Privacy Policy

MUTXRI TERMINAL ("the terminal", "we", "our") provides end-of-day and delayed market data, financial statements and company information for securities listed on the Johannesburg Stock Exchange (JSE), Nigerian Exchange (NGX), Nairobi Securities Exchange (NSE) and Egyptian Exchange (EGX). This policy explains what we collect, why, and what you can do about it.

1. What we collect

• Account details — your email address and, if you provide one, your name. If you sign up with a password, we store only a salted hash of it (PBKDF2), never the password itself.
• Provider details — if you sign in with Google or GitHub, we receive your name, email address and profile information from that provider, per the permissions you grant.
• Sign-in log — each sign-in attempt records: email, method (password / Google / GitHub), whether it succeeded, the IP address the request came from, a parsed device description (e.g. "Chrome on Windows") and the browser user-agent string. Failed attempts are recorded too, so we can detect credential-stuffing against an account.
• Device fingerprint — a one-way hash of your device description plus the first three octets of your IP. The raw IP is never stored in the fingerprint; the hash is used only to avoid emailing a security notice on every sign-in.

2. Why we collect it

• To authenticate you and keep your session secure.
• To send you a welcome email when your account is created.
• To send a security notice by email when your account is signed into from a device we have not seen before.
• To record sign-in history for security monitoring (unauthorised access detection).

3. What we never do

• We never sell your personal data.
• We do not show advertising and do not use advertising trackers.
• We do not store passwords, password hashes, session tokens or OAuth tokens in the sign-in log.

4. Retention

Sign-in log events are deleted automatically after 180 days. Accounts remain until you ask us to delete them (see section 8).

5. Data accuracy

Market data shown in the terminal is end-of-day or delayed as labelled on screen, sourced from the exchanges and other public providers. Financial statements are filed statements shown for information. Data may be delayed, incomplete or incorrect; the terminal is a research tool, not investment advice. Do not rely on it for trading decisions without independent verification.

6. Storage and emails

Account and log data are stored on our hosting provider (Render) and, once connected, a MongoDB database (Atlas). Emails are sent through Amazon Simple Email Service (SES) from the address [email protected]. Google and GitHub set their own cookies and process data under their own privacy policies during sign-in.

7. Local storage

The terminal stores your session token and interface preferences in your browser's local storage so you stay signed in between visits. You can clear this at any time from your browser settings.

8. Your rights

You may request a copy of, correction of, or deletion of your account and personal data at any time by emailing [email protected]. Deletion removes your account and its sign-in history.

9. Contact

Questions about this policy: [email protected].