Privacy policy.
Effective November 7, 2026
Volatility Box ("we", "us") runs volatilitybox.com. This policy explains what we collect, why we collect it, who helps us, and the choices you have. Questions: [email protected].
1. What we collect
- Your account: name, email, username and password. Passwords are stored scrambled (hashed); we can't read them.
- Your purchases: what you bought, your subscription status, and the billing details you enter (name, email, country, address). Card numbers go straight to Stripe; we never see or store them.
- Your settings: watchlists and alert settings.
- Telegram: if you connect Telegram alerts, your Telegram chat ID, so alerts reach you.
- How you use the site: pages you visit, clicks and scrolling, device and browser type, rough location from your IP address, and the link or campaign that brought you here.
- What you send us: support emails and feedback, such as a cancel survey.
2. Why we use it
- To run your account and give you what you paid for.
- To take payments and keep the records tax law requires.
- To send order and account emails, and the alerts you turn on.
- To keep the site secure and stop spam and abuse.
- To understand how the site is used and improve it (analytics, only with your consent where the law requires it).
- To send occasional product news, only if you signed up. Every such email has an unsubscribe link.
For visitors in the EU, UK and Switzerland, our legal bases are: performing our contract with you (account, purchases, alerts), legal obligation (tax records), legitimate interests (security, fraud prevention), and your consent (analytics cookies, product news).
3. Who helps us
These companies process data for us and get only what they need for their job:
- Stripe: payments.
- IONOS: sends our emails.
- Microsoft Clarity: site analytics, including recordings of how pages are used. On member pages all text is hidden from recordings.
- Cloudflare: security and fast delivery; it handles every visit.
- Wordfence: security; it logs visitor IP addresses to block attacks.
- Telegram: delivers the alerts you connect.
- Our other sites: TOS Indicators, Volatility Box, ORB Setups, Squeeze Setups, ETF Setups and Fib Setups share account and membership details with each other, so a bundle or membership works on every site it includes.
- Hosting: our own servers in the United States.
We don't sell your personal information, and we don't share it for advertising. We disclose it only if the law requires it, to protect our rights or users' safety, or as part of a sale or merger of the business.
4. Cookies
- Needed for the site to work: sign-in, cart and checkout, security, and remembering your cookie choice (tos_consent, one year).
- Analytics: Microsoft Clarity (_clck, _clsk), plus a campaign cookie that remembers which link brought you (mktg_utm, 30 days).
Visitors in the EU, UK and Switzerland are asked before any analytics cookie is set. Everyone else can opt out from the cookie notice, or at any time from Cookie settings, also linked at the bottom of every page. If your browser sends a Global Privacy Control signal, we treat it as an opt-out automatically. Other "Do Not Track" signals have no agreed standard, so we don't act on them beyond that.
5. How long we keep it
- Orders and payment records: 7 years, as tax law requires.
- Accounts: until you ask us to delete them. Free accounts with no purchase and no sign-in for 3 years may be removed after we email you first.
- Analytics: as long as each tool keeps it: Microsoft Clarity up to 13 months.
- Security logs: a few weeks.
- Emails with us: as long as needed to help you.
6. Your choices and rights
- Get a copy of your data, or delete it: use the form below or email [email protected]. We confirm by email and finish within 30 days. Deleting your data cancels any active subscription; order records stay for tax purposes.
- Correct your data: update it in your account, or email us.
- Stop product emails: use the unsubscribe link in any of them.
- EU, UK and Switzerland: you can also object to or restrict how we use your data, take your data elsewhere, withdraw consent at any time, and complain to your local data protection authority.
- California and other US states: we don't sell or share personal information. You can ask what we hold and have it deleted the same way, and we won't treat you differently for asking.
7. Children
Our sites are meant for adults. We don't knowingly collect data from anyone under 13 (under 16 in the EU). If you think we have, contact us and we'll delete it.
8. Security
Every page uses encryption (HTTPS), passwords are stored hashed, payments run through Stripe, and only people who need access have it. No system is perfectly secure; if a breach affects you, we'll tell you as the law requires.
9. Data stored in the US
We're based in the United States and store data here. When visitors from the EU, UK or Switzerland use our sites, their data comes to the US. Our service providers protect those transfers with the EU-US Data Privacy Framework or standard contractual clauses.
10. Changes
When we change this policy we update the effective date above. If a change is significant, we email members before it takes effect.