01Who this policy is from
QuantNifty is an algorithmic trading system development and consulting practice operating in India, referred to here as we, us or QuantNifty. It is a sole proprietorship run by Anuj Baid.
This policy covers the website quantnifty.com and the domain quantnifty.in, which redirects to it. Under the Digital Personal Data Protection Act, 2023, we act as the Data Fiduciary for the personal data described below, and you are the Data Principal.
You can reach us on WhatsApp at +91 96014 43663 or at [email protected] for anything in this policy.
02What we collect
On the website itself, three things and nothing else. If you use Verified P&L, the extra data it needs is described in its own section.
Information you type into the enquiry form
Your name, a phone number or email address, the type of work you are asking about, and whatever you write in the message field. All of it is optional in the sense that nobody is required to fill in the form; you can message us directly instead.
Standard server logs
Our host, Vercel, records ordinary request data when a page is served: IP address, browser and device type, the page requested, and a timestamp. This happens for every website on the internet and we do not use those logs to build a profile of you.
Google Analytics
We run Google Analytics 4 to see which pages get read and roughly where visitors come from. It records the pages you view, how long you stay, the referring site or search, your approximate location from your IP address, and your device and browser type. It sets its own cookies to recognise a returning browser, described in the next section.
We use it to decide what to write next, not to identify you. We do not upload your enquiry details, your name or your email into it, we do not run Google Ads or any advertising integration, and we have not enabled Google Signals or any cross-device advertising feature. If you would rather not be counted, any browser-level tracking blocker or Google's own opt-out add-on will stop it, and nothing on this site breaks if you do.
No broker passwords, session tokens or API keys, no PAN, phone number, email or address from your broker, no bank or demat details, and no payment information. Outside Verified P&L, which you choose to use, we collect no trading positions or portfolio data. You should never send credentials to us or anyone else over a web form or a chat app.
03Why we process it
We process your enquiry details for exactly one purpose: to reply to you and to discuss the work you are asking about. If that turns into an engagement, the same contact details are used to run the project.
Under the DPDP Act our lawful basis is your consent, which you give by choosing to send the message. Server logs are processed for security, abuse prevention and keeping the site running, which are legitimate uses of a website operator.
We do not sell personal data. We do not rent, trade or share it for advertising. We do not add you to a marketing list, and we do not send newsletters or bulk messages.
04The enquiry form and WhatsApp
This is the part most privacy policies bury, so it is worth being plain about.
The enquiry form on our homepage does not send anything to a server of ours. There is no database behind it. When you press send, your browser assembles what you typed into a pre-filled WhatsApp message and opens WhatsApp. Nothing leaves your device until you press send inside WhatsApp itself.
That means the message, once sent, is delivered and stored through WhatsApp, operated by Meta, and is governed by their privacy policy in addition to this one. We receive it as an ordinary WhatsApp chat. If you would rather not use WhatsApp, skip the form and write to [email protected] instead.
05Verified P&L and the browser extension
Verified P&L lets you prove your intraday P&L from Kotak Neo or Zerodha Kite and publish it on a public quantnifty.com link. It uses the QuantNifty Verified P&L Chrome extension. Nothing here happens unless you sign in with X and press Generate today’s Verified P&L. The first time you do, we explain what is collected and published and ask you to agree.
What the extension does in your browser
When you press Generate, the extension opens the broker you picked in a browser tab and goes to its Positions screen. It reads the request your own broker session already makes for your positions, and repeats the requests to the broker for your positions and your account profile (for Zerodha also today’s orders).
Kotak Neo: the extension switches on “Today’s positions” if needed and reads the Profit/Loss, Realised and Unrealised figures and each position’s last traded price shown on the Positions screen, to value open positions and to check the figures against the proof. Your Kotak password, session token, device id and the request details stay in your browser and travel only to Kotak, encrypted.
Zerodha Kite: the extension reads only the number of positions on the screen; the last traded prices come with the positions from Zerodha. Your Kite password and session token travel only to Zerodha, encrypted, with one exception: the last 12 characters of the session token are shown to QuantNifty in both requests, so we can confirm both came from the same login (and so the same account). Those characters cannot be used to sign in to your account.
The extension only runs on neo.kotaksecurities.com, kite.zerodha.com and quantnifty.com, and only when a verification is started from quantnifty.com. It does not read your browsing on any other website.
What reaches QuantNifty
A verifier server run by QuantNifty takes part in the encrypted connection to your broker so it can confirm the data really came from the broker. We receive only:
- From your broker profile: your name and client code (Zerodha: user id). Everything else in that response, including PAN, phone number, email, address and bank and demat details, stays hidden from us.
- From your broker positions: today's positions as the broker returns them: contract names, quantities, buy and sell amounts, product type and, for Zerodha, the last traded price and Zerodha’s own P&L figure for each position.
- Kotak Neo only, from the Positions screen: the three summary figures and each position’s last traded price, to value open positions and for the consistency check.
- Zerodha Kite only, from your orders: today’s order list, from which we keep only the number of executed orders and the brokerage they carry (Rs 20 an order + GST), used for the with-charges figures. The order list itself is not stored.
- Zerodha Kite only: the request headers your browser sends to Zerodha, with the session token hidden except its last 12 characters (see above). We compare them between the two requests and do not keep them.
We keep your broker account name only in masked form (for example AnuX XXXX) and your client code only masked (first two characters). To stop one broker account being linked to more than one X account we also keep a one-way fingerprint of it, made with a secret key that is kept outside our database (HMAC-SHA256), so the fingerprint cannot be turned back into your client code even by someone holding a copy of the database. Your full name and client code are never stored, not even while a verification is in progress: they are reduced to the masked forms and the fingerprint the moment they arrive. The one exception is your choice: if you turn on “Show my full broker account name” in Settings, we keep and show your full account name from your next verification. Your client code always stays masked, and turning the setting off deletes the full name straight away.
Everything we store is encrypted at rest (AES-256, by our database provider) and travels only over encrypted connections (TLS). Your broker password and session token never reach QuantNifty at all.
Sign in with X
Verified P&L uses Sign in with X. We receive your X user id, handle, display name, profile picture and follower count, and keep a session cookie named qn_sess for up to 30 days so you stay signed in. We only ask X for read access. We never post on your behalf; Share on X opens X's own post window for you to send.
What becomes public
Each verification creates a public page and share image showing your X profile, your broker, your masked account name and client code, the date and time, and your realised, unrealised and total P&L. We keep each day’s positions so your own page can show them and work out your trade statistics, but visitors see your positions only if you turn on “Show my positions” in Settings, Your performance dashboard (calendar, accuracy, averages, drawdown, trade statistics, with or without charges) is shown by default; turn off “Show my performance dashboard” in Settings to keep it to yourself. Positions are hidden by default. You can change both at any time. Your page, quantnifty.com/u/<your X handle>, lists the latest verified P&L of each day for each linked broker account. Anyone with the link can see it, and it can be shared and copied once posted.
Your consent
The first time you press Generate we show what is collected, stored and published, with a link to this policy, and ask you to tick “I agree”. We record that you agreed, the date and time, the version of that wording and your browser type. If the wording changes in a way that matters, we ask again. You can withdraw at any time by removing your verified days and asking us to delete your account.
Keeping and deleting it
You can remove any verified day yourself with Remove this day on your page; it is deleted immediately. Otherwise we keep your Verified P&L records until you ask us to delete them. To delete everything, write to us on WhatsApp or email from the X account you used, and we will delete your links, history and linked broker accounts within 30 days. Copies already shared on X or elsewhere are outside our control.
07Who else touches your data
We use a small number of third party services, listed here in full.
| Service | What it does | What it sees |
|---|---|---|
| Vercel | Hosts and serves the website | IP address, user agent, requested URL, timestamp |
| WhatsApp (Meta) | Carries enquiry messages | Your phone number and the message you send |
| Google Fonts | Serves the typefaces | IP address and user agent at the moment fonts load |
| Google Analytics | Counts page views and traffic sources | Pages viewed, time on page, referrer, approximate location from IP, device and browser |
| YouTube (Google) | Plays videos embedded in blog posts | IP address and user agent when the player loads, and playback data if you press play. Embeds use YouTube’s no-cookie mode, so nothing is set until you play. |
| X (formerly Twitter) | Sign in with X for Verified P&L | That you signed in to QuantNifty. We receive your X id, handle, name, picture and follower count |
| Kotak Securities | Source of the data in a Verified P&L (Kotak Neo) | The requests your own Kotak Neo session makes, as it would if you opened the app yourself |
| Zerodha | Source of the data in a Verified P&L (Zerodha Kite) | The requests your own Kite session makes, as it would if you opened Kite yourself |
| X (formerly Twitter) | Renders posts embedded in blog articles | IP address and user agent when the embedded post loads, and its own cookies if you are signed in to X |
Some of these providers operate servers outside India, so a cross-border transfer happens as a normal consequence of using them. We will also disclose information if a law, regulator or court in India validly requires it.
08How long we keep it
- Enquiries that go nowhere: deleted within about twelve months of the last message.
- Client project correspondence: kept for the duration of the engagement and for as long afterwards as we are required to for tax and contractual records, normally up to eight years.
- Server logs: retained by Vercel on their own schedule, typically a short rolling window measured in days.
You can ask us to delete your data sooner. See your rights below.
09Your rights
Under the Digital Personal Data Protection Act, 2023, you can ask us to:
- Tell you what we hold about you and who we have shared it with.
- Correct or complete anything inaccurate or out of date.
- Erase your personal data where we no longer need it for the purpose you gave it for.
- Withdraw consent at any time, which is as simple as telling us to stop. Withdrawal does not undo processing that already happened lawfully.
- Nominate someone to exercise these rights on your behalf in the event of death or incapacity.
- Complain to us first, and to the Data Protection Board of India if we do not resolve it.
Message us on WhatsApp with your request. We will respond within thirty days, and usually far sooner, since the volume of data involved is tiny.
10Grievance redressal
Anuj Baid, Proprietor, QuantNifty
WhatsApp: +91 96014 43663
Email: [email protected]
Response window: thirty days from receipt
If you are not satisfied with how we handle a complaint, you may escalate it to the Data Protection Board of India constituted under the DPDP Act, 2023.
11Security
The site is served over HTTPS with HSTS enabled and a set of standard security headers. There is no login, no user account, no payment flow and no database of personal data on our infrastructure, which removes most of the ways a website leaks information in the first place.
Enquiry messages live inside WhatsApp, where transport is end to end encrypted between you and us. No system is perfectly secure, and we cannot guarantee the security of information while it travels across the internet.
12Children
This website is meant for adults evaluating professional software work. We do not knowingly collect personal data from anyone under eighteen. If you believe a child has sent us information, tell us and we will delete it.
13Changes to this policy
If this policy changes, the effective date at the top of the page changes with it. Material changes, meaning anything that alters what we collect or who we share it with, will be flagged on the homepage as well. Continuing to use the site after an update means you accept the revised policy.
See also our Terms and Conditions, which cover the services themselves and the important risk disclosures around trading.
Back to quantnifty.com