Privacy Policy

Short version: no email is required to sign up, there are no advertising or analytics trackers on this site, and nothing here is sold or handed to data brokers. What is stored is what the tool needs in order to be your tool.

01What is collected

• Your account — the username you choose and your password. The password is never stored in readable form; only a PBKDF2-SHA256 hash of it (200,000 iterations) is kept.
• Your session — an HTTP-only cookie holding a random session token, with a rolling 30-day expiry. This is the only cookie the site sets. There are no advertising, analytics or cross-site tracking cookies.
• Your work in the tool — saved scans, alert rules, watchlists, display settings and in-app messages, stored against your account so they follow you between devices.
• Broker keys, only if you connect one — Alpaca API keys are validated and then stored encrypted. The secret is not written to logs.
• A Telegram link, only if you create one — if you bind the coach bot to your account, the Telegram chat identifier is stored so alerts can reach you.
• Server logs — ordinary web-server records (IP address, request path, timestamp) kept for security and debugging.

No email address, phone number, real name, address or payment details are requested or stored.

02Who else sees anything

• Alpaca Markets — only if you connect a broker account. Orders and account queries go to Alpaca under your own keys.
• Market-data providers — the server requests price data by ticker. Those requests are made by the server and are not tied to your identity.
• Telegram — only if you link the coach bot, and then only for the messages sent to you.
• Anthropic — if you use the conversational coach, your message and the relevant market context are sent to Anthropic's API to generate the reply.
• Google Fonts — pages load typefaces from Google's font servers, so Google sees your IP address when a page loads.
• The hosting provider — the server runs on DigitalOcean.

Your data is not sold, rented, or shared with advertisers or data brokers. It may be disclosed if the law actually requires it.

03Where it lives and how it is protected

Account data sits in a SQLite database on a single server. Traffic is served over HTTPS. Passwords are hashed, broker secrets are encrypted at rest, and session cookies are HTTP-only. That said, no system is perfectly secure, and a one-person operation is not a bank — do not store anything here you could not stand to lose control of.

04How long it is kept

Account data is kept while the account exists. Saved scan history is a rolling buffer: beyond the most recent 30 unpinned scans per account, older entries are dropped automatically. Pinned scans are kept until you delete them. When an account is deleted, the rows attached to it are deleted with it.

05Your choices

• Use the tool without connecting a broker and without linking Telegram — both are optional.
• Unlink Telegram at any time from settings.
• Change your password at any time from settings.
• Ask for your account and its data to be deleted.

06Children

This service is not intended for anyone under 18, and accounts should not be created for them.

07Changes and contact

This policy may change; the date at the top changes with it. A published contact address is not yet in place — until one is, privacy and deletion requests should go through whichever channel you already use to reach the operator.