Skip to content

Legal

Privacy policy

Last updated

Template notice: bracketed placeholders such as [COMPANY] and [STATE] in this document have not been filled in yet. They are set in legal-content.ts.

This Privacy Policy explains how [COMPANY] ("we", "us") collects, uses, shares and protects personal information when you use OptionsScreenerPro (the "Service"). It applies to the website, applications, emails and support channels.

1. Information we collect

  • Account information: name, email address, password hash, and, if you sign in with Google, the identifier, name and email that Google shares with us. We never receive your Google password.
  • Billing information: plan, billing interval, subscription status, invoice history and the payment processor’s customer and subscription identifiers. Card details are collected by the payment processor directly and are not stored by us.
  • Usage content you create: watchlists, saved screens, alert configurations, notification preferences and feedback.
  • Technical and usage data: IP address, browser and device type, pages and features used, screens run, exports made, timestamps, request identifiers and error logs. Security-relevant actions (sign-in, password change, plan change, export, alert creation) are recorded in an audit log.
  • Communications: messages you send to support and our replies.

We do not collect brokerage credentials, positions or trade history, and we do not ask for them.

2. How we use information

  • to provide, secure and operate the Service, including authentication, plan entitlements, alerts and emails you request;
  • to process payments, renewals, refunds and invoices;
  • to respond to support requests and to notify you of changes to the Service, Terms or this Policy;
  • to monitor performance, debug problems, prevent abuse (including data scraping and account sharing) and enforce our Terms;
  • to understand how features are used so we can improve them, using aggregated or pseudonymised data where possible;
  • to comply with legal obligations, including tax and accounting record-keeping.

We do not sell personal information and we do not use it for third-party advertising profiles.

4. How we share information

We share personal information only with service providers that process it on our behalf under contract, and only as needed to run the Service. The full list of processors and exactly what each receives:

  • Google Cloud (Cloud Run, Secret Manager, Cloud Scheduler): runs the application and its scheduled jobs; receives all application data, encrypted in transit and at rest.
  • Neon (PostgreSQL): stores the database; receives account, usage and market data, encrypted at rest.
  • Stripe: subscriptions, invoices and card payments; receives your email, plan and payment details (we never see full card numbers).
  • Resend: transactional and requested emails; receives your email address and the email content.
  • Google (OAuth sign-in): sign-in with Google when you choose it; receives the sign-in request; Google returns your name, email and verified status.
  • Cloudflare Turnstile: telling people from bots on sign-up and some sign-ins; receives browser signals and your IP address during the check.
  • Tradier: delayed quotes and option chains; receives the symbols the Service requests as a whole, never your identity (only when enabled).
  • Alpaca: delayed stock quotes and bars; receives the symbols the Service requests as a whole, never your identity (only when enabled).
  • Polygon.io: quotes, bars and reference data; receives the symbols the Service requests as a whole, never your identity (only when enabled).
  • Cboe (delayed quotes): delayed option quotes; receives the symbols the Service requests as a whole, never your identity (only when enabled).
  • Nasdaq (public data): listings and reference data; receives the symbols the Service requests as a whole, never your identity (only when enabled).
  • Yahoo Finance: end-of-day reference prices; receives the symbols the Service requests as a whole, never your identity (only when enabled).
  • Groq: AI copilot and AI explanations (first choice); receives your question and the minimised page context; never your password, payment details, email or IP address (only when enabled).
  • Cerebras: AI copilot and AI explanations (fallback); receives your question and the minimised page context; never your password, payment details, email or IP address (only when enabled).
  • Google Gemini: AI copilot and AI explanations (second fallback); receives your question and the minimised page context; never your password, payment details, email or IP address (only when enabled).
  • Telegram: alerts and copilot answers in @OptionsScreenerProBot, only after you link it; receives the alert or answer text sent to your linked chat (only when enabled).
  • Browser push services (Google, Mozilla, Microsoft, Apple): Web Push alerts, only after you allow them; receives an encrypted notification payload (only when enabled).
  • Google Analytics 4: aggregate visit statistics on the public site and app, only when enabled; receives page views and coarse device data; never screen filters, symbols or account details (only when enabled).

AI providers are used only when you use an AI feature; the "What the AI sees" page (/legal/ai) states exactly what is sent and what never is.

Market-data providers receive the symbols requested by the Service as a whole, not your identity. We may also disclose information when required by law, to protect rights and safety, or as part of a merger, acquisition or asset sale, in which case this Policy continues to apply to the transferred data.

5. Cookies and local storage

We use a session cookie to keep you signed in, a theme preference in local storage, and cookies the payment processor needs during checkout. We do not use advertising or cross-site tracking cookies. Blocking the session cookie prevents sign-in.

When an administrator enables Google Analytics 4, it sets first-party analytics cookies on our production domain only, after you accept them where the law requires consent (for example in the EU and UK). Analytics never receives screen filters, symbols, watchlist names or account details. Staff browsers are marked as internal traffic and excluded from the statistics.

6. Retention

  • Account and usage content: for as long as your account exists. When you delete your account we delete your profile, watchlists, saved screens and alerts within 30 days, except as noted below.
  • Billing records: retained for the period required by tax and accounting law (typically 7 years).
  • Audit and security logs: retained for up to 12 months, then deleted or anonymised.
  • AI request records (prompt, response, token counts): 30 days. Copilot and Telegram conversation turns: 90 days. Sign-in activity (IP address, device, day): 90 days.
  • Help Center analytics (which article was read, from which channel, failed searches, feedback): up to 400 days, without personal data beyond your user id when signed in.
  • Backups: encrypted backups roll off on a fixed schedule of up to 35 days.

7. Security

We protect information with encryption in transit (TLS) and at rest, hashed passwords, least-privilege access, secret management, audit logging and scope checks on every request. No system is perfectly secure; if we learn of a breach affecting your information we will notify you and any regulator as the law requires.

8. Your rights and choices

  • Access, correct or export your account information from the account page, or by contacting us.
  • Delete your account from the account page; see Retention for what is kept.
  • Opt out of product-update emails via the unsubscribe link or your notification settings. Transactional emails (receipts, password resets, security notices) cannot be opted out of while you have an account.
  • Depending on where you live you may have additional rights, such as to object to or restrict processing, to data portability, to withdraw consent, and to lodge a complaint with a supervisory authority. Residents of certain US states have the right to know, delete and correct personal information and to opt out of its sale or sharing; we do not sell or share personal information for cross-context behavioural advertising.

To exercise any right, email [CONTACT_EMAIL]. We may need to verify your identity before acting on a request.

9. International transfers

The Service is operated from [COUNTRY] and hosted in data centres in the United States. If you access it from elsewhere your information is transferred to and processed in those locations, under appropriate safeguards where required.

10. Children

The Service is not directed to children under 18 and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy; the "Last updated" date shows the current version. Material changes will be announced by email or in the Service before they take effect.

12. Contact

[COMPANY], [POSTAL_ADDRESS]. Email: [CONTACT_EMAIL].

Privacy policy | OptionsScreenerPro