Privacy
Privacy.
What we collect, why, how long we keep it, and how to delete it.
Who we are
ZTEN runs zten.in, MyZTEN and ZSIM Lab (my.zten.in) and ZTEN Shadow (shadow.zten.in). For anything on this page, write to hello@zten.in.
What we collect, and why
| What | When | Why |
|---|---|---|
| Name, email, phone | You register on MyZTEN or ZTEN Shadow | To sign you in, send one-time codes and account emails, and reply to you |
| Password | You register or reset it | Kept only as a bcrypt hash. We cannot read your password |
| One-time codes | Sign-up and password reset | To check your email. Each code expires after 10 minutes |
| Zerodha link (MyZTEN) | Only if you connect Zerodha | Your Kite Connect API key, its secret and each day's access token, stored encrypted; your Zerodha client ID and name. Used to read your account and open baskets for you to confirm |
| Your MyZTEN data | As you use MyZTEN | Your rules, settings, paper trades and the event log, so the app can run your rules and show your results |
| ZSIM Lab setups | You save a setup, a batch rule or run a batch | So you can run them again. Up to 3 setups and 3 batch rules; your last 10 batch runs |
| Push subscriptions | You turn on notifications | The browser's push address and keys and the browser's name, to send you alerts |
| Bug reports | You send one | Your text, the page, and your browser and screen size, to find and fix the problem |
| Audit log (MyZTEN) | Account actions | Sign-ups, sign-ins (with the IP address), password resets and Zerodha connect or disconnect, to keep your account safe |
| Guest ZSIM Lab runs | You run ZSIM Lab without an account | A random guest cookie and a salted hash of your IP address (never the address itself), to count the 3 free runs a day. Kept 7 days |
| Server logs | Every visit | The web server records the IP address, time, page and browser of each request, to run and protect the service. Kept 14 days |
| Google Analytics | Visits to zten.in, my.zten.in and shadow.zten.in | To count page visits and see which features are used. It sets cookies and never gets your email, name or trades |
What we never collect
- Your Zerodha password or 2FA code. You type them on Zerodha's own page.
- Card or bank details. ZTEN is free and takes no payments.
Who else handles it
- Oracle Cloud hosts our server, in its Hyderabad, India region.
- Google runs Google Analytics and delivers our emails.
- Your browser's push service (for example Google, Mozilla or Apple) delivers notifications you turned on.
- Zerodha handles your login and your account when you connect it, under Zerodha's own privacy policy.
We do not sell your data or share it for advertising.
Cookies and browser storage
- MyZTEN sign-in: a cookie that scripts cannot read, sent only to my.zten.in, valid for 1 day.
- ZSIM Lab guest: a random cookie that counts free runs, valid for 1 year.
- ZTEN Shadow sign-in: kept in your browser's local storage, valid for 1 day.
- Google Analytics: its own cookies. There is no consent banner today; we will review this as India's Digital Personal Data Protection rules take effect.
How long we keep it
Account data stays while your account exists. One-time codes expire after 10 minutes. Each day's Zerodha access token expires at 6:00 am the next morning, and disconnecting Zerodha deletes the key, secret and token at once. Guest ZSIM Lab rows are kept 7 days and server logs 14 days. Google Analytics keeps visit-level data for 2 months.
Your choices
- See or delete your data: write to hello@zten.in from the email on your account. We delete the account and its data within 30 days and confirm by email. Copies in server backups go when those backups are removed.
- Disconnect Zerodha any time in MyZTEN Profile, or revoke the app at Zerodha.
- Notifications: turn them off in MyZTEN or in your browser.
Age
ZTEN is for adults. Do not register if you are under 18.