Privacy Policy

Effective date: 2026-09-09

1. Who is responsible

finlyze.ai is run by a single independent developer — one person, not a company. That person is the data controller. There is no legal entity, no data protection officer and no privacy team; the same person reads every request:

[email protected]

2. What is stored

Account and profile

your email address, a bcrypt hash of your password (never the password itself), and the name you give;
the experience level and risk tolerance you pick during onboarding, plus your timezone, display currency, briefing time, price-alert threshold, default landing page and home-page widget layout;
account state: created and last-login timestamps, the email-verified flag, failed-login count and lockout time, a session-version counter used to revoke tokens, whether AI access has been granted, and any per-account daily token ceiling;
if you enable two-factor authentication: an encrypted TOTP secret and hashes of your backup codes;
consent records: which Terms and Privacy Policy versions you accepted and when, the marketing-email flag, and your notification opt-ins;
if your account is waiting for approval, a flag saying so.

If you ask for an invite before you have an account

The invite queue stores the email address, the name and the free-text note you submit on the sign-up page, plus whether it has been handled and by which administrator. Invite codes themselves are stored as administrator-issued rows with a use counter; they are not linked back to the account that redeemed one.

What you create in the app

watchlists; portfolios and positions (ticker, share count, buy price, date, your own notes); saved strategies and their iterations; alert rules; personas; course and skill progress; daily briefings; prediction and recommendation records kept for the track-record scoring;
conversations and every message in them, including debate transcripts and the artifacts attached to answers — tables, charts and generated report files;
analyses and reports you request;
derived long-term memories: short facts taken from what you state yourself in your messages (preferences, risk tolerance, trading rules, goals, tickers you follow, holdings you mention), each kept with the quote and the conversation it came from, plus the earlier values a newer statement replaced; and, where the feature is on, lessons summarised from your closed paper trades. They are used to tailor later explanations and risk reminders, never to give buy or sell calls. Uploaded file contents, passwords, keys and account or contact numbers are never stored as memories. Where the newer memory controls are on, market numbers are not taken from your messages unless you ask the assistant to remember them (each is kept with the date you said it), and some items, such as holdings you mention, are used only after you confirm them in Settings → Memory;
a log of changes to those memories (added, edited, replaced, confirmed, rejected, deleted). When a memory is deleted, its content is removed from the log as well;
feedback you send: the message, an optional screenshot you attach, the page URL, your browser user agent and your email address.

Operational records

a per-call cost ledger (provider, model, token counts, cost, latency) and run traces, which include a 200-character preview of the query that produced them;
run events and a chat audit log, which contain question and answer text;
application and web-server logs, including errors;
admin audit entries recording administrative actions and the email of the administrator who took them;
browser push subscriptions if you turn notifications on: the push endpoint URL, its keys and your user agent;
your IP address, used as the rate-limit key on the sign-up, sign-in and password endpoints and present in server logs.

Optional model-provider keys. If you supply your own API key for a model provider, it is encrypted before storage and is never displayed again to anyone, including administrators.

3. Why it is processed

Purpose	Basis (GDPR Art. 6)
Running the Service you asked for	Contract — Art. 6(1)(b)
Rate-limiting, lockouts, abuse and cost control	Legitimate interest — Art. 6(1)(f)
Keeping the operating cost ledger and audit trail	Legitimate interest — Art. 6(1)(f)
Marketing email	Consent — Art. 6(1)(a), opt-in only
Legal obligations	Legal obligation — Art. 6(1)(c)

Your personal data is not sold, and it is not shared with advertisers or data brokers. No automated decision producing legal or similarly significant effects on you is made: the AI produces analysis about markets, not decisions about you.

4. Where it lives

The Service does not run in a managed cloud region. It runs on the operator's own machine — a local Postgres database and a local cache — with Cloudflare in front of the domain (TLS and a tunnel) so that machine can serve finlyze.ai without being exposed directly. Backups are local snapshots on the same machine.

Using the Service therefore means your data is processed on that one computer, wherever the operator is. There is no corporate group and no set of standard contractual clauses to point at; the honest description is that a single individual holds the data.

5. Who else processes it

Model providers. When you ask the assistant something, your question, the context assembled for it — which can include your watchlist, portfolio positions and remembered preferences — and the relevant conversation history are sent to whichever provider answers that step. Currently wired: Anthropic, OpenAI, Google, xAI and OpenRouter (which routes onward to further upstream models); DeepSeek, Kimi (Moonshot) and GLM (Zhipu) are supported and used when a key is configured, either the operator's or your own. OpenRouter requests carry a "no data collection" routing preference by default.
Market, news and web data. Yahoo Finance (equities, indices, fundamentals), Coinbase (crypto prices), Deribit (crypto options), Frankfurter/ECB (FX), FRED (macro series), NewsAPI, Reddit, Google News and publisher RSS feeds, and Tavily / Firecrawl when a question needs a live web search or a page fetched. Only symbols, search terms and page URLs go to these services — a search term can be derived from your question. No account data is sent.
Cloudflare sits in front of finlyze.ai and sees the connection metadata and request headers of everything you do here.
Email. No outbound mail relay is configured on the live deployment today, so the service does not send verification or password mail by itself; a password reset is handled by hand by the operator. If a relay is ever configured, it will be named here.
Browser push services (your browser vendor's) if you enable notifications.
Error monitoring. The code supports Sentry, but it is disabled on the live deployment — no DSN is configured, so nothing is sent to it.

6. Training

Your conversations, holdings and memories are not used to train any model, by the operator or on the operator's behalf. What a model provider does with a prompt sent to its API is governed by that provider's own terms; see section 5 for the routing preference used to prefer non-retaining upstreams.

7. How long it is kept

Your content — chats, analyses, watchlists, portfolios, saved work — is kept until you delete it or delete your account. Apart from the memory items below, there is no automatic expiry: nothing else disappears on a timer.
Memories stay until you delete them or delete your account, with two exceptions: an item waiting for your confirmation is deleted after 30 days if you don't confirm it, and entries in the memory change log are deleted after 90 days. Deleting a chat also deletes the memories that came from it; memories saved before their source was recorded, and the tickers you follow, stay until you delete them.
When you delete your account, the following are deleted outright: profile, conversations and messages, derived memories, watchlists, portfolios and positions, alert rules, personas, skills, saved strategies, prediction and recommendation records, push subscriptions, feedback (including any screenshot), chat audit rows and run events.
Cost-ledger rows and run traces are kept, with the link to your account removed, so operating and accounting totals still add up. A run trace retains the 200-character query preview described in section 2.
Admin audit entries record the administrator who acted, the account or object acted on (including the email address it had at that moment) and the before/after values of the change. They are retained as an operational and security record and survive the deletion of the account they refer to.
Application and server logs live on the operator's machine and rotate there; they are not copied into a separate long-term store.

8. Your controls

Export — Settings → Account produces one JSON bundle of everything held on you (GDPR Art. 20). Secrets are never included in it.
Delete — Settings → Account, confirmed with your password, runs the deletion described in section 7.
Correct — name, experience level, risk tolerance, timezone, currency and notification preferences are editable in Settings; write to the contact address for anything else, including your email address.
Marketing consent is recorded at sign-up and is off unless you opt in; email the contact address to change it.
Notification opt-ins for the daily digest, price alerts and risk warnings are per-category in Settings.
Cookies — the banner lets you choose essential-only.
Two-factor authentication can be enabled in Settings.
Your own provider keys can be replaced or removed at any time.
Memory — Settings → Memory shows what the assistant remembers about you and where each item came from. You can edit, pin or delete any item, confirm or reject items waiting for confirmation, delete everything at once, and see the change log. Pausing memory stops it being read or saved (stored items stay viewable and deletable); paper-trade lessons have their own switch. An incognito chat, chosen before its first message, neither reads nor saves memories. Deleting a chat deletes the memories that came from it.

9. GDPR and CCPA

If you are in the EU/EEA, the UK or Switzerland you have the rights to access, rectification, erasure, restriction, objection and portability, and you may withdraw consent at any time. You may also complain to your local supervisory authority.

If you are a California resident you have the right to know what is collected, to delete it, to correct it, and to opt out of any sale or sharing — there is none: personal data is neither sold nor shared for cross-context behavioural advertising. Exercising any right will never be held against you.

Use the export and delete controls in Settings, or write to [email protected] from the address on your account. One person answers; the aim is within 30 days, and you will get an acknowledgement sooner than that.

10. Cookies and local storage

A first-party session cookie keeps you signed in. Local storage holds your access token — which the app sends with every API request — along with your language, theme, cookie choice and a little UI state. There are no third-party advertising or analytics trackers on the site.

11. Security

Passwords are hashed with bcrypt. Traffic is TLS-encrypted through Cloudflare. Secrets you entrust to the Service — your own provider API keys, your TOTP secret — are encrypted at rest and never shown back. Session tokens carry a version so a password change or an administrative action revokes every outstanding session. Repeated failed sign-ins lock the account across IP addresses, and administrative actions are written to an audit trail.

It is still one person's machine, with no security team and no formal certification. No system is perfectly secure. If a breach affects you, you will be emailed at the address on your account as soon as it is understood.

12. Children

The Service is not intended for anyone under 18 and personal information is not knowingly collected from them. If you believe a child has provided data, write to the contact address and it will be deleted.

13. Changes

This Policy carries a version. When it changes materially, the version changes and the new text appears on this page; material changes are announced in the app or by email where that is possible.

14. Contact

Privacy, and everything else: [email protected].