Privacy Policy

The short version

We store the minimum needed to run an account: your email address, which plan you are on, and the work you create inside the product. We do not sell personal data, we do not run advertising trackers, and we never receive your card details.

What we store, and why

• Email address: your identity here. Sign-in is a magic link, so there is no password to store. Handled by Supabase Auth.
• Plan and subscription state: tier, subscription status and the paid-through date, written by the billing webhook. This is what decides your access.
• Billing customer id: an opaque reference to your Stripe customer record, used to open the billing portal. We never see or store card numbers.
• Your work in the product: armed plans, paper brackets, journal entries, saved preferences and, if you create them, API keys.
• Broker credentials, only if you connect a personal feed: stored encrypted with AES-256-GCM and used solely to fetch market data for your own view.
• Operational logs: engine events used to run and debug the service. High-volume telemetry is kept for a short window; records that grade the product's own accuracy are retained so the public track record cannot be quietly edited.

Market data itself (prices, profiles, statistics) is not personal data. It is the same for every user.

What we do not do

• We do not sell or rent personal data.
• We do not run advertising or cross-site tracking pixels.
• We do not read your broker account beyond fetching market data for your own feed, and we never place orders on your behalf.

Who else processes it

• Supabase: database, authentication and storage.
• Stripe: secure payment processing, receipts and the self-service billing portal.
• Vercel: application hosting.
• Cloudflare Turnstile: bot and abuse verification before starting a free trial; it receives the verification token and network information needed to assess that request.
• Your broker / data gateway: only where you connect one.

When transactional email is enabled, Resend delivers it. When you invoke AI Coach, the configured Anthropic or OpenAI service processes only the prompt and market context needed for that response. A provider receives data only when its integration is configured and used.

How long we keep it

Account data is kept while your account exists. Operational telemetry rolls off on a fixed window measured in weeks. Accuracy-grading records are retained deliberately, because a public scoreboard that silently loses its misses is not a scoreboard.

Cancelling a subscription does not delete anything. You drop to Free and your work stays. Deletion is a separate, explicit action.

Getting your data, or deleting it

From your account page you can export everything associated with your email as a JSON file, and you can delete your account. Deletion removes your account row, your saved work and any stored broker credentials.

Three things survive deletion, and it is fairer to say so than to discover it later: the security log of broker-credential access; a minimal email tombstone that stops delayed billing webhooks from recreating the deleted account; and records your payment provider is legally required to retain for tax and accounting.

Where EU or UK law applies, we process account and subscription data to perform our contract with you, and operational/security logs for our legitimate interest in running and protecting the service. Contact the data controller at awakeagent@gmail.com.

Security

Access to your data is enforced in the database itself with row-level security, not only in the application. Broker credentials are encrypted at rest with a key held outside the database. Server-only secrets are never exposed to the browser.

No system is perfectly secure. If you find a vulnerability, please report it to awakeagent@gmail.com before disclosing it.

Cookies

We set what is needed to keep you signed in and to remember your language and display preferences. There are no advertising or cross-site tracking cookies.

If we add analytics or non-essential cookies, we will update this policy and request consent where the law requires it before enabling them.