Privacy Policy

1. Who is responsible

The controller of any personal data processed in connection with Tickertail is [operator entity: to be completed at incorporation; see the imprint in the Terms of Service].

2. The short version

• Accounts are optional. You can read every filing without signing up; one view, the stocks trail, asks you to sign in. An account is your email address plus whatever you choose to add to it (a display name, a timezone, saved follows) - you sign in with a one-time emailed link or your Google account (section 3), and no Tickertail password ever exists to steal.
• No tracking cookies. Signing in sets the strictly necessary session cookies that sign-in requires; the site sets no other cookies. Traffic is measured with a cookieless counter.
• Your watchlist stays in your browser unless you move it. Personalization (watchlists, reading preferences) lives in your browser's local storage and is not transmitted to us. The one exception is always your explicit choice: signed-in readers can save follows and desk tickers to their account so they sync across devices (section 3).
• No sale of personal data. We do not sell or share personal data for advertising, and never will.
• One honest caveat: the site's fonts load from Google, which means your IP address reaches Google's servers. Details in section 3.

3. What we collect today

Server logs. The site is served by our hosting provider (Vercel). Like every web server, it keeps standard access logs: IP address, browser user agent, requested page, and timestamp. We use these only for security and operations (spotting abuse and outages), and they are retained briefly by the provider, not compiled into profiles.

Aggregate traffic analytics. We measure page views and clicks on a handful of named buttons with Umami, a cookieless counter. It sets no cookies, stores no persistent identifier on your device, does not follow you across other sites, and honors your browser's Do Not Track setting. To tell visitors apart without identifying anyone, it works with a salted hash of technical request data that cannot be reversed and rotates regularly, so even that short-lived token expires on its own. What we see is aggregate: which pages are read, which buttons are clicked (the button's label, never anything you typed), roughly from which country and city, on what kinds of devices; never a profile of you.

Error reports. When something on a page breaks while you read it, a short error report goes to Sentry (section 5) so we can find and fix the fault: what went wrong and where in our code, the address of the page with anything after a question mark removed, and the type of browser and device. It carries nothing that identifies you: no name, email address, account, cookies or anything you typed, and Sentry is told not to record an IP address. Reports travel through our own domain. A visit with no error sends nothing, and does not even load Sentry's code.

Fonts, and the IP address that comes with them. The site's typefaces currently load from Google Fonts. When your browser requests a font file, your IP address necessarily reaches Google's servers (which may be outside your country, including in the United States). Google states that its Fonts service does not use that data for profiling or advertising, but we name the transfer here because, for a reader who does not sign in with Google, it is the one piece of your data that leaves our infrastructure today. We plan to self-host the fonts, at which point this section shrinks.

What stays on your device. Reading preferences and watchlists are stored in your browser's local storage by default. We receive them only when you are signed in and choose to save them to your account: following something while signed in, or accepting the one-time offer to copy this browser's saved follows. Local data is never uploaded silently, and clearing your browser data removes the local copies entirely.

Search stays on your device too. The search box remembers the last few members, companies and funds you opened from it, in your browser's local storage, so you can pick up where you left off. It never stores what you typed, and what you type is never sent to us: the whole index is downloaded to your browser and searched there. You can wipe the list at any time with "Clear recent searches" inside the search box itself.

Account data, only if you sign up. Creating an account stores your email address, sign-in timestamps, and your plan tier, in our database (hosted by Supabase; section 5). If you use them, it also stores your display name and timezone, and the follows and desk tickers you choose to save to the account. Sign-in works by one-time emailed link or through your Google account, so there is no password to store, and the only email your account itself triggers is the sign-in link you request. Three forms on the site collect personal information: the sign-in form (your email), the optional profile form in Settings (display name and timezone), and the newsletter form in the footer (your email).

Sign in with Google, only if you choose it. The "Continue with Google" button hands you to Google to confirm who you are. You approve the sharing on Google's own screen, and Google then sends us your name, your email address, whether Google has verified that address, a link to your profile picture, the identifier Google uses for your account, and, if your account belongs to an organization's Google Workspace, that organization's domain. We ask Google for nothing more: never your Google password, your contacts, your mail or your files, and we cannot post or act on your behalf. Our sign-in system (Supabase) keeps those details with your account record so it can recognize you next time; our own account table takes only the email address, and the site does not display your Google name or picture. If you already have an account under the same verified email address, signing in with Google joins onto that account rather than creating a second one. Google, for its part, learns that you signed in to Tickertail.

Newsletter, only if you subscribe. The form in the site footer stores the email address you type, and nothing else, with Resend (section 5). It is the newsletter list and it is used for nothing else: it is not linked to your account, it is not used to profile you, and it is never sold or shared. You are subscribed because you asked to be, so you can withdraw at any time using the unsubscribe link in any newsletter we send, which removes you from the list. Subscribing does not create an account, and having an account does not subscribe you.

That is the complete list. There is no payment data - and when subscriptions open, card details will go to the payment processor directly, never to us (section 11).

4. What we deliberately do not collect

• No brokerage anything. We never ask for brokerage credentials or account numbers, and we never connect to a brokerage. The desk list of tickers you can keep is optional and self-typed, and it stays in your browser unless you save it to your account (section 3); we never treat it as proof of what you own.
• No ad tech. No advertising trackers, no third-party marketing pixels, no data brokers.
• No sale or sharing. We do not sell personal data, and we do not "share" it for cross-context behavioral advertising as the California CCPA/CPRA defines that term.
• No profiling. We build no individual profiles and make no automated decisions about you.

5. Who processes data for us

Current processors and infrastructure:

• Vercel (USA): hosting and server logs. Transfers are covered by the EU-U.S. Data Privacy Framework and/or standard contractual clauses.
• Umami Software, Inc. (USA): runs the cookieless traffic analytics described in section 3. The counter's script is served from our own domain, but the measurement requests themselves go from your browser directly to Umami's servers in the United States and the European Union; like any web request they carry your IP address, which Umami does not store - it is used to work out an approximate location and to compute the short-lived salted hash above, then discarded. Our data processing agreement with Umami incorporates the EU standard contractual clauses.
• Sentry (Functional Software, Inc., USA): receives the error reports described in section 3, and nothing about a visit with no error. Reports carry nothing that identifies a reader, and Sentry is told not to record IP addresses. Transfers are covered by the EU-U.S. Data Privacy Framework and/or standard contractual clauses.
• Supabase: hosts the database of filings and prices the site is rendered from, and the account records described in section 3 (email, sign-in timestamps, plan tier, any profile details or saved follows you add, and the details Google shares if you sign in with Google) for readers who sign up. It also runs the sign-in itself, for the emailed link and for Google. Pages are rendered on the server, so your browser never connects to the database directly; during a Google sign-in it does pass through Supabase's sign-in address on the way to and from Google, which means Supabase receives your IP address for that step.
• Google Fonts (USA): font delivery; receives your IP address as described in section 3. Google operates the Fonts service as an independent controller rather than as our processor, and Google LLC is certified under the EU-U.S. Data Privacy Framework.
• Google (USA): Sign in with Google, for readers who choose it. Google confirms who you are and shares the details listed in section 3. For your Google account itself, Google acts as an independent controller under its own privacy policy, not as our processor, and Google LLC is certified under the EU-U.S. Data Privacy Framework. Readers who sign in with an emailed link send Google nothing through this route.
• Marketstack: supplies end-of-day market prices to our ingestion jobs. It receives no data about visitors.
• Resend (USA): holds the newsletter list described in section 3 - the email addresses of people who subscribed, and nothing else - and will deliver the newsletter itself. It receives no data about readers who have not subscribed. Our data processing agreement with Resend incorporates the EU standard contractual clauses.

Planned, not yet in use: a payment processor (Stripe) and messaging alerts (Telegram) are planned features. Neither of them processes anything today; each will be added to this policy before it goes live (section 11).

6. Cookies

Reading the site sets no cookies. Signing in to an account sets the strictly necessary session cookies that keep you signed in, and asking for a sign-in link sets one more, for fifteen minutes, holding the address we just emailed so the page can tell you where the link went. That one is httpOnly, so page scripts cannot read it. Choosing Google sets one more: a one-time code that proves the sign-in coming back from Google is the one you started, used once and for nothing else. Every one of them exists only to deliver the sign-in you asked for - the one purpose the law does not require a banner for, which is why there is none. Google's own sign-in screen is on Google's site, and any cookies it sets there are Google's, under Google's policy. Our standing commitment: only ever strictly necessary cookies plus cookieless analytics. If that ever changes, we will ask for consent before any non-essential cookie is set, not after.

7. Purposes and lawful bases (GDPR Art. 6)

• Serving the site and keeping it secure (server logs): legitimate interest, Art. 6(1)(f).
• Understanding aggregate readership (cookieless analytics): legitimate interest, Art. 6(1)(f).
• Font delivery (the Google Fonts request): legitimate interest in rendering the site as designed, Art. 6(1)(f), pending the planned self-hosting, which will remove this transfer entirely.
• Accounts and sign-in (the account data in section 3, including the details Google shares if you sign in with Google): contract, Art. 6(1)(b) - we process them because you asked for an account that works, and you chose how to sign in to it.
• Sending the newsletter (the email address you give the footer form): consent, Art. 6(1)(a) - you asked for it, and you can withdraw by unsubscribing.
• Future features (billing, alerts): contract, Art. 6(1)(b), and consent, Art. 6(1)(a), as each launches (section 11).

8. Retention

Server logs are retained briefly by the hosting provider on rolling windows measured in days to weeks, then deleted. Analytics data is aggregate and contains no personal identifiers to retain. Local storage data lives on your device until you clear it. Account data is kept while your account exists and deleted when the account is deleted - delete your account yourself in Settings (with a paid subscription active, cancel it first; deletion opens once the paid period ends), or ask via section 13 and it is done. A newsletter subscription is kept until you unsubscribe, which removes your address from the list. We hold no other personal data.

9. Your rights

Under the GDPR (and similar laws elsewhere) you have the right to access, rectify, and erase personal data concerning you, to restrict or object to its processing, to data portability, and to lodge a complaint with a supervisory authority in your country. California residents have the rights to know, delete, and correct, and to be free of discrimination for exercising them; we do not sell or share personal data, so there is nothing to opt out of.

In practice, exercising most of these rights against us is short work: apart from transient server logs and the account you may have created (email, sign-in timestamps, plan tier, any profile details or saved follows you added, and the details Google shared if you signed in with Google - all of which we can show you or erase on request), we hold no personal data about visitors. You can also remove Tickertail from the apps connected to your Google Account at any time, which withdraws the permission you gave (Google asks again if you use the button later); deleting your Tickertail account removes what Google shared with us. Contact details for requests are in section 13.

10. Children

Tickertail is not directed at children under 16. Accounts require you to be at least 18 (Terms, section 3), and we knowingly process no children's data.

11. When features launch

Accounts have launched: sections 3, 6 and 7 above cover exactly what they add (an email address, the sign-in cookies described in section 6, the profile details and follows you choose to save, and, if you use it, what Sign in with Google shares). Still ahead: subscriptions add a payment processor (Stripe, which will draw the card fields in its own frames and receive what you type into them directly, so that we never see a card number - our database will only mirror whether a subscription is active), and messaging alerts add the messaging identity you choose to connect. Before each launch, this policy will be updated, the dateline at the top will move, and material changes will be announced on the site.

12. Changes

When this policy changes, the dateline at the top moves; material changes are announced on the site before they take effect.

13. Contact

[a dedicated privacy contact (privacy@ on the production domain) will be published here once the mail domain is live; the controller's postal address will appear with the imprint in the Terms of Service]