Privacy Policy

Effective Date: May 1, 2026

1. Information We Collect

Account information: email address, name (if provided via Google OAuth), profile photo (if provided via Google OAuth), and password (hashed and encrypted — never stored in plain text). Usage data: stock tickers analyzed, analysis history, watchlist contents, feature usage patterns, and login timestamps. Payment information: payment processing is handled by Stripe — we do not store full credit card numbers; we retain subscription plan, Stripe customer ID, and billing history. Automatically collected: browser type, device type, IP address, pages visited, time spent, and referral source. Analytics: we use Microsoft Clarity for anonymized usage analytics, which may include session recordings and heatmaps.

2. How We Use Your Information

We use collected information to: provide and operate the Service; process subscription payments; send transactional emails (receipts, password resets, plan changes); send product updates and feature announcements (you may opt out); improve the Service based on usage patterns; detect and prevent fraud or abuse; comply with legal obligations; and respond to support requests. We do NOT sell your personal data to third parties, share your data with advertisers, or use your stock analysis history to trade for our own account.

3. Data Sharing

We share data only with: Supabase (database and authentication), Stripe (payment processing), Anthropic (AI analysis — your ticker queries are sent to Claude API; Anthropic's data retention policies apply), Finnhub and Yahoo Finance (market data providers — tickers queried on your behalf), Vercel (hosting and infrastructure), Microsoft Clarity (anonymized analytics), Resend (transactional email delivery), and law enforcement or government agencies when required by law.

4. Data Retention

Account data is retained as long as your account is active. Analysis cache is retained for 90 days, then automatically deleted. Payment records are retained for 7 years for legal and tax compliance. Deleted accounts: most personal data is deleted within 30 days; some records may be retained for legal compliance.

5. Your Rights

Depending on your jurisdiction, you may have the right to: access the personal data we hold about you; correct inaccurate personal data; request deletion of your personal data; object to or restrict processing of your data; data portability (receive your data in a structured format); and withdraw consent at any time. To exercise these rights, email [email protected].

6. Cookies

We use cookies and similar technologies for: session management (keeping you logged in via Supabase auth tokens), analytics (Microsoft Clarity — 1-year cookie), payment processing (Stripe), and local preferences (theme, recent analyses — stored in your browser's localStorage). You can control cookies through your browser settings. Disabling authentication cookies will prevent you from logging in.

7. Security

We implement commercially reasonable security measures including HTTPS encryption for all data in transit, hashed and salted passwords, row-level security in Supabase, and regular security reviews. No system is completely secure. We cannot guarantee absolute security of your data.

8. Children's Privacy

The Service is not directed to or intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that a minor has created an account, we will delete it promptly. If you believe a child has provided us personal information, contact us immediately at [email protected].

9. Changes to This Policy

We will notify you of material changes to this Privacy Policy via email or in-app notification at least 30 days in advance. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

10. Contact

For privacy-related questions or to exercise your data rights: [email protected] · apexstockintel.com/contact