Privacy Policy

1. Data we store

For each account we keep:

• your email address (used to sign in and for essential account messages);
• a salted hash of your password — never the password itself;
• when the account was created;
• your subscription plan and status (free or premium, renewal date);
• a Stripe customer ID and subscription ID, plus whether the subscription is set to renew or cancel at the period end, if you have ever subscribed.

If you email us, we keep that correspondence so we can reply and follow up. We don't ask for your name or address, we don't build advertising profiles, and we never sell or rent your data.

2. Service providers we use

We rely on a few trusted providers to run the service. They process only the limited data described below, on our behalf, under their own privacy terms:

• Cloudflare — serves and protects the site (CDN, DNS, security). It processes network data such as your IP address and request metadata to deliver pages and block abuse.
• Stripe — processes payments and subscriptions (see the next section).
• Resend — delivers our transactional emails (such as password-reset links). To send you an email, your email address is shared with Resend for that purpose.

The servers that run the site are hosted in the EU.

3. Payments (what Stripe handles)

All payments are processed by Stripe. When you subscribe, your card number goes directly from your browser to Stripe — it never touches our servers, and we cannot see it. Stripe tells us only what we need to run your subscription: a customer ID, the subscription status and the current period end. Stripe processes your payment data under its own privacy policy.

4. Cookies and local storage

We set exactly one cookie: an httpOnly session cookie that keeps you signed in. It is not readable by JavaScript and is not used for tracking. If you switch between dark and light mode, that preference is saved in your browser's local storage — it never leaves your device. There are no third-party trackers, no advertising pixels and no cross-site analytics on this site.

5. Analytics

We measure how the site is used ourselves, on our own server, without cookies and without third parties — and we store only aggregate numbers, never individual profiles. That covers: how many times each page was viewed per day; an approximate daily visitor count derived from a salted hash that rotates every day (so it cannot identify you, be reversed to your IP address, or link your visits across days); which external sites referred visitors; how long pages stay visible on screen; anonymous session shapes (which page a visit started and ended on, counted under a random per-tab id that is discarded when you close the tab and is never connected to your account); which dashboard features get used; and search terms typed into the stock screener, sanitized and aggregated. What you type anywhere else — sign-in forms, passwords, email addresses — is never recorded. If your browser sends the Do Not Track signal, none of this is collected at all.

6. Why we process your data (legal bases)

Where EEA/UK data-protection law applies, we rely on: performance of a contract (to create your account and provide the service and any subscription you buy); our legitimate interests (to keep the service secure and to understand, in aggregate, how it is used); legal obligations (for example, retaining billing records for tax and accounting); and your consent where we specifically ask for it.

7. International transfers

Our servers are in the EU. Some providers above (for example Stripe) may process data outside the EEA; any such transfer relies on the data-transfer safeguards those providers maintain, such as the EU Standard Contractual Clauses, or on an adequacy decision.

8. Your rights

Subject to applicable law, you have the right to access the personal data we hold about you, correct it if it's wrong, delete it, restrict or object to how we process it, receive it in a portable format, and withdraw any consent you've given. To exercise any of these, email [email protected] from your account address and we'll action it. You also have the right to lodge a complaint with your local data-protection authority.

9. Children

The service is intended for adults and is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, contact us and we will delete it.

10. Security

We take reasonable measures to protect your data — encrypted connections (HTTPS), passwords stored only as salted hashes, access controls, and off-site encrypted backups. No method of transmission or storage is ever 100% secure, however, and we cannot guarantee absolute security.

11. Data retention and deletion

We keep your account data for as long as your account exists. If you want your account deleted, email us from the address on the account and we will remove it, including your email and password hash. Billing records held by Stripe may be retained longer where tax and accounting rules require it.

12. Changes to this policy

We may update this policy from time to time. If a change is material, we will note it on this page and, where appropriate, tell you by email. The "last updated" date above always reflects the current version.

13. Contact

Questions about your data? Email us at [email protected].