Cookie Policy

1. HTTP Cookies

A cookie is a compact alphanumeric data file placed on your computer, tablet, or mobile device by a web server when you access a website. Cookies allow web applications to maintain stateful user sessions, authenticate secure API requests, remember language preferences, and gather diagnostic telemetry. Cookies may be "session cookies" (which are automatically erased from your device memory when you terminate your active browser session) or "persistent cookies" (which remain stored on your local drive until they reach an explicit expiration timestamp or are manually deleted).

2. First-Party vs. Third-Party Cookies

First-party cookies are set directly by the domain you are visiting (forexmasters.in) and can only be accessed by our infrastructure. Third-party cookies originate from an external domain or vetted sub-processor integrated into our platform (such as our payment gateway or edge network security shield) to facilitate specialized services.

3. HTML5 Local Storage & Session Storage

Key-value storage mechanisms embedded natively within modern web browsers. Unlike cookies, data stored within Local Storage does not transmit automatically with every outbound HTTP request, significantly improving network efficiency and client-side application performance. We utilize Local Storage for preserving client-side UI themes, caching macroeconomic news for offline reading, and persisting lesson progress queues.

4. IndexedDB & WebAssembly (WASM) Local Cache

High-performance, structured, client-side transactional databases utilized by our local replication layer (PowerSync) to execute client-side queries, render offline candlestick visualizers, and cache syllabus state with sub-millisecond read latency.

5. Service Workers & Cache Storage

Background worker scripts that intercept network requests to enable offline platform resiliency, caching static UI assets, stylesheet bundles, and institutional video player shells.

These tokens are technically indispensable for the basic operation, cryptographic security, and authentication of the Platform. They enable you to authenticate into your student terminal, execute authenticated server actions, satisfy anti-bot challenges, and maintain secure sessions. Because the Platform cannot function without these tokens, they are exempt from statutory opt-in requirements under Article 5(3) of the EU ePrivacy Directive and cannot be disabled without terminating platform functionality.

These storage keys allow our user interface to remember configuration decisions and choices you make across sessions—such as your selected interface language, light or dark visual theme, collapsed sidebar state, and offline content cache. Disabling these keys will not break core security, but will degrade your user experience by resetting your preferences on every page reload.

These tokens collect anonymized, aggregated telemetry concerning how users navigate through curriculum modules, page load velocities, edge rendering latencies, and client-side runtime errors. We utilize this diagnostic telemetry strictly to identify platform bottlenecks, optimize video stream playback, and debug application crashes. Telemetry collected via these tools is stripped of personally identifiable identifiers and IP addresses are masked at ingestion.

These 1st-party cookies capture inbound traffic sources, campaign identifiers (UTMs), and referrals originating from search engines, community links, or AI answer engines (including ChatGPT, Perplexity, and Claude). This telemetry is utilized exclusively to measure the educational reach of our public research briefs and optimize platform discovery.

1. Local Resolution & Instant Enforcement

When you configure your consent preference on any public page via our cookie banner, your decision is immediately persisted to a local first-party consent cookie and browser Local Storage.

2. Authenticated Profile Synchronization

If you are authenticated into your student account (or upon subsequently signing in), our client execution runtime automatically synchronizes your consent choice ("accepted" or "declined") and the UTC timestamp of consent directly into your cryptographically protected account profile.

3. Cross-Device Zero-Banner Experience

When you access the Platform from a secondary device (such as your mobile smartphone, tablet, or workstation laptop), our session bootstrap runtime queries your account profile. If an established consent choice is detected, the platform automatically applies your preferences to that local browser instance and suppresses the cookie notification banner entirely.

4. Permanent Preference Revocation

You may update or toggle your consent status at any time within your Account Security Settings. Any modification is immediately synchronized across your registered session devices.

European Union (GDPR & ePrivacy Directive)

Processing of Strictly Necessary tokens is based on Article 6(1)(f) of the General Data Protection Regulation (GDPR - Legitimate Interests for delivering requested digital services and ensuring network security) and Article 5(3) of the ePrivacy Directive (technical necessity exception). Processing of Functional, Performance, and Attribution tokens is based strictly on your freely given, specific, informed, and unambiguous Consent pursuant to Article 6(1)(a) of the GDPR and Article 5(3) of the ePrivacy Directive. You have the absolute statutory right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

United Kingdom (UK GDPR & PECR)

Processing adheres to the UK Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR) under equivalent legal bases and ICO guidelines.

India (Digital Personal Data Protection Act, 2023 & IT Rules 2011)

Processing of device telemetry is conducted for specified educational purposes with notice and consent, or under Section 7 of the DPDP Act (Certain Legitimate Uses) for operating cybersecurity defenses, mitigating unauthorized terminal intrusions, and maintaining technical infrastructure reliability.

California (CCPA & CPRA)

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, we disclose the categories of internet and network activity collected via automated mechanisms. We affirmatively certify that Forex Masters does not "sell" your personal information, nor do we "share" personal information for cross-context behavioral advertising. You have the right to know, access, and delete data collected via automated mechanisms, free from discriminatory treatment.

1. In-Platform Consent Controls

You may adjust or revoke your cookie choices at any time by navigating to your Account Settings under the "Privacy & Security" tab. Modifying your choice to "declined" immediately disables the deployment of non-essential performance and attribution cookies.

2. Universal Opt-Out Signals (Global Privacy Control & DNT)

The Platform actively monitors for and honors the Global Privacy Control (Sec-GPC: 1) browser signal. If your browser transmits a valid GPC signal, our client runtime automatically interprets this as an instruction to disable all non-essential telemetry and attribution storage. While industry consensus on "Do Not Track" (DNT: 1) remains fragmented, we treat active DNT signals with the same high-standard suppression of non-essential analytics.

3. Browser-Level Configuration & Storage Purging

All modern desktop and mobile browsers provide controls to view, block, or purge stored cookies and local data. Please consult your browser's documentation:

4. Consequences of Disabling Technical Cookies

Please note that if you configure your browser to reject all cookies (including Strictly Necessary cookies), you will be unable to authenticate into your student terminal, execute order simulations, complete financial checkout transactions, or access encrypted course materials.

Supabase Inc. (Stateless Authentication & Database Replication)

Provides cryptographically signed JWT user session management and real-time database synchronisation for the student workspace.

Cloudflare Inc. (Edge Security & Content Delivery)

Operates reverse proxy caching, DDoS mitigation, and Turnstile bot defense tokens to safeguard platform availability against automated attacks.

PostHog Inc. (Product Performance & Analytics)

Delivers privacy-focused product usage analytics. Client IP addresses are masked at ingestion, and all telemetry is restricted to first-party domain scopes without third-party ad linkage.

Functional Software, Inc. / Sentry (Error Telemetry)

Captures real-time client-side JavaScript runtime exceptions. Operates strictly in-memory with aggressive PII data scrubbing filters applied prior to transmission.

Razorpay Software Private Limited (Payment Gateway & Billing Infrastructure)

Processes subscription transactions and card tokenization under PCI-DSS Level 1 certification. Sets anti-fraud session cookies within isolated payment frames.