Privacy Policy

Last updated: March 2026

1. Information We Collect

We collect account information (email, hashed password, preferences), financial data you input (transactions, holdings, dividends, watchlists), payment metadata via Stripe (customer ID and subscription status — we never see your credit card numbers), usage data (feature counts, page views), and device information (timezone, locale, IP address for anti-abuse).

2. How We Use Your Information

We use your information to provide and operate the Service, enforce subscription tier limits and quotas, detect and prevent abuse, send billing notifications, and improve the Service based on usage patterns.

3. Data Storage and Security

All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Row-Level Security (RLS) ensures complete data isolation between users. Device fingerprints are stored as irreversible SHA-256 hashes.

4. Data Sharing

We do NOT sell your personal data. We share data only with Stripe (payment processing), Google Gemini API (AI features, when invoked), and email providers (billing and notification emails).

Stripe uses your billing address, tax ID (where provided), and transaction history to calculate and remit applicable sales tax, VAT, GST, HST, or QST under Stripe Tax. Stripe acts as our tax processor for invoice issuance and tax remittance in jurisdictions where we are registered. See Stripe's privacy policy (https://stripe.com/privacy) for details on Stripe's own data handling.

5. Data Retention

Account data is retained while active and deleted within 30 days of account deletion. Payment history is retained for 7 years (tax requirements). Abuse detection signals are retained for 180 days. Usage data is retained for the current billing period plus 12 months.

6. Your Rights

You may request a complete data export at any time. You may update your information through the Settings page. You may request permanent account deletion with a 30-day cooling-off period. You may opt out of marketing emails and AI features.

7. Cookies and Local Storage

We use browser localStorage for authentication tokens, UI preferences, and nudge cooldowns. We do NOT use third-party tracking cookies.

8. Children

The Service is not intended for individuals under 18 years of age.

9. Changes to This Policy

We will notify you of material changes via email and in-app notification.

10. Contact

For privacy inquiries or data deletion requests, visit Settings > Billing > Need Help?