Chartwright privacy

Chartwright is a private tool for its owner and a small number of invited people. There is no signup, no account, no email address, no password, and no analytics. Access is an invite token that the owner issues by hand and can revoke at any time.

What leaves your browser

When you send a message, the extension sends to this self-hosted backend:

• the text you typed;
• chart context — the symbol, the interval, the chart id;
• the results of the chart actions the assistant runs on your behalf;
• a screenshot of the tab, but only when you explicitly capture one. Chrome requires a click and shows its own share picker, so it cannot happen silently.

Where it goes next

The backend forwards all of the above to OpenRouter, which routes it to the configured model. The default model is a cloaked model. Cloaked models are free precisely because the lab hosting them receives the prompts and completions in exchange — so your chat text, your chart data, and any screenshot you send reach a third party that is not named in OpenRouter's listing, under that lab's own terms and retention policy.

If that is not acceptable to you, do not send screenshots or anything sensitive. The operator can point CW_MODEL at a named paid model instead, which stops the cloaked-model routing entirely.

What this backend stores

• A SHA-256 hash of your invite token, its label, and when it was created or revoked. The token itself is never stored.
• Your conversations and turns, including the messages and any screenshot data URI attached to a turn, in a SQLite file on the operator's server.
• One usage record per model call: which token, when, which model, which tool names, and token counts. This is what enforces the weekly quota.

Nothing is sold, shared, or used for advertising. The operator can read the database, which is the same trust you extend to anyone who hosts a tool for you. Ask them to delete your data and they can, with one SQL statement.

What Chartwright does not do

It requests no cookies permission, never reads or uploads your TradingView session, and touches no site other than tradingview.com. It cannot place trades.