STOCKGAINESHow it worksHow we testSecurityContactSign in

Draft for legal review, version 2026-09-26. A lawyer reviews these pages before anyone but the owner signs in.

Privacy notice

Version 2026-09-26

What we hold

  • Your email address, how you sign in (an email link, Google, or a password you add), and a salted scrypt hash of that password; never the password itself.
  • What you put in: holdings, accounts, your investor profile, watchlist, delivery and spend settings, and your conversations with Ask the Terminal.
  • Your API keys and connection tokens, encrypted with AES-256-GCM under a key that belongs to your account alone. Only the last four characters are ever shown back, and keys never reach the AI models.
  • Market data fetched with your keys, and the analysis the terminal builds from it.
  • An audit log of changes made to your account, and your AI spend records.

How we use it

Only to run the service for you: to build your terminal, answer your questions, send the emails you asked for, keep your account secure and fix errors. We do not sell your data, show you advertising, or use your data to train AI models. Each account is walled off at the database; tests check every route across two accounts.

Who processes it for us

  • Vercel: hosts the web app and the analysis engine.
  • Neon (Postgres): stores your sign-in account (email address, and a password hash if you add a password), your settings, portfolio records, conversations and encrypted keys.
  • MotherDuck: stores the market data fetched with your keys, in a database of your own.
  • Resend: sends your sign-in links, and your daily brief and alerts when you turn email on.
  • Sentry: receives error reports, with request bodies, cookies and anything shaped like a key removed first.
  • Anthropic: runs the AI models on your own API key; your questions and the data the terminal sends with them go to Anthropic under your account.
  • Your market-data providers (Alpaca, FMP, Finnhub): answer requests made with your own keys.
  • SnapTrade, Google, Slack: only if you use them: Google can sign you in, and when connected they read your brokerage positions, read the one sheet you pick, or receive your brief.

Cookies

The service sets only the cookies sign-in needs, and a short-lived one while you connect a service. There are no advertising or analytics trackers.

Your choices

You can change or remove your keys, connections and settings at any time in Settings, and turn emails off. You can download a copy of your data or delete your account yourself in Settings, Data and privacy, or ask for either by replying to your invite email; deleting removes your records, your keys and your market database.

Questions about these terms or your data: write to us on the contact page.