Privacy
What we store
If you create an account, we keep:
- Username (your choice, public)
- Password hash — Argon2id, the plaintext is never stored or readable by us
- Account creation + last-seen timestamps
- Your watchlist — the tickers you've saved
- Your sentiment votes — which tickers you've voted bull/bear on
- Your alert rules + preferences — price thresholds, digest hour, insider-buy threshold
- Your Telegram chat ID — only if you choose to bind a Telegram account for alerts
- Recent alerts sent to you — for deduplication and rate limiting
What we don't store
- No email address (we don't ask for one)
- No real name, phone number, or any other identifying field
- No IP address attached to your account (login attempts log IPs for lockout protection; deleted after 15 minutes)
- No analytics tracking, no cookies set by third parties, no Google Analytics, no Facebook Pixel
- No device fingerprinting
- No selling, sharing, or licensing of any user data to anyone, ever
What's public on your account
- Your username appears in the aggregate sentiment score as one anonymous vote — never tied to your name in the UI
- Your watchlist is private by default. Future watchlist-sharing (when shipped) will be strictly opt-in.
Anonymous users
If you don't sign up:
- Your watchlist is stored locally in your browser cookies — never sent to our server
- You can't vote on sentiment (sign-in required, to prevent vote manipulation)
- You can't receive Telegram alerts (sign-in required, to bind a chat)
Server logs
The web server (nginx) keeps access logs containing IP, timestamp, path, and user-agent for each request, rotated weekly and retained for 4 weeks. These logs are used for traffic statistics (aggregate counts only — never tied back to your account) and are not shared. Logs are deleted after rotation.
Deleting your account
Open /profile, scroll to "Delete account", type your username, and click delete. This immediately purges your user record, watchlist, votes, alert rules, and history. No grace period, no undo, no backup retention of deleted accounts. If you also want your Telegram chat unbound, just delete the account — that disconnects everything.
Forgotten passwords
Since we don't collect emails, there's no password-reset flow. If you forget your password, create a new account with a different username. We can't help recover the old one — by design.
Contact
Found a privacy issue? Use the F9 Feedback form. We'll respond directly.