Privacy
Last updated October 25, 2026
What we collect
If you sign up for the email digest we store your email address, your watchlist tickers and your delivery preference (daily or weekly). We do not ask for your name, payment details or brokerage information.
Accounts
If you sign in we store your email address, when you signed in, and your plan. Sign-in links and session cookies are random tokens; we store only a one-way hash of them. We never store passwords.
Payments
Pro payments are handled by Stripe. We never see or store your card number; we keep only your Stripe customer and subscription IDs and subscription status. Stripe's privacy policy applies to the payment data it processes.
Usage data
To enforce the free daily lookup limit and prevent abuse, the server keeps your IP address and the tickers you opened in memory for the current day only. Standard hosting logs may record IP addresses and requests for a short period for security. We do not use advertising trackers or sell data.
Browser storage
Your layout and dark/light preference are saved in your browser's localStorage. An owner cookie is set only for the site operator.
Digest emails are sent through our email provider. Every email has a one-click unsubscribe link; unsubscribing deletes your watchlist. To have your data deleted, reply to any digest email or contact us at the address below.
Cookies
We use a sign-in cookie (td_session) only when you sign in. It is HttpOnly and Secure, and expires after 30 days or when you sign out. We don't use advertising or tracking cookies.
Third parties
Data shown comes from SEC EDGAR, Yahoo Finance and news publishers. News thumbnails are fetched through our server so those sites don't see your IP.
How we use your information
We use the information above only to run the service, send the emails you ask for (sign-in links, watchlist confirmations and digests), process Pro billing, and prevent abuse such as spam sign-ups or scraping.
Who we share it with and how
We share data only with the service providers that run the site, and only what each one needs:
- Stripe (payments): when you upgrade, your email address and subscription details are sent to Stripe over its secure, encrypted API. Stripe collects your card details directly; they never pass through our servers.
- Resend (email delivery): to send an email, we send your email address and the message content to Resend over its encrypted API.
- Railway (hosting and database): the site and its database run on Railway, so the data described here is stored on Railway's servers.
We do not sell your information or share it for advertising. We may disclose information if required by law, for example in response to a valid legal request.
How we protect it
- All traffic uses HTTPS/TLS, with HSTS so browsers always connect securely.
- Sign-in links and session tokens are stored only as one-way hashes.
- We don't use or store passwords, and we never receive or store card data.
- Access to the server and database is restricted to the site operator.
- Secret keys are kept in server environment variables, not in code.
- Rate limiting protects sign-in, signup and lookup endpoints from abuse.
Data retention
We keep your account and watchlist until you unsubscribe or ask us to delete them. Sign-in links expire after 15 minutes and sessions after 30 days. Per-day usage data is kept in memory for the current day only. Short-lived security logs are rotated by our host. We keep billing records only as long as needed for accounting and legal requirements.
Your choices
Email hello@tickerdecoded.app to get a copy of your data or have your account and watchlist deleted. Educational only, not investment advice.
Changes to this policy
If we change this policy we will update the date at the top of this page. For significant changes we will notify account holders by email.
Contact
hello@tickerdecoded.app