Privacy Policy

The short version: an email address if you want an API key, a count of the calls you make, and no card details at all — those go to Stripe and never to us. We do not sell anything to anyone.

1. What we collect

• Email address — only if you create an account. It is the account's identity and where login links are sent.
• API key — generated by us, used to authenticate your API calls.
• Password — only if you choose to set one. Stored as a bcrypt hash; we never see or store the password itself.
• Usage logs — which endpoint you called and when, so your monthly allowance can be counted and shown to you.
• Page views and searches — the path visited and, on a company page, the ticker. Recorded against a salted digest of your address, not against your account.
• A salted digest of your IP address — for rate limiting and abuse control. We do not store IP addresses. The digest is enough to tell two visitors apart for a day; it is not reversible into an address, and it is not a person — one office shares an address, and one phone moving from wifi to cellular produces two.

2. What we do not collect

No payment information, of any kind. There is no card form on this site. Paying takes you to Stripe's own checkout page, where your card details are given to Stripe — they are never posted to this service, never pass through it, and are not in its database. What comes back to us is that a payment succeeded, the email address it was made with, and Stripe's own identifiers for the customer and the subscription, which is what lets your access be granted and later cancelled.

No tracking cookies, no advertising identifiers, no third-party analytics, and no cross-site tracking of any kind.

3. Why we collect it

• To run the service and let you make API calls.
• To count usage against your allowance, and to show you that count.
• To send you login links and account email.
• To rate-limit and to stop abuse.
• To understand which companies are looked at, so the site can be improved. This is aggregate interest in tickers, not a profile of you.

4. Who else sees it

• Railway — hosting. The application and its database run there.
• AgentMail — email delivery. Receives your address and the message when we send you a login link or an account email.
• Stripe — payments, and only if you buy something. Your card details go to Stripe and not to us; Stripe receives your email address and holds the payment record. Stripe is the data controller for what it collects on its own page, under its privacy policy. If you never buy anything, nothing is sent to Stripe.
• OpenRouter — only if you use the optional question box on a company page. Your question and the filed figures for that company are sent to a language model to answer it. Do not type anything private into that box. If you never use it, nothing is sent.

We do not sell your data, and we do not share it for advertising. We will disclose data if the law requires it.

5. Security, stated honestly

• The site is served over HTTPS.
• Passwords are hashed with bcrypt and are not recoverable by us.
• Session cookies are signed, HttpOnly and Secure.
• API keys are stored as a SHA-256 hash, not in plain text. The full key is shown once, at the moment it is issued. After that this database holds the hash and the first eight characters — enough to tell you which key your account is on, and not enough to use it. Nobody here can read your key back to you, which means a lost key is a regeneration rather than a lookup. Treat it as a password anyway: anyone holding it can spend your calls. You can regenerate at any time, and doing so stops the old key immediately.

No system is perfectly secure and we do not claim otherwise.

6. How long we keep it

• Account data — for as long as the account exists, or until you ask us to delete it.
• Usage logs — kept so your allowance can be counted and audited.
• Page views and digests — retained in aggregate for analytics. They are not linked to your account.
• Login links — deleted shortly after they expire.

7. Your rights

Under PIPEDA and comparable law you may ask for access to the personal information we hold about you, its correction, or its deletion.

• Access — your account, tier, usage and key are all on your dashboard. Ask 01dominique.c@gmail.com for anything beyond that.
• Correction — email 01dominique.c@gmail.com to change the address on an account.
• Deletion — email 01dominique.c@gmail.com and we will delete the account, its key and its usage logs. Aggregate figures that are not linked to you may remain.

If you are unhappy with how we have handled a request, you can complain to the Office of the Privacy Commissioner of Canada.

8. Cookies

One cookie, set only when you sign in, holding a signed session. It is how the dashboard knows who you are. There are no tracking or advertising cookies. Your browser also stores your API key locally if you paste one in; that never leaves your device except as the header on your own API calls.

9. Where the data lives

The service is operated from Ontario, Canada, and hosted on infrastructure that may process data outside Canada. Using the service means accepting that.

10. Changes

Material changes will be announced by email to account holders, or by a notice on the site.

11. Contact

Privacy questions, access requests and deletion requests: 01dominique.c@gmail.com.