Privacy Policy

Last updated: September 29, 2026

This Privacy Policy describes how Stockless LLC (“we,” “us,” or “our”) collects, uses, and shares information when you use the Stockless app and our website at stockless.app (the “App” and the “Website,” together the “Services”).

By using the Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Services.

1. Information We Collect

1.1 Account Information

When you create an account (in the App or on the Website), we collect:

Email address — Used for account identification, authentication, and communication. If you sign in with Apple and hide your email, we receive the private relay address Apple provides instead.
Display name — Your chosen name displayed within the App.
Authentication credentials — Managed through Firebase Authentication (Apple Sign-In, Google Sign-In, or email/password). We do not store your password directly.

1.2 User-Generated Content

When you use the Services, we collect content you create, including:

Portfolio data — Stocks you follow and, if you choose to add them, share counts and purchase cost for positions you hold, including positions imported via brokerage linking.
Paper trading data — Virtual trades and positions in practice mode.
Preferences and settings — Your chosen personality, jargon level, theme, and notification settings.
Bookmarks and notes — Content you save or annotate within the App, including investment stances and thesis data.
Watchlists — Stocks you add to your watchlists.

1.3 Usage Data

We automatically collect information about how you interact with the Services, including:

Feature usage — Which screens, features, and actions you use.
Error and crash data — Technical information collected when the App encounters an error, used to improve stability (via Sentry).

1.4 Device Information

We automatically collect certain device information, including:

Device type and model — e.g., iPhone 16.
Operating system and version — e.g., iOS 18.
App version — The version of the App you are running.
Time zone — Used to provide time-relevant market information.

1.5 Website Information

If you use the Website, we also collect:

Waitlist email address — If you join our waitlist, we store your email address so we can send you a heads-up when the App launches. That is the only email we will send you unless you create an account. You can ask us to remove your address at any time at privacy@stockless.app.
Web session cookie — When you sign in on the Website, we set a single strictly necessary session cookie (the stockless_session cookie). It is HttpOnly (page scripts cannot read it) and Secure, and it expires after 24 hours. It holds only a signed session token that keeps you signed in. The Website sets no other first-party cookies and does not use cookies for advertising or tracking.
Cloudflare technical data — The Website is delivered and protected by Cloudflare, our content delivery network (CDN) and security provider. Cloudflare processes visitors’ IP addresses and standard technical request data (such as browser user agent) to serve pages and protect the site against bots and abuse, and it may set its own short-lived bot-detection cookie (__cf_bm). See Section 4.13.

1.6 Information We Do NOT Collect

Payment card details — Subscriptions are processed through Apple's App Store; we do not see or store your payment information.
Precise geolocation — We do not use GPS or precise location tracking.
Contacts or address book — We do not access your device contacts.
Biometric data — We do not collect fingerprint, face, or other biometric data.
Advertising identifiers — We do not collect or use advertising IDs for tracking.

2. How We Use Information

2.1 Providing and Maintaining the Services

Authenticate your identity and manage your account.
Deliver the Services’ core features, including portfolio tracking, market commentary, stock analysis, and educational content.
Personalize your experience based on your chosen personality, jargon level, and preferences.
Generate AI-powered commentary, briefings, and insights tailored to your portfolio.
Deliver push notifications, if you enable them (for example, daily briefings).
Send you a launch notification if you joined the Website waitlist.

2.2 Improving the Services

Identify and fix bugs, errors, and performance issues.
Analyze usage patterns in aggregate to understand which features are most valuable.
Develop new features and improvements.

2.3 Safety and Security

Detect, prevent, and address fraud, abuse, and security threats.
Enforce our Terms of Service.
Comply with legal obligations.

3. Data Storage and Security

3.1 Where We Store Data

Your data is stored on secure servers hosted by Railway (United States). Our primary storage includes:

PostgreSQL — Application database with encrypted connections (TLS).
Redis — Caching layer for performance optimization. Cached data expires automatically, typically within 24 hours.
Firebase (Google) — Authentication services and push notification delivery.

The Website is served through Cloudflare’s network, described in Section 4.13. Data is primarily stored and processed in the United States.

3.2 How We Protect Data

Encryption in transit — All data transmitted between the Services and our servers is encrypted using TLS.
Encryption at rest — Brokerage connection secrets are encrypted at rest using symmetric encryption.
Secure token storage — In the App, authentication tokens are stored in your device’s iOS Keychain. On the Website, your sign-in session is kept only in the HttpOnly session cookie described in Section 1.5 — never in browser storage a page script could read — and it expires after 24 hours.
Access controls — Access to personal data is restricted to authorized personnel.
Rate limiting — API rate limiting to prevent abuse.

3.3 Data Retention

How long we keep each category of information:

Account data (email, display name, sign-in provider) — Retained until you delete your account.
Portfolio, watchlist, and other user content — Kept with your account until you delete it or delete your account.
Waitlist email addresses — Kept until the launch email has been sent, and removed sooner if you ask us to.
Web session cookie — Expires after 24 hours, or immediately when you sign out.
Cache data — Redis cache data expires automatically, typically within 24 hours.
Error and crash logs — Retained for up to 90 days via Sentry.
AI-generated content — Short-lived commentary (greetings, per-stock reactions, summaries) is cached and regenerated, typically within 24 hours. Personalized content tied to your account (daily briefings, weekly reports, saved recommendations and theses) is kept with your account until you delete it.
Encrypted backups — Some data may persist in encrypted backups for a limited period before being overwritten.

3.4 Security Limitations

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

4. Third-Party Services

We use the following third-party services that may collect or process your data:

AI providers and your permission: Before the App first sends your screenshots, questions, or holdings to an AI provider, it shows you what will be sent and asks you to agree. Your name, email address, and account identifier are never sent to AI providers.

4.1 Firebase (Google)

Purpose: User authentication (Apple Sign-In, Google Sign-In, email/password) and push notifications via Firebase Cloud Messaging.
Data shared: Email address, authentication tokens, push notification tokens.
Privacy policy: https://firebase.google.com/support/privacy

4.2 SnapTrade (Passiv Inc.)

Purpose: Brokerage account linking for portfolio import.
Data shared: We never share or store your brokerage credentials. SnapTrade handles the OAuth connection directly with your broker. We only receive read-only position data (holdings, quantities, cost basis). Your SnapTrade user secret is encrypted at rest.
Privacy policy: https://snaptrade.com/privacy-policy

4.3 Twelve Data

Purpose: Market data — real-time and delayed stock quotes, historical price charts, symbol search, company profiles, market open/closed status, top gainers and losers, past earnings results, and stock split data.
Data shared: Requested stock symbols only. No personal information is sent.
Privacy policy: https://twelvedata.com/privacy

4.4 StockNewsAPI

Purpose: News headlines and articles for individual stocks, your portfolio and watchlist symbols, and general market coverage.
Data shared: Requested stock symbols only. No personal information is sent.
Privacy policy: https://stocknewsapi.com/privacypolicy

4.5 Public data sources (SEC EDGAR, FRED)

Purpose: SEC EDGAR provides company fundamentals (XBRL filings), insider transaction filings (Form 4), institutional holdings (Form 13F), and the earnings-release filings (Form 8-K) the App uses to estimate upcoming earnings dates. FRED (Federal Reserve Bank of St. Louis) provides interest rates and macroeconomic indicators.
Data shared: Requested company identifiers and data series only. No personal information is sent.
More information: https://www.sec.gov/edgar and https://fred.stlouisfed.org/legal

4.6 Anthropic (Claude)

Purpose: AI-generated market analysis, portfolio briefings, personality-driven commentary, and educational content.
Data shared: Portfolio stock symbols and market data context for generating personalized insights. No personal identifying information (name, email, etc.) is sent to AI models.
Privacy policy: https://www.anthropic.com/privacy

4.7 Google (Gemini)

Purpose: Fallback AI provider and portfolio screenshot OCR (importing positions from screenshots).
Data shared: Stock symbols, market data context, and uploaded portfolio screenshots for OCR processing. Screenshots are processed in memory and are not stored. The text extracted from them is deleted when you finish the import, or within a few hours if you abandon it.
Privacy policy: https://policies.google.com/privacy

4.8 OpenRouter (AI model routing)

Purpose: Routes AI generation requests to cost-efficient mid-tier models (e.g. Moonshot Kimi, Google Gemini) for personality commentary, summaries, and classification.
Data shared: Stock symbols, market data context, your portfolio/watchlist context, and chat questions — only to generate AI responses. We never send your name, email address, or account identifier to an AI model.
Retention controls, by type of request: We ask every provider not to train on your data (data_collection: deny) and we never allow a request to be served by a provider outside the controls we requested. In addition, any request that involves your own information — chat, portfolio-aware insights, your positions, performance, or anything you typed — is routed only to providers contractually committed to zero data retention. Requests that contain no information about you — personality commentary built from public ticker data, summaries of public news articles, global daily greetings, per-symbol research shared by all users — may be routed to providers that meet the no-training requirement but are not zero-retention. These controls depend on the selected provider’s support and are not a guarantee of universal zero retention.
Privacy policy: https://openrouter.ai/privacy

4.9 Sentry

Purpose: Error tracking and crash reporting to improve App stability.
Data shared: Error logs, device information, App state at time of error.
Privacy policy: https://sentry.io/privacy/

4.10 Apple App Store

Purpose: App distribution and subscription management.
Data shared: Transaction data is managed by Apple; we receive subscription status but not payment details.
Privacy policy: https://www.apple.com/privacy/

4.11 RevenueCat

Purpose: Subscription entitlement management and purchase status sync.
Data shared: App user ID, subscription product identifiers, entitlement status, transaction metadata, and related subscription lifecycle events. We do not share payment card details with RevenueCat.
Privacy policy: https://www.revenuecat.com/privacy/

4.12 Railway

Purpose: Hosting and infrastructure for the Services — application servers, the PostgreSQL database, and the Redis cache.
Data shared: Account data, user content, and technical logs needed to operate the Services, hosted in the United States.
Privacy policy: https://railway.com/legal/privacy

4.13 Cloudflare

Purpose: Content delivery network (CDN) and security (DDoS and bot mitigation) for the Website at stockless.app.
Data shared: IP addresses and standard technical request data (such as browser user agent) for visitors to the Website. Cloudflare may set its own short-lived bot-detection cookie (__cf_bm).
Privacy policy: https://www.cloudflare.com/privacypolicy/

5. User Rights

5.1 Right to Access

You can access most of your data directly through the App's settings and portfolio screens.

5.2 Right to Correction

You can update your preferences and portfolio data directly in the App. To correct other information (such as your email address), contact us at privacy@stockless.app.

5.3 Right to Deletion

You can delete your account in the App from Settings → Account → Delete Account. You can also request deletion by contacting us at privacy@stockless.app. Upon receiving a deletion request, we will:

Delete your account and all associated personal data within 30 days.
Remove your portfolio positions, import history, preferences, watchlists, linked brokerage connections, and cached AI-generated content.
If you signed in with Apple, revoke our Sign in with Apple authorization with Apple on your behalf.
Delete your RevenueCat customer record (our subscription platform) and your Firebase sign-in account.
Note that some data may persist in encrypted backups for a limited period before being overwritten.

Deleting your Stockless account does not cancel an App Store subscription. If you have a paid subscription, cancel it first in your Apple ID settings (Settings → [your name] → Subscriptions → Stockless); otherwise Apple may continue billing you.

5.4 Right to Data Portability

You can request a copy of your personal data in a machine-readable format by contacting us at privacy@stockless.app.

5.5 Right to Opt Out

Push notifications — You can disable notifications at any time through your device's notification settings or, where available, the App's settings.
Brokerage linking — You can disconnect your brokerage account at any time through the App's settings.
Waitlist emails — You can ask us to remove your waitlist email address at any time at privacy@stockless.app.

6. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA):

Right to know what personal information we collect, use, and disclose.
Right to correct inaccurate personal information.
Right to delete your personal information, subject to certain exceptions.
Right to opt out of the sale or sharing of personal information. We do not sell or share your personal information.
Right to non-discrimination for exercising your CCPA/CPRA rights.

Sensitive personal information: Financial information we process — such as holdings you add manually, import from a screenshot, or link from a brokerage — is used only to provide the Services you request (for example, to analyze your portfolio). We do not use it to infer additional characteristics about you, and we do not use it for advertising or for training cross-context behavioral advertising.

No behavioral advertising: We do not engage in cross-context behavioral advertising, and we do not sell or share personal information for that purpose.

Retention: How long we keep each category of personal information is listed in Section 3.3.

To exercise your CCPA/CPRA rights, contact us at privacy@stockless.app.

7. International Users

If you access the Services from outside the United States, please be aware that your information may be transferred to, stored in, and processed in the United States, where our servers are located. By using the Services, you consent to the transfer of your information to the United States.

8. Children's Privacy

The Services are intended for users who are at least 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information as quickly as possible. If you believe we have collected information from a child under 13, please contact us immediately at privacy@stockless.app.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

Updating the “Last Updated” date at the top of this document.
Posting the updated Privacy Policy within the App and on the Website.
Sending a notification through the App for significant changes (if you have notifications enabled).

Your continued use of the Services after changes to this Privacy Policy constitutes your acceptance of the updated Privacy Policy.

10. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: privacy@stockless.app

For privacy-specific requests (access, deletion, correction), please include “Privacy Request” in the subject line.