Privacy Policy

Who we are

Krishan Thushyanthan, carrying on business as Meror (Ontario BIN 1001742979), of 303 Bristol Rd W, Mississauga, Ontario L5R 2H1, Canada, operates Meror and is accountable for your personal information. Privacy questions, and any request to see, correct or delete what we hold: support@meror.ca.

Meror is a business name registered in Ontario under the Business Names Act, BIN 1001742979, held by Krishan Thushyanthan as sole proprietor. It is not a corporation. Registering a business name registers the name and nothing else: it is not a securities registration, a licence, or approval of anything on this site by any government or regulator.

What we collect

Account information: your email address, display name and a one-way hash of your password (never the password itself); if you sign in with Google or GitHub, the identifier and email those providers return. Optional two-factor secrets, encrypted.

Service information: the traders you follow or copy, your allocations, limits and simulated portfolio; your theme and preferences; notifications we sent you.

Venue connections: when you connect a brokerage or exchange, the tokens or API credentials that venue issues, encrypted at rest with AES-256-GCM. We never ask for or store your venue username or password. Account balances and positions the venue reports are stored to run your copies. We also store the name of each account the venue shares with us and its full account number (with its last four digits, which is what we show you), so that you can tell your accounts apart and so that one brokerage account can be connected to only one Meror account.

Billing: your Stripe customer identifier and subscription status. Card numbers are entered on Stripe's pages and are never sent to or stored by us.

Subscriptions bought in the iPhone app: Apple is the payment processor for in-app purchases. From Apple we receive the transaction identifier, the product bought, the purchase, renewal and end dates, whether it will renew, and the country of your App Store, never your card details. So that a purchase can be matched to your account, the app gives Apple a random identifier we create for your account; it says nothing else about you.

Security and legal records: network address, browser identifier and timestamps for sign-ins, acceptances of these documents and signed authorizations; an audit log of security-relevant actions.

Messages you send us: your name, email address, subject and message from the contact form, kept so we can answer you. A copy is also posted into a private staff channel on our Discord server and emailed to our own inbox, so a message is not missed; the Discord channel is not visible to other members.

Technical: server logs with request paths and timings, kept briefly for reliability. Advertising measurement runs only if you allow it in the cookie notice. Your answer to that notice is kept both in your browser and on your account, because some of the measurement is sent by our server rather than by your browser and has to be able to read it. Analytics and advertising below says exactly what is sent and to whom.

iPhone app diagnostics: the iPhone app sends meror.ca the anonymous crash and performance reports that Apple's MetricKit prepares on your iPhone, with the app's version, so we can find and fix bugs. They contain no name, email address or trading information.

Why we use it

To provide the service you asked for (accounts, copies, notifications, billing); to keep it secure and detect abuse; to meet legal obligations, including keeping records of authorizations you gave for orders placed in your account; and to improve the service using aggregate, de-identified usage.

Product emails: if your account stays on paper, we use your email address and name to send you up to three emails about copying with real money, starting a day after you sign up and about a week apart. Each one has an unsubscribe link that works in one click without signing in, and your mail app may show its own unsubscribe button for the same link. Unsubscribing stops product emails only. Emails about your own account and copies, such as a trade waiting for your yes or a declined card, are separate; the ones that can be turned off are in Email preferences on your profile.

Who we share it with

Service providers acting for us: Stripe (payments on the website), Apple (payments in the iPhone app), the hosting provider, email delivery, and Discord, which carries a copy of anything you send through the contact form into a private staff channel. Venues you connect (for example a brokerage through SnapTrade, or a Solana wallet) receive the instructions needed to run your copies; the aggregator receives what it needs to link your account. Sign-in providers (Google, GitHub) receive only the sign-in request. We disclose information when the law requires it or to protect rights and safety.

We do not sell personal information. If you allow it in the cookie notice, the advertising platforms we buy ads from (Reddit, and X where enabled) are told that a visit, sign-up or purchase happened, so we can measure what an ad led to. Some of that is sent by our server rather than by your browser, and it carries your account identifier, your network address, your browser identifier and the identifier the ad link carried, never your email and never anything about your trading. If you decline, or have not answered, none of it is sent.

Trybe is separate and is not advertising measurement: it is how a creator who referred you is paid. If you arrived through a creator's link and later subscribe, Trybe is told the order reference, the amount and your account identifier so the commission can be credited. That is part of paying the creator for the sale rather than measuring an ad, so it happens whatever you answered in the cookie notice; it carries no trading data, and it happens only when a referral brought you here.

Public trader data

The traders shown on the service are drawn from public regulatory filings, public on-chain records and venue leaderboards; that information is public by the nature of those sources. If you choose to publish your own trading through a connected account, that is opt-in, is labelled as yours, and can be revoked from your profile at any time; after revocation your record is no longer shown.

Retention

Account data is kept while your account is open and deleted or de-identified within 90 days of closure, except records we must keep: acceptances, signed authorizations, orders placed in your account, billing records and the audit log, which are kept for the period the law requires (typically up to seven years).

Security

Passwords are hashed with a slow hash and never stored; venue credentials are encrypted at rest; connections use TLS; access to production data is restricted and logged. No system is perfectly secure; if a breach affects you we will tell you as the law requires.

Your rights

You can see and correct your account information from your profile. You can ask us for access to, correction of, or deletion of your personal information, or withdraw consent, by writing to support@meror.ca; we respond within 30 days. If you are not satisfied you may complain to the Office of the Privacy Commissioner of Canada. If you are outside Canada your local law may give you additional rights, which we honour where they apply.

Analytics and advertising

Where analytics is enabled, we use Google Analytics 4 to count visits and see which pages are used. With the same permission we load the Reddit ads pixel, the X ads pixel where it is set up, and the Trybe creator pixel. None of them loads until you allow it in the cookie notice; if you decline, none of them is loaded.

Measurement does not all happen in your browser. A pixel misses a sign-up when an ad blocker is on, a tab closes, or a trial converts to a charge days later by webhook, so our server also tells Reddit directly that a sign-up or a paid invoice happened. That event carries your account identifier, the network address and browser identifier of the request, and the click identifier Reddit put on the ad link. It never carries your email, and never anything about traders, copies, balances or orders. It follows the same permission: your answer to the cookie notice is stored on your account, the server checks it before sending, and no answer counts as no.

IP addresses are anonymised where the platform allows it and the browser Do Not Track signal is honoured. You can change your choice at any time from "Cookie settings" in the footer; from then on nothing further is sent, though what was already sent cannot be recalled.

Cookies and local storage

We use browser local storage to keep you signed in, to remember your theme, and to keep a copy of your own account details so pages open at once. Stripe sets cookies on its own checkout pages under its own policy. If you allow analytics and advertising measurement, Google Analytics, Reddit, X and Trybe set their own cookies (for example _ga, _rdt_uuid) on this site; declining keeps them all off.

Where data is stored

Data is stored where the service is hosted and may be processed by providers outside Canada (for example Stripe in the United States), where it is subject to local law.

Children

The service is for adults. We do not knowingly collect information from anyone under 18, or under 19 for anything to do with betting on sport; if you believe we have, contact support@meror.ca and we will delete it.

Changes

Material changes to this policy are announced in the service and require your acceptance. The version at the top identifies what you accepted.