Privacy Policy

Last updated: July 30, 2026

1. What We Collect

• Account information: email address, and either a password hash (with salt) or a Google account ID if you sign in with Google.
• Subscription information: Stripe customer ID, subscription status, and billing period end date. We never see or store your credit card number. All payment data is handled directly by Stripe.
• Usage data: watchlist selections, page visits, and audit logs of account actions.
• Server logs: IP address, browser type, and request timestamps, retained for up to 90 days for security and debugging.

2. How We Use Data

• Deliver the Service (authenticate you, gate paywalled content, deliver the morning digest).
• Process subscription payments via Stripe.
• Send transactional emails (receipts, account notices, morning digest for subscribers).
• Improve the Service, measure ad campaign performance, and detect abuse.

3. Who We Share Data With

We share only what's necessary with these processors:

• Stripe (payments) — email, name, billing details
• Railway (hosting) — all data at rest and in transit
• Supabase (database) — all application data
• Google (only if you sign in with Google) — basic profile
• Google Workspace / Gmail (email delivery for the daily digest and transactional emails) — email address and message content
• PostHog (product analytics) — page views, feature usage, and session recordings, used to understand how the Service is used and improve it
• X (Twitter) Ads and TikTok Ads (advertising conversion tracking) — a hashed version of your email and an advertising event (e.g. signup, subscription) so we can measure the effectiveness of ad campaigns; this does not include your password or payment details

We do not sell, rent, or trade personal data to data brokers.

4. Cookies and Local Storage

We use a session token stored in your browser to keep you logged in. We also use analytics and advertising cookies/pixels (PostHog, X Ads, TikTok Pixel) to measure product usage and ad performance, as described in Section 3. You can opt out of non-essential tracking in most browsers via cookie/privacy settings.

5. Data Retention

We keep account data for as long as your account is active. If you delete your account, we remove personal data within 30 days, except where retention is required for legal, tax, or fraud-prevention reasons (typically Stripe transaction records for up to 7 years).

6. Your Rights

You can access, correct, or delete your account data at any time by emailing support@stockcatalysts.ai. If you are in the EU/UK, you have additional rights under GDPR (data portability, objection to processing). If you are in California, you have rights under CCPA. We honor these requests within 30 days.

7. Security

Passwords are stored as salted hashes. Traffic is served over HTTPS. Payment processing is delegated to Stripe (PCI DSS Level 1). No system is perfectly secure; if you suspect unauthorized access to your account, email us immediately.

8. Children

The Service is not directed to children under 13. We do not knowingly collect data from children.

9. Changes

We may update this policy. Material changes will be announced by email.

10. Contact

support@stockcatalysts.ai