Last updated: July 28, 2026

When you create an account, we collect your email address and password (handled by our authentication provider, Supabase — we never see or store your password in plain text). We also store:

• Your watchlist — the securities you choose to follow
• Responses you submit to in-app surveys
• Usage data tied to your account (e.g. time spent using the service), used to manage trial and post-trial access
• Subscription and billing status (plan type, trial dates, cancellation date) — the underlying payment details (card numbers, etc.) are handled entirely by Stripe; we never receive or store them

We do not collect any data beyond what is described here. We do not sell your personal data to anyone.

To operate your account (authentication, trial/subscription status), to remember your watchlist and preferences, to send account-related emails (e.g. weekly digests, unsubscribe requests), and to understand product usage so we can improve the service.

We use a small number of third-party services to operate Project Goldilocks, each acting as a data processor on our behalf:

• Supabase — authentication and database hosting
• Stripe — subscription billing and payment processing
• Vercel — application hosting
• Cloudflare — domain, DNS, and DDoS protection
• Sentry — error monitoring (technical error data only, not account content)
• Google (Gmail SMTP) — delivery of account and alert emails

None of these providers are permitted to use your data for their own purposes. We do not share your data with any other third party, and never for advertising.

Your account data is retained for as long as your account exists. Weekly database backups are kept on a rolling 12-week basis, after which older backups are automatically deleted.

We use a single session cookie, set by Supabase, to keep you signed in. We do not use advertising or tracking cookies.

You can download a copy of your personal data at any time using the "Export My Data" button on your Profile page. This export includes your account details, watchlist, and survey responses — not the publication's rankings or research content, which is our own generated output rather than your personal data.

You can permanently delete your account and all associated data at any time using the "Delete Account" button on the same page. If you have an active paid subscription, deletion is completed once your current billing period ends, so you are never charged for access you can no longer use.

These rights are available to all users, consistent with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for any users in the European Union, the General Data Protection Regulation (GDPR).

Questions about this policy or your data can be sent to [email protected].

If we materially change what data we collect or how we use it, we will update this page and the "Last updated" date above.