Privacy Policy

The short version: an email address if you want an API key, a count of the calls you make, and no card details at all — those go to Stripe and never to us. We do not sell anything to anyone.

1. What we collect

• Email address — only if you create an account. It is the account's identity and where login links are sent.
• API key — generated by us, used to authenticate your API calls.
• Password — only if you choose to set one. Stored as a bcrypt hash; we never see or store the password itself.
• Usage logs — which endpoint you called and when, so your monthly allowance can be counted and shown to you.
• Page views and searches — the path visited and, on a company page, the ticker. Recorded against a salted digest of your address, not against your account.
• A salted digest of your IP address — for rate limiting and abuse control. We do not store IP addresses. The digest is enough to tell two visitors apart for a day; it is not reversible into an address, and it is not a person — one office shares an address, and one phone moving from wifi to cellular produces two.
• Your answer to the sign-in offer — "yes" or "no", against the same digest, so the offer is not repeated in every browser on your connection. Everyone sharing that connection shares the answer. If you were shown the discount, the time it was shown and whether it was claimed are kept against that digest too, so it is only ever shown once.

2. What we do not collect

No payment information, of any kind. There is no card form on this site. Paying takes you to Stripe's own checkout page, where your card details are given to Stripe — they are never posted to this service, never pass through it, and are not in its database. What comes back to us is that a payment succeeded, the email address it was made with, and Stripe's own identifiers for the customer and the subscription, which is what lets your access be granted and later cancelled.

No advertising cookies or identifiers, no third-party analytics, and no cross-site tracking of any kind. One first-party cookie records how you first found the site, described in section 8.

3. Why we collect it

• To run the service and let you make API calls.
• To count usage against your allowance, and to show you that count.
• To send you login links and account email.
• To rate-limit and to stop abuse.
• To understand which companies are looked at, so the site can be improved. This is aggregate interest in tickers, not a profile of you.

4. Who else sees it

• Railway — hosting. The application and its database run there.
• AgentMail — email delivery. Receives your address and the message when we send you a login link or an account email.
• Stripe — payments, and only if you buy something. Your card details go to Stripe and not to us; Stripe receives your email address and holds the payment record. Stripe is the data controller for what it collects on its own page, under its privacy policy. If you never buy anything, nothing is sent to Stripe.
• OpenRouter — only if you use the optional question box on a company page. Your question and the filed figures for that company are sent to a language model to answer it. Do not type anything private into that box. If you never use it, nothing is sent.

We do not sell your data, and we do not share it for advertising. We will disclose data if the law requires it.

5. Security, stated honestly

• The site is served over HTTPS.
• Passwords are hashed with bcrypt and are not recoverable by us.
• Session cookies are signed, HttpOnly and Secure.
• API keys are stored as a SHA-256 hash, not in plain text. The full key is shown once, at the moment it is issued. After that this database holds the hash and the first eight characters — enough to tell you which key your account is on, and not enough to use it. Nobody here can read your key back to you, which means a lost key is a regeneration rather than a lookup. Treat it as a password anyway: anyone holding it can spend your calls. You can regenerate at any time, and doing so stops the old key immediately.

No system is perfectly secure and we do not claim otherwise.

6. How long we keep it

• Account data — for as long as the account exists, or until you ask us to delete it.
• Usage logs — kept so your allowance can be counted and audited.
• Page views and digests — retained in aggregate for analytics. They are not linked to your account.
• Login links — deleted shortly after they expire.
• Sign-in offer records (the digest, when the offer was shown and whether it was claimed) — kept so the offer is only ever shown once per connection.

7. Your rights

Under PIPEDA and comparable law you may ask for access to the personal information we hold about you, its correction, or its deletion.

• Access — your account, tier, usage and key are all on your dashboard. Ask 01dominique.c@gmail.com for anything beyond that.
• Correction — email 01dominique.c@gmail.com to change the address on an account.
• Deletion — delete your account yourself from the Account tab of your dashboard, or email 01dominique.c@gmail.com. Deleting cancels any subscription immediately and removes the account, its key, usage logs, watchlist and webhooks. A record that a deletion happened is kept, and Stripe keeps its receipts for payments already made. Aggregate figures that are not linked to you may remain.

If you are unhappy with how we have handled a request, you can complain to the Office of the Privacy Commissioner of Canada.

8. Cookies

One cookie, set only when you sign in, holding a signed session. It is how the dashboard knows who you are. A second, bp_offer, is set only if you click to claim a discount, and holds nothing but a random claim number until you close your browser, so checkout can apply it. A third, bp_src, is set the first time you arrive from a tagged link or from another website, and is never changed after that. It holds only a short label for where you came from, such as ref:awesome-quant or host:github.com, and nothing that identifies you. A tag on a link is also recorded with that page view. If you create an account, the label is stored with it so we can tell which places bring people who use the API. It expires after 90 days and is never shared. There are no advertising cookies and nothing from a third party. Your browser also stores your API key locally if you paste one in; that never leaves your device except as the header on your own API calls. It also remembers, locally, whether you have closed the sign-up prompt on company pages and articles, so it is not shown again. That flag never leaves your device.

9. Where the data lives

The service is operated from Ontario, Canada, and hosted on infrastructure that may process data outside Canada. Using the service means accepting that.

10. Changes

Material changes will be announced by email to account holders, or by a notice on the site.

11. Contact

Privacy questions, access requests and deletion requests: 01dominique.c@gmail.com.