browser identifier and timestamps for sign-ins, acceptances of these documents and signed authorizations; an audit log of security-relevant actions.

Messages you send us: your name, email address, subject and message from the contact form, kept so we can answer you.

Technical: server logs with request paths and timings, kept briefly for reliability. We use no advertising trackers.

Why we use it

To provide the service you asked for (accounts, copies, notifications, billing); to keep it secure and detect abuse; to meet legal obligations, including keeping records of authorizations you gave for orders placed in your account; and to improve the service using aggregate, de-identified usage.

Who we share it with

Service providers acting for us: Stripe (payments), the hosting provider, and email delivery. Venues you connect (for example through SnapTrade, Kalshi or a brokerage) receive the instructions needed to run your copies; the aggregator receives what it needs to link your account. Sign-in providers (Google, GitHub) receive only the sign-in request. We disclose information when the law requires it or to protect rights and safety.

We do not sell personal information, and we do not share it for advertising.

Public trader data

The traders shown on the service are drawn from public regulatory filings, public on-chain records and venue leaderboards; that information is public by the nature of those sources. If you choose to publish your own trading through a connected account, that is opt-in, is labelled as yours, and can be revoked from your profile at any time; after revocation your record is no longer shown.

Retention

Account data is kept while your account is open and deleted or de-identified within 90 days of closure, except records we must keep: acceptances, signed authorizations, orders placed in your account, billing records and the audit log, which are kept for the period the law requires (typically up to seven years).

Security

Passwords are hashed with a slow hash and never stored; venue credentials are encrypted at rest; connections use TLS; access to production data is restricted and logged. No system is perfectly secure; if a breach affects you we will tell you as the law requires.

Your rights

You can see and correct your account information from your profile. You can ask us for access to, correction of, or deletion of your personal information, or withdraw consent, by writing to the contact address shown on the site; we respond within 30 days. If you are not satisfied you may complain to the Office of the Privacy Commissioner of Canada. If you are outside Canada your local law may give you additional rights, which we honour where they apply.

Analytics

Where analytics is enabled, we use Google Analytics 4 to count visits and see which pages are used. It loads only after you allow it in the cookie notice; if you decline, nothing is loaded. IP addresses are anonymised and the browser Do Not Track signal is honoured. You can change your choice at any time from "Cookie settings" in the footer.

Cookies and local storage

We use browser local storage to keep you signed in and to remember your theme. We set no advertising cookies. Stripe sets cookies on its own checkout pages under its own policy. If you allow analytics, Google Analytics sets cookies (for example _ga) on this site; declining keeps them off.

Where data is stored

Data is stored where the service is hosted and may be processed by providers outside Canada (for example Stripe in the United States), where it is subject to local law.

Children

The service is for adults. We do not knowingly collect information from anyone under 18; if you believe we have, contact the contact address shown on the site and we will delete it.

Changes

Material changes to this policy are announced in the service and require your acceptance. The version at the top identifies what you accepted.