CopyPilot

Privacy policy

What we collect, and why.

We keep only what's needed to copy your orders between the accounts you link.

Last updated 3 October 2026

We never sell your data or show you ads.
Broker tokens are encrypted at rest with AES-256-GCM.
Delete an account link and its token is gone from our database.

01What we collect

We collect the following when you use CopyPilot:

  • Account details: your name, email and a hashed password (we never store it in plain text).
  • Broker connections: client IDs, account names and access tokens for the demat accounts you link.
  • Trading activity: orders on your master accounts and the copies we place on followers, with their status.
  • Settings: your groups, multipliers and sizing rules.
  • Basic technical data: IP address, browser type and logs needed to keep the service running and secure.

02How we use it

Only to run the product you signed up for:

  • Reading orders on your master accounts and placing matching orders on followers.
  • Showing balances, trade logs and connection status in your dashboard.
  • Sending account emails such as password resets.
  • Detecting abuse and fixing errors.

03Broker access

We connect to Zerodha through Kite Connect and to Dhan through the access token you provide. We use this access only to read profiles, balances and orders, and to place, modify or cancel copied orders.

We never ask for or store your broker password, PIN or TOTP. Tokens expire on the broker's schedule, and you can revoke them from your broker at any time.

04Who we share it with

We don't sell or rent your data. We share it only with:

  • Your brokers, to carry out the orders you asked us to copy.
  • Service providers that host our database and send email, under confidentiality terms.
  • Authorities, when Indian law requires it.

05Security

Broker tokens are encrypted with AES-256-GCM before they're stored, and all traffic uses HTTPS. No system is perfectly secure, so please use a strong password and keep your devices safe.

06Retention and deletion

We keep your data while your account is active. Removing a linked account deletes its stored token. To delete your CopyPilot account and its data, email us and we'll do it within 30 days, except records we must keep by law.

07Your rights

Under India's Digital Personal Data Protection Act, 2023, you can ask to access, correct or erase your personal data, withdraw consent, and raise a grievance. Email us and we'll respond within 30 days.

08Cookies and storage

We store your login session and theme choice in your browser. We don't use advertising or third-party tracking cookies.

09Changes to this policy

If we make material changes, we'll update the date above and let you know by email or in the dashboard.

10Contact

Questions or grievances: contact@tcmhack.in.