Privacy Policy

The short version

We collect what we need to log you in, keep your subscription working, and deliver forecasts inside your TradingView chart. We use a small number of well-known processors (Supabase, Stripe, Google, Apple) to do this. We don't sell your data. We don't share it with anyone outside that list. You can delete your account at any time.

The long version is below.

1. Who we are

One Proven System ("OPS," "we," "us") is operated by Kaden Hesse. It consists of:

• A marketing and signup website at oneprovensystem.com
• A Chrome extension ("One Proven System Adaptive Indicator") that runs inside TradingView charts (tradingview.com/chart)
• A backend API at api.oneprovensystem.com that serves forecasts and handles your account

This policy covers all three. Questions: kaden@oneprovensystem.com.

2. What we collect

Account data

When you sign up:

• Email address — how we identify your account and send transactional messages.
• Password — if you sign up with email. We never see your password in plain text; it's hashed and stored by Supabase (see below).
• Name and OAuth identifier — if you sign in with Google or Apple, we receive your name and a provider-specific user ID. We don't receive your social network contacts, posts, or anything else.
• Subscription status — whether your trial is active, your plan, and renewal dates.
• Stripe customer ID — a reference that lets us look up your billing in Stripe. We do not store credit card numbers ourselves; Stripe handles that.
• IP address and basic request metadata — logged transiently when you talk to our API, for security and abuse prevention.

Extension data

When you use the Chrome extension:

• Stock symbols — we read the ticker from the TradingView chart you have open (e.g. "AAPL") so we know which forecast to show. We do not read anything else from the page.
• Local storage — we save the last ticker you viewed in your browser (chrome.storage.local) so the extension remembers your context. This data stays on your device.
• Auth session — the extension stores your Supabase session token locally so you don't have to sign in every time. Also stays on your device.
• Forecast requests — the extension calls our API with the ticker you're viewing. Our server logs that request transiently for performance monitoring; we do not build a long-term record of what tickers you look at.

3. How we use it

• Run the service. Authenticate you, fetch your forecasts, manage your subscription.
• Talk to you about your account. Email verification, password reset, billing receipts, important changes to the service.
• Keep things working. Detect fraud, prevent abuse, fix bugs, monitor performance.
• Comply with the law. Tax records, fraud investigations, lawful requests from authorities.

We do not currently send marketing or promotional emails. If we ever do, every message will include a one-click unsubscribe link, and we'll only send to you if you've opted in.

4. Who we share it with

We use a small set of third-party processors to deliver OPS. Each one only sees the data they need. None of them sell your data. Their privacy policies govern what they do with what we send them:

We do not sell your personal information. We do not share it with advertisers, data brokers, or analytics platforms.

5. Where it's stored & how we protect it

• Account data is stored in Supabase, which runs on AWS infrastructure in the United States.
• Payment info is stored by Stripe, encrypted to PCI DSS standards. We never receive your full card number.
• All traffic between your browser, the extension, and our API uses HTTPS.
• Passwords are hashed (one-way, never reversible) before they're stored.
• We use reasonable technical and administrative measures to protect your data, but no online service can be 100% secure.

If we ever experience a security incident that affects your data, we will notify you and any relevant authorities as required by applicable law.

6. How long we keep it

• Account data: until you delete your account, plus a grace period of up to 30 days for backups before it's fully purged.
• Billing records: retained for as long as required by tax and accounting law (typically 7 years in the U.S.), even after account deletion.
• API logs: retained for up to 30 days for debugging, then deleted.
• Local storage on your device: until you clear your browser's storage or uninstall the extension.

7. Your rights

You can:

• See your data — sign in to your account; everything we have about you is visible there.
• Update your billing info — through the Stripe customer portal, accessible from your account.
• Delete your account — deletes your account data from our systems within 30 days (excluding billing records we're legally required to keep).
• Export your data — email us and we'll send you a copy.
• Withdraw consent / unsubscribe — you can stop using the service at any time. Transactional emails (billing, security) will continue while your account is active.

To exercise any of these rights, email kaden@oneprovensystem.com.

8. California residents (CCPA / CPRA)

If you live in California, you have additional rights under the California Consumer Privacy Act:

• Categories of personal information we collect: identifiers (email, name, OAuth IDs), commercial information (subscription status), internet activity (request logs).
• The right to know what we've collected about you.
• The right to delete what we have.
• The right to correct inaccurate data.
• The right to opt out of "sales" or "sharing" — we don't sell or share your personal info, so there's nothing to opt out of.
• The right not to be retaliated against for exercising any of the above.

Send California-specific requests to kaden@oneprovensystem.com with "CCPA Request" in the subject.

9. International users (EU/UK)

OPS is operated from the United States. If you access it from the EU, UK, or anywhere else outside the US, your data will be transferred to and processed in the United States.

Our legal basis for processing your data is:

• Contract — we need your data to deliver the service you signed up for.
• Legitimate interest — for fraud prevention, security, and improving the service.
• Legal obligation — for tax records and lawful requests.

Under GDPR you have the rights described in Section 7 above, plus the right to lodge a complaint with your local data protection authority. To exercise any of these, email kaden@oneprovensystem.com.

10. Children

OPS is not directed at children under 13 (or under 16 in the EU/UK). We do not knowingly collect data from anyone in that age range. If you believe we have collected data from a child, please email us and we will delete it.

11. Cookies & local storage

We don't use third-party tracking cookies or behavioral advertising tools.

We do use browser storage (localStorage) for one thing: keeping you signed in. Supabase's auth library stores a session token in your browser so you don't have to log in every time. You can clear it by signing out, clearing your browser's storage, or uninstalling the extension.

12. Changes to this policy

We may update this policy as the service evolves. The most current version will always be at oneprovensystem.com/privacy-policy. The "Last Updated" date at the top reflects the most recent change.

If we make a material change, we'll notify active users by email before it takes effect.

13. Contact

Questions, requests, complaints, or anything else privacy-related: kaden@oneprovensystem.com.

You'll hear back from a real person, usually within a couple of business days.