Privacy Policy

1. Information we collect

• Account: email address, password (stored only as a bcrypt hash — never in plaintext)
• Uploaded data: portfolio/transaction details from the CSV you upload (symbols, shares, average cost, etc.)
• Usage logs: AI request counts, timestamps, IP address (for rate limiting / abuse prevention), and contact-form input (name, email, message)
• Payments (if you subscribe): handled by Stripe; we do not store card numbers (only a Stripe customer ID).
• Mobile app (iOS): only if you enable push notifications, we store your device push token to send price/verdict change alerts. Disabling notifications removes the token.
• We do NOT collect Social Security numbers, driver's license numbers, biometric data, precise geolocation, or information about race, religion, health, or sexual orientation.

2. Categories of personal information (CCPA/CPRA)

In the last 12 months we have collected the following statutory categories of California consumers' personal information:

• Identifiers: email, user ID, IP address
• Commercial information: subscription status/plan, Stripe customer ID
• Internet/network activity: request logs, feature usage
• Financial information (sensitive): the portfolio data you upload — holdings, shares, average cost
• We do not 'sell' or 'share' (for cross-context behavioral advertising) any of the above.

3. Sources of information

• Directly from you (sign-up, CSV upload, contact form)
• Automatically as you use the Service (logs, usage, IP)
• Subscription status from our payment processor (Stripe)

4. How we use it (business purposes)

• To provide the Service (login, portfolio display/analysis, AI features)
• To protect against cost overruns and abuse (quotas, rate limiting, security)
• To respond to inquiries, send service/transactional messages, and improve the Service
• To comply with legal obligations and protect legal rights

5. Disclosure to third parties (processors)

We do not sell your personal information or share it for advertising. We disclose it only to the following service providers (processors), and only as needed to run the Service:

• Data providers (IEX (Databento), SEC EDGAR): lookup parameters such as a ticker may be sent
• Anthropic (AI): your question text and stock/filing summaries are sent to generate Q&A and analysis. Additionally, if you upload a CSV that isn't in a recognized format, the contents of that file may be sent to Anthropic to extract your holdings (only if you have consented to this AI processing).
• Stripe (payments): to process subscription billing
• Hosting / database providers: to store data and operate the Service
• We may also disclose information where required by law (e.g., subpoena) or to protect rights and safety.

6. We do not sell or share your personal information

We do not sell your personal information (including sensitive personal information) or share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA, and we have not done so in the prior 12 months. We also do not sell or share the information of users we know to be under 16.

7. Sensitive personal information

Financial-account-related information in your uploaded portfolio may be 'sensitive personal information.' We use it solely to provide the Service (display and analysis) and never to infer characteristics about you. Because of this, exercising the CPRA 'right to limit' would not change how we use it — but you may delete that data at any time.

8. Retention & deletion

We retain each category only as long as needed for the purpose it was collected. Generally, account information, uploaded portfolio data, and usage records are kept while your account is active and are removed immediately on account deletion (except where retention is legally required). Payment records may be retained separately by Stripe and for tax/accounting purposes for the period required by law.

9. Your privacy rights (CCPA/CPRA and others)

Depending on where you live, you may have the right to:

• Know / access: the categories and specific pieces of personal information we have collected, used, and disclosed
• Delete: request deletion of the personal information we hold about you
• Correct: request correction of inaccurate personal information
• Opt out of sale/sharing: not applicable, because we do not sell or share
• Limit use of sensitive personal information: see section 7
• Non-discrimination: we will not discriminate or retaliate against you for exercising these rights

10. How to exercise your rights

Delete: log in and go to Account (your email) → Delete account (password required); your account, portfolio, and usage records are removed immediately. For access (export), correction, or other requests, contact us at the address below. We verify identity (e.g., by matching your registered email) and respond free of charge within 45 days of receipt (extendable by another 45 days with notice). You may use an authorized agent, in which case we may require proof of authorization. If we decline a request, we will explain why, and you may appeal.

11. California 'Shine the Light'

We do not share personal information with third parties for their own direct-marketing purposes, so no separate disclosure is required under California Civil Code §1798.83.

12. Security

Passwords are stored as bcrypt hashes; session and auth tokens are stored as one-way hashes (SHA-256); your uploaded portfolio holdings are encrypted at rest (AES-256-GCM); sessions use httpOnly cookies; and HTTPS is used in production. We also do not retain the raw files you upload (e.g., brokerage statements) — we extract your holdings and store only that normalized data. However, no method of transmission or storage is 100% secure.

13. Children

The Service is not directed to anyone under 18, and we do not knowingly collect children's personal information. We do not sell or share the information of users known to be under 16.

14. Users outside the US · changes

The Service is intended for users in the United States, and data may be processed and stored in the US. We may update this policy and will revise the 'Last updated' date on this page when we do.

15. Contact

Privacy contact: jihwanmoon1999@gmail.com