Privacy policy

Your Google account. Sign-in is through Google, using only the basic profile and email scopes. Google sends us your name, email address, profile picture and Google account ID. We store these to identify your account and to show your name and picture in the app. We never see your Google password, and we request no other Google data — no Gmail, Drive, Calendar or contacts.

Account data we generate. An API key and a webhook identifier are created for your account so that TradingView alerts and API calls can be attributed to you.

Alert and pipeline data. Alerts you send to your webhook endpoints are stored, along with the states they wrote, the signals they were evaluated against, and the delivery result for each destination. Your configuration — prisms, routes, states, signals, confluences, destinations, report pages and the metadata attached to them — is stored for the same reason: it is what the maps, reports and activity views are made of.

Connected services. To deliver messages we store what you give us for each destination: Telegram bot tokens, chat and topic identifiers, Discord bot tokens and channel identifiers, and webhook URLs. If you connect Telegram direct messages, we store the chat ID and username Telegram gives us when you press Start. If you add your own AI-extraction provider key, it is stored encrypted.

Technical logs. Like every web service we keep short-lived server logs of requests — IP address, browser identifier, the endpoint called and the outcome — for troubleshooting and abuse prevention only.

To run the service for you: to sign you in, receive and process your alerts, deliver your messages, and show you what happened. To keep the service working: diagnosing problems and preventing abuse. That is all. We do not sell your data, we do not use it for advertising, and we do not build profiles of you from it.

Axiom Flow's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide and improve the sign-in and account features you see; it is never transferred to others except as needed to provide those features, for security, or to comply with the law, and humans read it only with your consent, for security or abuse investigation, or where the law requires.

• The destinations you configure. The content of an alert is sent to the Telegram chats, Discord channels or webhook URLs you route it to. Once delivered, it is in that service and governed by its terms.
• Google, for sign-in. Google's own privacy policy governs what Google does during that step.
• Hosting. The service runs on Railway's infrastructure; your data is stored there under Railway's security terms.
• AI extraction, only if you turn it on. When a state or signal uses AI extraction, the text of the alert being processed is sent to the model provider (Anthropic by default, or the provider whose key you supplied) to extract the fields you asked for. Nothing else about you is sent with it.

No other third parties receive your data, and none of it is sold.

Axiom Flow sets only the cookies it needs to keep you signed in. There are no analytics, advertising or tracking cookies, and no third-party scripts run on the site, so there is nothing to opt in or out of. The law treats strictly necessary cookies like these as exempt from consent, which is why you do not see a cookie banner.

• axiom_session — set when you sign in, on this site only. It lets the server confirm you are signed in before showing signed-in-only pages. Kept for up to 30 days and removed when you sign out.
• Sign-in session — a short-lived, HttpOnly cookie used only during the Google sign-in hand-off. Expires within 24 hours.

The app also uses your browser's local storage, on your device only, for your sign-in token and your own preferences: theme, which map tab and filters you had open, table layouts, and the like. Nothing in local storage is sent to anyone but Axiom Flow's own API, and signing out clears the token. Google may set cookies on its own domain while you sign in; those are governed by Google's privacy policy, not this one.

Account and configuration data is kept for as long as your account exists. Alert history and delivery logs are kept while your account exists so that reports and replay keep working; during beta there is no automatic expiry. Telegram connection links expire after ten minutes. Server request logs are kept for a short period, measured in weeks, and then discarded. When your account is deleted, everything above is deleted with it within 30 days, except what we must keep to meet a legal obligation.

All traffic to the site and the API is encrypted in transit. Provider keys you add for AI extraction are encrypted at rest, and secrets such as your API key are shown to you once and otherwise hidden. Access to the production systems is limited to the operator. No service can promise perfect security; if we learn of a breach affecting your data we will tell you without undue delay.

You can see and change most of your data in the dashboard, and export it through the API with your key. You can delete destinations, prisms, states, signals and confluences yourself. To have your account and its stored alert history removed entirely, or to receive a copy of everything we hold about you, write to the address below; we act within 30 days. You can also revoke Axiom Flow's access to your Google account at any time from your Google account permissions; your Axiom Flow account then stays until you ask us to delete it.

If you are in the European Economic Area or the United Kingdom: we process your data to perform our agreement with you (running the service you signed up for) and for our legitimate interest in keeping it secure. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your local data protection authority.

Axiom Flow is a tool for trading alerts and is not directed at anyone under 18. We do not knowingly collect data from children; if you believe a child has created an account, tell us and we will delete it.

The service is hosted on Railway, whose data centres may be outside your country. By using Axiom Flow you accept that your data is processed there under the safeguards described on this page.

This page may be updated as the service leaves beta. The date at the top shows when it last changed; a material change will be announced in the app. See also the terms of service.

Questions about your data, access or deletion requests. Write to vinitpandya@gmail.com. The service at axiom-flow.io is operated by Vinit Pandya.