Privacy Policy

• Account data. Your name, email address, and sign-in method. If you use email/password, we store only a cryptographic hash of your password — never the password itself. If you sign in with Google or Apple, we receive your name and email from that provider.
• Billing data. Payments are processed by Stripe. We store your subscription status, plan, and Stripe customer reference. Your full card number never touches our servers.
• Sign-in security data. For the Recent Logins feature on your Account page, we record the time, sign-in method, approximate location, IP address, and browser of each sign-in — so you can spot access you don't recognize.
• Your activity on the service. Watchlist entries, report views, and support requests you submit through the Contact form.
• Usage analytics. We use privacy-focused, cookie-less analytics (Umami) to understand aggregate page traffic. It does not build cross-site profiles of you.

• To provide the service: authentication, membership gating, watchlists, and reports.
• To bill you correctly and manage renewals, upgrades, and cancellations via Stripe.
• To secure your account — including single-session enforcement and the Recent Logins history.
• To send transactional email: verification links, password resets, watchlist/value alerts you opt into, and billing receipts.
• To respond to support requests and improve the service using aggregate usage patterns.

We do not sell or rent your personal data, and we do not use it for third-party advertising.

We use a small number of strictly necessary cookies: a session cookie that keeps you signed in, and security tokens that protect forms from abuse (Cloudflare Turnstile). Our analytics is cookie-less. We do not use advertising or cross-site tracking cookies.

We share data only with the processors needed to run the service:

• Stripe — payment processing and subscription billing.
• Google / Apple — only if you choose them for sign-in.
• Resend — delivery of transactional emails.
• Cloudflare Turnstile — bot protection on sign-up and forms.
• Hosting and database providers — to run the platform's infrastructure.

Each processor receives only what it needs for its function. We may also disclose data if required by law or to protect the rights and safety of our users and service.

We keep account data while your account is active. Login history is kept for a limited period for security purposes. Password reset and email verification tokens are single-use, stored hashed, and expire automatically. Data is encrypted in transit, and passwords are stored using industry-standard hashing.

• Access and correction. You can view and update your name and email on your Account page.
• Deletion. You can request deletion of your account and associated personal data via the Contact page; we will action it within 30 days, subject to records we must keep (for example, billing records required for tax purposes).
• Email preferences. Alert emails are opt-in and can be turned off; transactional emails (receipts, security notices) are sent only as needed.
• Portability and objection. Depending on where you live (for example under GDPR or CCPA), you may have additional rights — including data portability and the right to object to certain processing. Contact us to exercise them.

The service is not directed at children and paid memberships require you to be an adult. We do not knowingly collect personal data from children under 16; if you believe a child has provided us data, contact us and we will delete it.

We will update this policy as the service evolves. Material changes will be announced by email or an in-app notice before they take effect, and the effective date above will always reflect the current version.

For privacy questions or requests, reach us through the Contact page. See also our Terms of Service.