Privacy
Last updated 2026-09-03
The short version: we hold your email, what you choose to save, and what you ask the AI. There is no password to leak because there is no password. We do not sell anything to anyone.
What we collect
- Your email address — the account. Sign-in is a one-time link, so we never hold a password of yours.
- What you save — watchlist, imported holdings, and your preferences.
- What you ask — the questions you put to the AI, so they can be answered and so we can meter cost.
- Usage counters — request counts and model spend against your account, to enforce limits. Rate limiting falls back to IP address when you are signed out.
What we deliberately do not keep
Imported files are read in memory and discarded. A brokerage export carries account numbers and balances, and only the holdings you confirm are ever written — never the file, not to storage, not to logs. We do not run advertising or third-party analytics trackers, and we do not sell or rent personal data.
Your data never joins anyone else’s answer
Answers are cached and shared between users to make them affordable. Anything personal — your holdings, your watchlist, your history — is kept in a per-user space that the shared cache cannot read, and is never written into a prompt that another user’s answer is built from. That separation is enforced in the code rather than by convention.
Who else processes it
| Service | Purpose | What it sees |
|---|---|---|
| Vercel | Hosting | IP address and request metadata |
| Neon | Database | Your account, watchlist and holdings |
| Upstash | Cache and rate limiting | Quotes and per-identity counters |
| Resend | Sign-in emails | Your email address |
| Stripe | Payments | Your email and payment details, held by Stripe |
| Inngest | Scheduled jobs | No personal data |
| Z.ai (GLM) | AI answers | Your question and the market data it is answered from |
| Anthropic | AI answers (failover) | Your question and the market data it is answered from |
Payment card details go to Stripe and are never seen by or stored on this site. Questions you ask the AI are sent to the model provider to be answered.
Where the market data comes from
- SEC EDGAR — Company filings and fundamentals. Public record.
- US House Clerk — Congressional Periodic Transaction Reports. Public record.
- Office of Government Ethics — Executive-branch Form 278-T filings. Public record.
- iShares — Published ETF holdings, used for index membership.
These are sources of information about companies and public officials, not about you. Nothing about your account is sent to them.
How long we keep it
Account data lives until you delete the account. Cached quotes expire in seconds and usage counters in a day or two. Ask us to delete your account and everything tied to it goes with it — watchlist, holdings and preferences are removed by database cascade, not by a cleanup job that might not run.
Your rights
Ask for a copy of your data, a correction, or deletion, and we will do it. Depending on where you live you may also have the right to object to processing or to complain to a regulator. Write to [email protected]. There is no self-service delete button yet; until there is, email is the way, and we would rather say that than imply a button exists.
Cookies
One cookie, holding your sign-in session. It is not used for tracking or advertising, and there is no consent banner because there is nothing to consent to beyond keeping you signed in.
Contact
[email protected] · Berlin, Germany · Terms of Service
This notice describes what the software actually does, checked against the code. It has not been reviewed by a lawyer, and it does not yet name a legal entity or a governing jurisdiction — set LEGAL_ENTITY and LEGAL_JURISDICTION, and have it reviewed, before relying on it under GDPR or CCPA.