morphic Privacy Policy

Last updated 23 October 2026

1. Who we are

1.1. morphic (morphic.trade) is operated by the individual who operates morphic ("we", "us"). We decide how your information is used, and we are responsible for it. Contact: morphic <welcome@morphic.trade>.

1.2. This policy explains what we collect, why, who else handles it, how long we keep it and what you can do about it. Section 12 of our Terms of Use summarises it; where the two differ, this policy is the more detailed account, and it never takes away anything the Terms give you.

2. What we collect

2.1. Your account. Your email address, the name you give us, your password (stored only as a salted scrypt hash, never in readable form), your profile (time zone, the instrument you trade and any notes you write for Ask Lens), your display preferences, your notification choices, whether your email address is confirmed, your module access and your subscription status.

2.2. The agreement you sign. When you sign our Terms of Use we record the version you signed, a fingerprint of its exact text, the name you typed as your signature, the time, your network (IP) address and your browser's description of itself. This is the evidence of what you agreed to.

2.3. What you put in. The questions you ask Ask Lens and its answers, which tools it used and what the answer cost us, and the trade plans you ask us to score. Plans and levels you draw on the chart are kept in your own browser, not on our server, unless you send them to us to be scored or asked about.

2.4. Payments. When subscriptions are open, payment is taken by our payment provider (section 4), which acts as the seller of record. Your card details go to it directly and never reach us. We receive the facts we need to give you access: a customer and subscription reference, the plan, its status and its renewal or end date.

2.5. Security. The email address and network address of a failed sign-in attempt, kept for up to one day to slow down password guessing. A record of each signed-in session (when it began, when it was last used and when it expires; the session key itself is stored only as a hash). Our server's logs record the network address and time of each request.

2.6. Visit counts. We count which pages are viewed and which buttons are pressed, so we can see what is useful. No cookie is used for this and no network address is stored: a visitor is a one-way code made from the day, a secret kept on our server, the network address and the browser's description, so the same visitor gets the same code within a day and a different code the next day. Visits can be counted, but nobody can be followed from day to day or identified. With each visit we also record the country it comes from: our own server looks the network address up in a country table (DB-IP's IP to Country Lite, licensed CC BY 4.0) and keeps only the two-letter country code. The address is not stored and is not sent to anyone for this. A visit through a VPN or similar service shows that service's country. If you are signed in, the count is linked to your account. With a page view we also record how the visit arrived: the name of the site that linked to it (such as google.com, never the full address of the linking page), the campaign tags in the page's address (utm_source, utm_medium, utm_campaign, or a ref tag), whether an advertising click marker was in the address (only its kind, such as gclid or fbclid, never its value), and, when the page was opened inside an app's built-in browser, which app (such as Instagram or LinkedIn), read from the browser's description. This lets us see which sources bring visitors within a day; on its own it does not identify you. Only the names of pages and the labels of buttons are recorded, never anything you type.

2.6.1. Our analytics cookie, if you accept cookies. Our own cookie (named mx_vid) holds a random code and nothing else. With it we can recognise your browser on later visits, so we can count returning visitors and visits (a visit ends after 30 minutes without activity), and see where your first visit came from: the site that linked to us and the campaign tags in the address of the first page (utm_source, utm_medium, utm_campaign), the first page you opened and the type of device. If you create an account or join the waiting list, that becomes linked to the code, so we can see which sources lead to sign-ups. We do not use the code to show you anything different, we do not share it, and it is never linked to anything outside morphic.

2.7. Google Analytics. We also use Google Analytics to understand how the site is used. If you accept analytics cookies on the banner shown on your first visit, Google Analytics sets its cookies in your browser and records the pages you view, how you arrived, the time spent, your browser, device and screen, and an approximate location (city or region) worked out from your network address. Until you accept, or if you decline, it sets no cookies and stores nothing on your device: it only sends Google a signal that a page was viewed, which Google receives with the network address and the browser's description, and which cannot be linked to earlier visits. Advertising features and Google's use of the data for advertising are switched off.

2.8. The waiting list. If you join the waiting list: your email address, your name and, if you tell us, what you trade.

2.9. Emails you send us. The messages themselves and your address, so we can answer.

2.10. What we do not collect. We do not collect card numbers, brokerage logins, your positions or your account balances, your precise location, your contacts or advertising identifiers. If you tell Ask Lens about your trading account or positions in a question, that text is kept as part of the conversation (section 2.3), so share only what you are comfortable sharing.

3. Why we use it

3.1. To provide the service you signed up for: your account, your access, the maps, Ask Lens, scoring your plans, and the emails that belong to the account (confirming your address, resetting your password, invites). This is necessary to perform our agreement with you.

3.2. To send the emails you ask for, such as the email when a map is published. You turn these on and off yourself in your account.

3.3. To keep the service secure, to prevent abuse and to protect your account. This is in our legitimate interest and yours.

3.4. To review and improve the service. We read the visit counts, our analytics cookie's records and Google Analytics' reports, and we may read Ask Lens conversations, to find where the service is wrong, unclear or missing something. This is in our legitimate interest; analytics cookies are set only with your consent, which you can withdraw at any time. We do not use your information to train AI models, and we do not ask our AI provider to.

3.5. To keep evidence of our agreement and to comply with the law, including tax and accounting rules and requests from authorities that the law obliges us to answer.

3.6. We do not sell your information, rent it, use it for advertising, or make automated decisions about you that have legal or similarly significant effects.

4. Who else handles it

4.1. We use a small number of service providers, each only for what it does for us and under its own obligations to protect the information:

DigitalOcean hosts our server and database, in New York, United States.

Google provides Google Analytics, in the United States. It receives the pages you view and technical details of your browser and device, and sets cookies only if you accept them (section 2.7).

Anthropic provides the AI model behind Ask Lens, in the United States. To answer a question it receives the conversation so far, the parts of the published map needed to answer, and from your profile your name, the instrument you trade and your notes.

Resend delivers the emails morphic sends, in the United States. It receives your email address and the email's content.

Lemon Squeezy takes payments as the seller of record, once subscriptions are open. It collects your payment details directly under its own privacy policy and tells us the subscription facts in section 2.4.

Google handles the email we exchange with you (Google Workspace). The pages also load their typefaces from Google Fonts, so Google's servers see your network address and browser when you open morphic.

unpkg, a public content network, serves the charting library the chart is drawn with, so it also sees your network address and browser when the chart loads.

4.2. Market data comes from public sources (such as Yahoo and Cboe). Our server fetches it; none of your information is sent to them.

4.3. We may disclose information if the law requires it, to protect the rights, safety or property of our users, of us or of others, or as part of a transfer of the service, in which case this policy continues to apply to it.

5. Where it is processed

5.1. We are in Israel. Our server and most of our providers are in the United States, so your information is transferred there. We rely on the providers' contractual commitments to protect it, and we only transfer what each one needs.

6. Cookies and your browser's storage

6.1. We use one cookie of our own to keep you signed in. It is set by morphic itself, cannot be read by the page's scripts, is sent only over secure connections and lasts up to 30 days unless you sign out. Without it you could not stay signed in, so there is nothing to opt out of.

6.1.1. If you accept cookies, we also set our analytics cookie (mx_vid, section 2.6.1). It is set by morphic itself, cannot be read by the page's scripts, is sent only over secure connections and lasts 13 months. Declining, or changing your choice to decline later, deletes it and unlinks what was recorded under it, which then stays only in the anonymous counts.

6.2. Google Analytics sets its cookies (named _ga and _ga_ followed by our measurement code) only if you accept cookies on the message. They last up to two years. You can change your choice at any time with "Cookie settings" at the foot of the page; declining stops new analytics cookies from being set, and you can delete existing ones in your browser's settings. We use no advertising cookies.

6.3. Your browser also keeps your display preferences, your choice about analytics cookies, the levels and plans you draw, and similar conveniences in its own local storage on your device. We cannot see them unless you send them to us, and you can clear them at any time in your browser's settings.

7. How long we keep it

7.1. Your account, profile, preferences, Ask Lens conversations and subscription status: until you close the account.

7.2. The record of the agreement you signed: kept after the account is closed, for as long as we may need it to establish or defend legal claims, or the law requires.

7.3. Failed sign-in records: one day. Password-reset links: 45 minutes. Email-confirmation links: 48 hours. Each link works once.

7.4. Server logs: 30 days.

7.5. Visit counts: 12 months. When you close your account, the link between the counts and your account is removed and the counts stay anonymous. Google Analytics keeps its data for the retention period set in our Google Analytics account, at most 14 months. Our analytics cookie's record (first visit, source, visits) is deleted 13 months after the browser was last seen, or at once if you decline cookies.

7.6. Backups of the database are made every night and kept for 14 days, then deleted, so information you delete may remain in a backup until then.

7.7. The waiting list: until you are invited, until we remove the entry, or until you ask us to remove it. Closing an account also removes its address from the list.

7.8. Payment records are kept by our payment provider, and by us where needed, for as long as tax and accounting law requires.

8. How we protect it

8.1. Connections to morphic are encrypted. Passwords are stored only as salted scrypt hashes, and session keys, API keys and emailed links are stored only as hashes. Repeated failed sign-ins are slowed and blocked, access to the server is restricted, backups are readable only by the server's administrator, and only the operator of morphic can see account information. No system is perfectly secure; if a breach affects your information, we will tell you and the authorities as the law requires.

9. Your rights and choices

9.1. You can accept or decline cookies at any time with "Cookie settings" at the foot of the page; the choice covers both our analytics cookie and Google Analytics. From your account page you can download all the information we hold about your account, correct your profile, turn emails on or off, sign out other devices, and close your account, which deletes it as described in section 7.

9.2. You can also write to us to see, correct or delete your information, to object to a use of it, or to ask a question about it. We answer within the time the law sets. These rights come from the Israeli Protection of Privacy Law, 5741-1981, and from any other law that applies to you, such as the GDPR if you are in the European Union or the United Kingdom.

9.3. If you are not satisfied with our answer, you can complain to the Privacy Protection Authority in Israel, or to the data protection authority where you live.

10. Children

10.1. morphic is for adults. You must be at least 18 to use it, and we do not knowingly collect information about anyone younger. If you believe a child has given us information, tell us and we will delete it.

11. Changes to this policy

11.1. When we change this policy we update the date at the top and publish the new version here. If a change is significant, we tell you by email or in the service before it takes effect.

12. Contact

12.1. The individual who operates morphic, operator of morphic. Contact: morphic <welcome@morphic.trade>.

Version 2026-10-23. See also the Terms of Use.