Privacy Policy
Effective August 14, 2026
Mark processes personal information needed to provide option position analysis, saved positions, alerts, accounts, and billing. This policy explains what we process, why we process it, how long we keep it, where it goes, and the rights available to you.
In this policy, “Mark” means the controller operating trymark.app and dashboard.trymark.app.
1. Controller and privacy contact
The service and controller are identified as Mark. The Mark privacy team handles privacy operations, rights requests, and complaints.
2. Information, purposes, and retention
We process the information below only as needed for the stated purposes. We may isolate and retain information longer where law requires it or it is needed to resolve a dispute.
| Category | Information | Purpose | Retention |
|---|---|---|---|
| Account and authentication | Name, email, profile image, verification status, user ID, selected country or region of residence, privacy-policy version, consent choices and timestamps, login provider and provider account ID, authentication tokens, IP address, user agent, and session timestamps | Confirm launch-region eligibility, record consent, identify users, provide sign-in, protect accounts, prevent abuse, and support users | Until account deletion. Standard sessions expire 7 days after recent use, authentication cache after 5 minutes, and magic links after 10 minutes. Unused signup receipts stop working after 20 minutes and are removed during routine cleanup |
| Positions and analysis | Ticker, company, option type, strike, expiry, quantity, entry and target premium, deadline, quotes, volatility, assumptions, results, saved history, and alert preferences | Calculate scenarios, save and sync positions, track changes, and provide alerts | Device data until you delete it or clear browser storage. Synced data until you delete the position or account |
| Preferences | Language, currency, theme, sidebar state, and default alert frequency | Remember the interface and sync settings across devices | Device data until deleted and account settings until account deletion. Language cookie 1 year and sidebar cookie 7 days |
| Billing and subscriptions | User, customer, product, subscription, order, and event IDs; subscription status and period; cancellation state; processing timestamps | Open checkout, activate subscriptions, verify access, process refunds, disputes, and accounting | Contract and payment records for 5 years where Korean commerce law applies. Other subscription data until account deletion or the purpose ends |
| Email and alerts | Email address, alert content and link, send, acceptance, delivery, delay, bounce, complaint and rejection status, and provider message IDs | Send sign-in links and position alerts, confirm delivery, and resolve delivery failures and complaints | Sign-in links for 10 minutes. Delivery and complaint records for up to 3 years or until a related dispute ends |
| Product analytics and security | Session and user IDs, locale, screen, page view, feature interactions, position ID, option type and time-to-expiry band, position intent, comprehension answers, errors, performance data, and session replay with inputs masked | Analyze use, run feature tests, investigate errors, and improve security and reliability | Product events for up to 12 months, session replay for up to 30 days, and application logs for 7 days. Relevant records may be isolated until a security incident or dispute is resolved |
3. Records retained by law
| Record | Retention |
|---|---|
| Advertising records | 6 months |
| Contract and cancellation records | 5 years |
| Payment and service supply records | 5 years |
| Consumer complaints and dispute records | 3 years |
4. How we collect information
- Directly from you during analysis, account setup, settings, and support
- From Google or Discord when you choose social sign-in
- From Polar and its webhooks during checkout and subscription processing
- Automatically through cookies, local storage, session storage, logs, and analytics tools
5. Disclosure to third parties
Mark does not sell personal information. We do not disclose it for an independent third party's purposes unless you direct us to, consent, or the law permits or requires the disclosure.
When you select a service below, that business processes information independently under its own terms and privacy policy. Where separate consent is required by law, we request it before the feature is used. Polar and its payment partners collect payment-card details directly; Mark does not store a complete card number.
| Recipient | Information | Purpose | Retention |
|---|---|---|---|
| Polar Software, Inc. and payment partners | User ID, email, locale, order, subscription, and payment information | Checkout, tax, subscription, and customer portal operations | For the period required by the recipient's legal obligations and privacy policy |
| Google LLC | OAuth ID, name, email, profile image, and authentication information | Google sign-in selected by the user | Until disconnection or deletion of the related account, subject to the recipient's legal retention |
| Discord Inc. | OAuth ID, name, email, profile image, and authentication information | Discord sign-in selected by the user | Until disconnection or deletion of the related account, subject to the recipient's legal retention |
6. Service providers
| Provider | Service |
|---|---|
| Amazon Web Services | Database and application infrastructure in the United States (Northern Virginia) region, email delivery, and logs |
| PostHog, Inc. | Product analytics, feature testing, error collection, and session replay |
7. International transfers
We transfer information internationally where needed to provide the services below. Transfers use encrypted network connections. United States infrastructure is necessary to create and operate an account; you may refuse by not creating an account or may later request deletion. Product analytics begins only after optional consent.
| Recipient and location | Information and purpose | Timing and method | Retention |
|---|---|---|---|
| Amazon Web Services · United States | Account, authentication, saved positions, preferences, billing references, alerts, IP address, user agent, and logs · hosting, storage, email, security, and service operation | Encrypted transfer when an account is created and while the service is used | For the retention period stated for each category in section 2 |
| PostHog, Inc. · United States | User and session identifiers, screens, events, errors, and replay with inputs masked · analytics and reliability | Encrypted transfer after optional analytics consent | Events up to 12 months and replay up to 30 days |
| Polar Software, Inc. and listed subprocessors · United States and other listed locations | User ID, email, locale, order, subscription, and payment information · checkout, tax, and subscription operations | Encrypted API and webhook transfer when using checkout or the portal | As required by law or for the necessary period after billing ends |
| Google LLC · United States and global locations | OAuth ID, name, email, profile image, tokens, and connection data · Google sign-in | Encrypted transfer when Google sign-in is selected | Until disconnection or account deletion, subject to the provider's legal retention |
| Discord Inc. · United States and global locations | OAuth ID, name, email, profile image, tokens, and connection data · Discord sign-in | Encrypted transfer when Discord sign-in is selected | Until disconnection or account deletion, subject to the provider's legal retention |
8. Cookies and automatic collection
Mark uses essential cookies and browser storage for sign-in, locale and layout preferences, and local positions. Product analytics and session replay cookies are optional and are enabled only after consent. Blocking essential storage may prevent sign-in, preference persistence, saving, or synchronization.
You can block or clear cookies and site data in your browser and export or delete device data in Mark settings. Send a request to the privacy address to stop processing analytics linked to your account.
Session replay is configured to mask input fields. Avoid placing unnecessary personal information in free-form fields or content displayed on screen.
9. Deletion
We delete personal information without undue delay when its retention period expires or its purpose is complete. Information retained by law is isolated and used only for the required purpose.
Electronic records are deleted in a manner designed to prevent recovery. Paper records, if created, are shredded or destroyed. Backup copies are isolated from ordinary processing, used only for restoration, and securely overwritten through the backup rotation cycle.
10. Your rights
You and an authorized legal representative may request access, a copy, correction, deletion, restriction or suspension, withdrawal of consent, and portability where applicable law provides those rights.
Email the privacy address from your account email and describe the request. We may verify your identity. We will respond within the period required by law and explain any lawful restriction or refusal and available appeal route.
The device-data controls in settings do not delete server account, billing, email, or synchronized data. Request full account deletion separately.
11. Security
No transmission or storage method is completely secure. If a breach occurs, we will take required remedial steps and notify affected people and regulators where the law requires it.
- Encrypted network connections
- Secure cookies, expiring sessions, and hashed single-use sign-in links
- Database access limited to operational need
- Error and delivery records used to detect failures
- Provider review and contractual data-protection duties
12. Children
Mark is not directed to children under 14 and does not knowingly collect their personal information. If we learn that such information was collected, we will verify and delete it. A legal guardian may contact the privacy address to request deletion.
13. Changes to this policy
We publish the effective date and changed terms on this page. We will provide advance notice in the service or by account email if a change materially affects your rights or our processing purposes.
14. Questions and complaints
Contact the privacy address about this policy, our processing, or a rights request.
People in Korea may also contact the Privacy Infringement Report Center at 118, the Personal Information Dispute Mediation Committee at 1833-6972, or the Privacy Portal.