Privacy notice

1. Controller and contact

Tracking Alpha is the service brand. The controller's legal name, postal address, and registration or tax details, if applicable, must be inserted here before this notice is approved for paid launch. Privacy questions and rights requests can be sent to support@trackingalpha.app.

2. Personal data we collect

We collect account and profile data such as email address, display name, avatar, account identifiers, timezone, and sign-in records; billing data such as customer, subscription, entitlement, invoice, tax, cancellation, and refund records; and product data such as tracked assets, thesis text and claims, lists, read state, feedback, notification settings, and generated research. Stripe handles full payment-card details, which Tracking Alphadoes not store.

If you upload an avatar, it is stored at a public asset URL so the image can be displayed in the product. Anyone who obtains that URL may be able to retrieve the image. Do not use an avatar that contains sensitive information or that you do not want available at a public URL.

We also process communications and delivery records; public-source text, URLs, dates, and issuer context; and technical data such as IP address, user agent, request and provider identifiers, timestamps, page path, preference-cookie values, usage events, error messages, stack traces, and security or reliability logs. Please do not put unnecessary personal or sensitive information in thesis text, feedback, or error descriptions.

3. Where the data comes from

We receive data from you, your browser and use of the service, authentication and payment providers, email delivery systems, and public sources. Public research providers may return information about companies, officers, authors, or other people mentioned in source material. We may infer limited product states, such as whether an item is unread or whether a public development may support or challenge a thesis claim.

4. Purposes and legal bases

We process account, thesis, research, notification, and billing data to provide the service and take steps you request before a contract. We process tax, accounting, consumer-rights, and compliance records to meet legal obligations. We process limited security, error, abuse-prevention, product-quality, and aggregated usage data for our legitimate interests in protecting, maintaining, understanding, and improving the service, balanced against your rights. Browser analytics starts by default and can be disabled at any time using the control in section 9.

5. AI and automated processing

Company context, public-source material, and your thesis text or claims may be sent to contracted model providers to identify an asset, draft thesis claims, generate search instructions, summarize public developments, and estimate relationships to your thesis. These inputs and outputs are not used to train the model provider's general models by default under the business API settings currently used. We do not use AI output to make a solely automated decision that produces legal or similarly significant effects about you. Billing rules, not model judgment, determine account entitlement. The Terms explain the practical research limits and the source review expected from users.

6. Human quality review

During the beta, specifically authorized reviewers may inspect limited asset context, thesis text or claims, source excerpts, model inputs and outputs, error reports, and feedback when needed to investigate a problem or evaluate reliability. This is targeted quality assurance, not continuous human review of every output. Access is limited to people who need it and is logged where the relevant system supports logging.

7. Service providers and other disclosures

We share only what is reasonably necessary with Supabase for authentication, database, and file storage; Vercel for hosting, workflows, logs, and privacy-focused web analytics; Stripe for checkout, subscriptions, tax, and payment support; Resend for transactional email; OpenAI for model and embedding processing; You.com, Exa, Firecrawl, and Financial Modeling Prep for public research and retrieval; and Telegram for routing support feedback and bounded operational error reports to the operator. Those reports can include account identifiers, email address, page path, error message, stack trace, and technical metadata. A provider is used only when the related feature is configured or invoked.

When checkout names Link or Stripe as merchant of record, it acts independently for the purchase transaction and handles payment collection, transaction taxes, receipts, disputes, transaction support, and refunds it processes. Tracking Alpha remains responsible for product delivery, product support, and the personal data it controls. Checkout terms and the merchant's privacy notice explain its separate processing.

We may also disclose data when legally required, to protect users or the service, to establish or defend legal claims, or during a genuine financing, acquisition, reorganization, or sale subject to appropriate confidentiality and data-protection safeguards. We do not sell personal data or share it for cross-context behavioral advertising.

8. International transfers

Some providers operate in the United States and other countries. Where European data protection law applies, transfers outside the European Economic Area rely on an applicable adequacy decision, approved standard contractual clauses, and supplementary safeguards as required. Contact us to request information about the safeguard relevant to your data.

9. Cookies and analytics

We use cookies or similar local storage that are necessary for authentication, security, navigation, and interface preferences such as sidebar state, filters, and sort order. We do not use advertising cookies. Browser analytics is enabled by default. PostHog records bounded page and product events and stores pseudonymous device and session identifiers; Vercel Web Analytics records page and device information for aggregated traffic statistics without third-party cookies. Query strings and investment content are not intentionally sent in browser analytics events. The control below applies to this browser and can be changed at any time.

10. Retention

Account and product data is generally retained while your account is active. After deletion, user-owned database rows are designed to be removed with the account. Public company and source research shared across users may remain when it no longer identifies you. Payment, tax, legal acceptance, fraud-prevention, security, delivery, and dispute records may be retained for the period required by law or reasonably needed for those purposes. Provider copies and backups follow provider deletion cycles, so removal may not be immediate. Before paid launch, the operator must approve and document a specific retention schedule for these categories.

11. Security

We use measures intended to protect personal data, including authenticated access, role-based database policies, service credentials kept on the server, bounded inputs, and provider access controls. No internet service is completely secure. Please report a suspected account or data incident promptly to support@trackingalpha.app.

12. Your choices and rights

Account settings let you change notification preferences. To request an export of core account data or account deletion, send a request from your account email to support@trackingalpha.app. Depending on where you live, you may also have rights to access, correct, erase, restrict, or port personal data; object to processing based on legitimate interests; withdraw consent without affecting earlier lawful processing; and complain to a data-protection authority. These rights can have legal limits, and we may need to verify your identity. If European data protection law applies, you may complain to the authority where you live or work or where you believe an infringement occurred.

A transaction-data request made to Link or Stripe does not by itself delete your Tracking Alpha product account. Contact us from your account email for that separate request.

13. Children

The service is for adults and is not directed to anyone under 18. If you believe a minor provided personal data, contact us so we can investigate and remove it where appropriate.

14. Changes

We will publish and date material updates. Where required, we will give notice or request renewed agreement before a change takes effect. Continued access will not be treated as consent where law requires an affirmative choice.