Privacy policy

Last updated November 14, 2026

TradePact sends you alerts based on rules you write about stocks and the economy. We collect as little as we can. Questions: tinyusefulthings003+tradepact@gmail.com.

1. What we store

• An account key. When you open the app, your browser gets a random key. We store only a hashed copy. There's no name, email address or password.
• Your pacts: the rules, names, the plan text you write, cooldowns and other settings, plus each rule's latest check result and the history of alerts and your “did you follow your plan?” answers.
• Your watchlist and holdings (tickers, share counts and average cost) if you add them, and the daily total value we calculate for portfolio rules. When you import a CSV, the file is read in your browser and only the positions are sent and stored.
• Your market-data keys (Finnhub, Massive, Twelve Data). They're encrypted with AES-256 before storage and decrypted only inside the checks that use them. We keep the last four characters to show which key is connected. Keys are never sent back to your browser.
• Market data fetched with your key, such as quotes and daily price history, cached for your account only so we don't use up your key's limits. It's never shown to other users.
• Alert settings, and if you connect them: your Telegram chat ID and your browser's push notification address. Your time-zone offset is stored to respect quiet hours.
• Pro purchases. Polar (our merchant of record) handles payment, your name and email under its own privacy policy. We receive your license key. We don't see your card.
• Basic request logs kept by our host (Cloudflare) for security for a short time. We use IP addresses only to limit abuse, such as too many new accounts from one network.

2. What we don't do

• No advertising, no tracking cookies, no analytics scripts, no selling or sharing your data.
• No brokerage connections. We never ask for brokerage logins and can't see your accounts.

3. Who processes data for us

• Cloudflare hosts the site, the database and the scheduled checks.
• Your data providers (the ones whose keys you connect) receive requests for the tickers in your rules, made with your key.
• SEC EDGAR and FRED receive requests for public filings and economic series. These requests don't include anything about you.
• Anthropic (Claude) processes the plain-English text you submit to draft rule blocks, and the text of public filings we summarise, for Pro features. We don't send your holdings or keys.
• Telegram delivers messages if you connect it. Your browser's push service (for example Google or Apple) receives an empty wake-up signal; alert text is fetched from us afterwards.
• Polar processes Pro payments and license keys.

4. How long we keep it

Your data stays while your account is in use. Delete a key, a holding or a pact in the app and it's removed at once (cached data from a removed key is deleted with it). To delete your whole account, email us from the address on your Polar receipt, or include your account details from the app, and we'll erase it within 30 days.

5. Your rights

You can ask to see, correct, export or delete your data by emailing tinyusefulthings003+tradepact@gmail.com. Depending on where you live (for example Canada under PIPEDA, the EU and UK under GDPR, or California under the CCPA), you may have further rights, including complaining to your privacy regulator.

6. Security

Data travels over HTTPS. Market-data keys are encrypted at rest with a key kept separately from the database. No system is perfectly secure; if we learn of a breach affecting you, we'll tell you as the law requires.

7. Changes

We'll update this page and its date when this policy changes. Significant changes will also be noted in the app.