Privacy Policy — AlphaEdge

Last updated: October 2026

1. Who we are

AlphaEdge Signals is a research and trading-signals application. "AlphaEdge Signals" is the app and brand name of ALPHA EDGE, an MSME-registered enterprise (Udyam Reg. No. UDYAM-MH-18-0568869), which operates the AlphaEdge mobile application and web app.

Registered office: Office No FF-29, X Central Mall 1st Floor, Borsapada Road, Mahavir Nagar, Kandivali West, Mumbai, Maharashtra 400067.

The Udyam number above is ALPHA EDGE's registration as a micro, small or medium enterprise with the Government of India. It is not a securities-market registration, and this page does not state a SEBI registration number.

This policy explains what personal information the AlphaEdge app and its backend collect, why we collect it, who it is shared with, and how you can access or delete it. It describes the app as it actually behaves. Where a practice is limited or a protection is not one we can claim, we say so plainly rather than overstating it.

2. Information we collect

2.1 Account and registration information

You provide this when you create an account or complete your profile:

Mobile phone number (Indian +91 numbers) — this is your login identity; we sign you in with a one-time password (OTP) sent to it.
Email address
Full name
PAN number — your Permanent Account Number, a government-issued tax identifier, where you supply it. This is sensitive; see section 3.
State and city
Profession
Trading experience
Capital utilization (a broad range you select) and capital per trade (an amount you enter)
Trader type
Referral code and/or relationship-manager referral code, if you were referred
Market segments you are interested in — the segments you select during profile setup

2.2 Payment information

When you request a subscription, you submit payment evidence for a UPI transfer you have already made from your own bank or UPI app:

UPI transaction references (UTRs) — up to nine per request.
A payment-proof upload — a JPEG, PNG or WebP image, or a PDF, up to 10 MB. This is typically a screenshot or receipt of your UPI payment.

These UTRs and the uploaded proof files are stored on our servers and are retained as the commercial record of your payment. Uploaded proofs are held in private storage and are readable only by our authorised administrative staff over an authenticated, access-controlled route; they are not published and are not included in general data exports.

We do not collect card details. AlphaEdge collects no card number, expiry, CVV or cardholder name, and runs no card checkout. Payment is made by you, in your own UPI or banking app, outside AlphaEdge; we only receive the reference and the proof you choose to upload. No card-payment gateway is active in the app.

2.3 Device and network information

Push notification token (an Expo push token) and the platform your app is running on (for example, Android). This is stored against your account so we can deliver signal and account alerts to your device.
IP address. The network address your request arrives from is recorded and stored when you sign in, when your session is refreshed, when an administrator acts on your account, and when a referral attribution changes. We keep it as a security and fraud-prevention record — to see whether a single paid account is being signed into from many places, and to investigate suspected account sharing or misuse.

The app does not collect a device identifier, an advertising ID, or an installation ID. There is no advertising identifier in AlphaEdge, and we do not build advertising profiles.

2.4 App activity analytics

We record how the app is used, to our own backend. The events we record are:

session_start, session_heartbeat (roughly every 45 seconds while the app is open) and session_end
tab_dwell — which tab you were on and how long (in milliseconds)
segment_dwell — the same, for segments within a screen
A session_id that ties one app session's events together, and a source value identifying the app surface (for example, the mobile app or web app)

These analytics are linked to your account. They are not anonymous and we do not describe them as anonymised. When you are signed in, our server attaches your user ID to each event from your authentication token — we can, and for product and support purposes do, see the activity of an identified account. Events sent while you are not signed in carry no user ID.

Earlier in-app text described analytics as "aggregated and anonymized". That description was inaccurate and this policy replaces it.

2.5 What we do not collect

No third-party analytics or crash-reporting services. AlphaEdge contains no Sentry, Firebase Analytics, Amplitude, Mixpanel, PostHog or Crashlytics SDK. All analytics described above go only to our own backend. Google Firebase is present solely as the transport that delivers push notifications to Android devices.
No KYC document collection. The app has no identity-document verification flow. We do not collect Aadhaar, passport, voter ID or driving licence details or images. (You may see a plan named "KYC trial" — that is only a subscription plan name and involves no document collection.)
No card or bank-credential collection, as described in section 2.2.
No contacts, no photo library beyond the single payment-proof file you choose, no microphone, no background location.

3. Why we collect each item

Data	Purpose
Phone number	Account identity and OTP sign-in; service and account notices
Email address	Account correspondence, receipts and support
Full name	Identifying your account and your payment records
PAN number	Client records and the tax and financial-sector record-keeping obligations that apply to us, and to match a payment to the right client. It is not used for marketing, is never shown to other users, and is visible only to authorised administrators.
State, city	Determining which products and communications are appropriate for you; internal reporting
Profession, trading experience, capital utilization, capital per trade, trader type	Understanding your experience and scale so that research coverage and risk framing are suitable, and so support can respond in context. These are self-declared and optional.
Referral code / RM referral code	Attributing your signup to the referrer or relationship manager, and applying any referred pricing
Market segments of interest	Scoping any trial you take and deciding which research coverage to show you
UTRs and payment proof	Verifying that a claimed UPI payment was actually made, activating the correct subscription, resolving payment disputes, and keeping the accounting record
Push token and platform	Delivering signal alerts and account notifications to your device
IP address	Security and fraud prevention: detecting whether one paid account is being used from many places, investigating suspected account sharing or misuse, and keeping an audit trail of sign-ins and administrative actions. It is not used for marketing or for location targeting.
App activity analytics	Understanding which parts of the product are used, diagnosing problems, and deciding what to build or fix. Because these are account-linked, they are also used for support and for internal engagement reporting.

4. How your data is stored and protected

Your data is held in our own database on servers we operate. Payment-proof files are stored in private server storage, outside any publicly served directory, and are reachable only through an authenticated administrator-only route.

Traffic between the app and our servers is encrypted in transit using HTTPS/TLS. At rest, your data sits in our own database and in private file storage on servers we control, protected by operating-system and database access controls and by role-gated application access: ordinary user accounts cannot see other users' records, and administrative endpoints deny access by default. We do not additionally claim database-level or disk-level encryption at rest, because we will not assert a protection we cannot evidence.

Most accounts sign in with a one-time password sent to your phone, and for those we store no password at all. A small number of accounts — principally staff and older email logins — use an email-and-password sign-in; for those we store only a salted, one-way hash of the password, never the password itself, and we cannot recover it.

We do not claim more than this. We do not represent that our systems are unbreachable, and we make no certification claim we cannot evidence. If a security incident affects your personal information, we will notify affected users and the relevant authorities as required.

5. How long we keep your data

Account and profile data, including PAN — for as long as your account exists, and afterwards for as long as we are required to retain client records under the financial-sector, tax and accounting obligations that apply to us.
Payment records, UTRs and payment-proof uploads — retained as financial records for the statutory record-keeping period, because they evidence a commercial transaction and may be needed for audit or dispute resolution. These are generally not deleted on request while that obligation applies.
Push tokens — kept while the device is active. A token is deactivated when a newer token registers for the same device, when you ask us to remove it, or when the push service reports it is no longer valid — which is what happens once you uninstall the app.
Sign-in and IP records — retained as an append-only security audit trail. We have not yet fixed an automatic purge window for these; they are deleted with your account data, or earlier on request where we have no security or regulatory reason to keep them.
App activity analytics — retained as event records and as periodic per-user summaries used for internal reporting. We do not currently operate a fixed automatic purge window for these; they are deleted when we delete your account data, or earlier on request where we have no regulatory reason to keep them.

6. Who we share data with

We do not sell your personal data, and we do not share it for advertising.

Push delivery. To send a notification to your device, the notification text and your push token pass through Expo's push service and, on Android, Google Firebase Cloud Messaging. These are transport providers: they receive the push token and the content of the notification, not your profile, PAN or payment records.
Our own staff. Authorised administrators and, where you were referred by one, your relationship manager can see the account and payment-request information needed to service your account.
Infrastructure. Our servers and database are hosted with a commercial hosting provider, which holds the data at rest on our behalf under our instruction.
Legal and regulatory. We will disclose information where we are legally obliged to — for example to SEBI, a tax authority, a court, or law enforcement acting under valid authority.

Beyond these, we do not pass your data to third parties. In particular, no third-party analytics, attribution, advertising or crash-reporting service receives anything from AlphaEdge.

7. Your rights: access, correction and deletion

You may, at any time:

Access a copy of the personal information we hold about you;
Correct your profile details — most can be edited directly in the app, under Profile;
Request deletion of your account and personal data;
Turn off notifications in your device settings, or ask us to remove your push token.

To make any of these requests, email support@alphaedge.app from the email address on your account, or from your registered phone number's contact details, and tell us what you want done. We will respond within a reasonable period and will verify that the request comes from you before acting on it.

For account deletion specifically — how to ask, how we verify it is you, and exactly what is deleted and retained — see app.alphaedge-signals.com/delete-account.

Limits on deletion, stated honestly: where we are required to retain records — payment records, UTRs, payment proofs, and the client records we are obliged to keep — we will retain those for the required period even after your account is closed, and will delete the rest. We will tell you what was deleted and what was retained, and why.

8. Children

AlphaEdge is for adults. You must be 18 years of age or older to create an account or subscribe. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, write to support@alphaedge.app and we will close it and delete the associated data.

9. Not investment advice; market risk

AlphaEdge Signals is operated by ALPHA EDGE (Udyam Reg. UDYAM-MH-18-0568869). The research, signals, baskets and commentary in AlphaEdge are general research information, not personalised investment advice, and are not a recommendation tailored to your financial situation, objectives or risk tolerance.

Investments in securities markets are subject to market risks. Read all the related documents carefully before investing. Trading involves the risk of loss, including loss of capital. Past performance is not indicative of, and does not guarantee, future results. Any performance figures shown in the app are historical and measured at published levels; your own results will differ. You are responsible for your own investment decisions and your own risk management, and you should consider consulting a qualified adviser about your particular circumstances.

Registration with SEBI and certification from NISM in no way guarantee the performance of an intermediary or provide any assurance of returns.

10. Grievance redressal

If you have a complaint about your data, this policy, or our service, write to support@alphaedge.app with the details and your registered phone number. We will acknowledge your complaint and work to resolve it.

You can also write to us by post at: ALPHA EDGE (Udyam Reg. UDYAM-MH-18-0568869), Office No FF-29, X Central Mall 1st Floor, Borsapada Road, Mahavir Nagar, Kandivali West, Mumbai, Maharashtra 400067.

Where a complaint concerns a SEBI-registered intermediary, SEBI operates the SCORES platform at scores.sebi.gov.in. If a SEBI registration applies to this service, the registration number to quote when using that route will be published on this page. Until then, please raise anything unresolved with us directly at the addresses above so it is recorded and actioned.

11. Changes to this policy

If we change this policy, we will update the "Last updated" date at the top of this page and publish the revised policy here, at app.alphaedge-signals.com/privacy. The same date is shown in the app's Legal screen, and it tracks the terms revision recorded against your consent when you submit a subscription request — so an update to the policy is visible in the app, not only on this page.

For a change that materially affects how we use your data, we will give notice in the app before or when the change takes effect — by an in-app notice or a push notification to registered devices. Continuing to use AlphaEdge after a change takes effect means you accept the updated policy; if you do not, you can stop using the app and ask us to delete your data under section 7.