Privacy Policy
What we collect, how we use it, who we share it with, and your rights.
Privacy Policy
Effective date: 2026-09-14
Version: 2026-09-14
Plain English: We collect very little. Email + password to log you in, plus security/audit metadata. No analytics. No advertising. No third-party tracking. If you use the Pro+ AI assistant, your conversations are saved so you can pick them back up — stored under a random pseudonym in a separate database, not next to your account (see §10.1). We use AES-256 to encrypt secrets and PBKDF2-SHA256 (600,000 iterations) to hash passwords.
1. Who We Are
This Privacy Policy describes how [ENTITY NAME] ("Provider", "we", "us", "our") collects, uses, retains, and shares personal information through the Market Sniper service (the "Service").
If you have any questions, contact:
- Privacy: [email protected]
- Legal: [email protected]
- Postal: [ENTITY NAME], Attn: Privacy, [REGISTERED ADDRESS]
2. Personal Information We Collect
We collect the minimum personal information needed to operate the Service. We do not maintain analytics SDKs, advertising pixels, social-media beacons, or cross-origin trackers.
2.1 Information You Provide
| Category | Data | Purpose |
|---|---|---|
| Account credentials | Email address; password (hashed, never stored in plaintext) | Account creation, authentication, recovery |
| Game identity link (optional) | The username, character name, or in-game handle you choose to associate with a supported game | Personalization of in-game data displays |
| Subscription information | Plan code (free / pro / pro+); subscription status | Entitlement enforcement |
| Support correspondence | Contents of any email or message you send to us | Responding to your request |
| AI conversations (Pro+) | The messages you exchange with the Pro+ AI assistant, stored under a random pseudonymous identifier in a separate conversation database (see §10.1) | Saving your chats so you can resume them; improving our own AI, anonymized (§10.1) |
| Legal acceptances | The fact that you accepted a particular version of a particular legal document | Compliance recordkeeping (see §6) |
2.2 Information Collected Automatically
| Category | Data | Purpose |
|---|---|---|
| Session metadata | Session token (hashed); CSRF token; session creation/expiry timestamps | Authenticated access |
| Session fingerprint | A one-way SHA-256 hash of (User-Agent string, Accept-Language header, screen resolution, timezone offset) — the fingerprint is irreversible; the underlying browser values are not retained | Device-binding for audit integrity (FINRA-aspirational posture) |
| Geolocation (audit-only) | When a privileged operator action or sensitive event is recorded, we resolve the request's IP address to country / region / city via the offline MaxMind GeoLite2 database. The IP and resolved geo are stored on the audit row only, not on your user profile | Security audit, fraud detection, compliance reporting |
| Cookies | See the Cookie Policy for the full list. We use only first-party, strictly-necessary cookies (session, CSRF and trusted-device) and first-party functional storage. We do not set third-party cookies | Authentication; CSRF defense; first-party UI preferences |
2.3 Information We Do NOT Collect
We affirmatively do not collect:
- your real name (we do not ask)
- your phone number
- your street address (other than for billing if/when payment processing is activated — handled by the payment processor, not by us)
- your government-issued ID
- analytics or behavioral telemetry beyond what is required to deliver and secure the Service
- third-party advertising data
- social-media identifiers
If a form ever asks for this information in the future, this Privacy Policy will be updated and material change handling will apply (see §11).
2.4 Information from Game Publishers
We retrieve publicly available market data from game publisher APIs. This data is about the game economy as a whole, not about you personally. We do not retrieve, request, store, or process your individual game-account credentials, your game-account email, your character roster, your inventory, or any other private information from a game publisher.
2.5 Children
The Service is intended for users 18 years of age or older. Users between 13 and 17 may use the Service only with verifiable parental consent. We do not knowingly collect personal information from anyone under 13. If we learn we have collected personal information from a child under 13, we will delete it promptly. If you believe we have collected information from a child under 13, contact [email protected].
3. How We Use Personal Information
We use personal information to:
- create and authenticate your account;
- deliver, operate, maintain, and improve the Service;
- operate the Pro+ AI assistant, including saving your conversations so you can resume them, and improving our own AI models from anonymized conversation and feedback data (see §10.1);
- enforce subscription tiers and entitlements;
- process payments (when paid billing is activated — by sending non-payment-instrument metadata to our payment processor);
- secure the Service (rate limiting, abuse detection, fraud prevention, audit logging);
- respond to your support requests;
- record your acceptance of legal documents (Terms of Service, Privacy Policy, Risk Disclosure, etc.) for compliance evidence;
- communicate with you about your account, security incidents, material changes to terms, and (if you opt in) product updates;
- comply with applicable laws and respond to lawful requests from authorities;
- exercise or defend our legal rights.
We do not use personal information for advertising, profiling for advertising, sale, or rent. We do not train any third-party machine-learning model on your personal information.
4. Legal Bases (EEA, UK, and similar regimes)
Where we process personal data of individuals subject to GDPR, UK GDPR, or similar regimes, we rely on the following legal bases:
| Activity | Legal basis |
|---|---|
| Account creation, authentication, delivery of the Service | Contract performance (Article 6(1)(b) GDPR) |
| Security, audit logging, fraud prevention | Legitimate interests (Article 6(1)(f) GDPR) — securing our infrastructure and protecting users |
| Recording legal acceptances | Legal obligation (Article 6(1)(c)) and legitimate interests |
| Marketing communications (opt-in only) | Consent (Article 6(1)(a)) |
| Responding to legal requests | Legal obligation |
You may withdraw consent at any time where consent is the legal basis. Withdrawal does not affect the lawfulness of processing before withdrawal.
5. Sub-Processors (Service Providers We Share Information With)
We share personal information only with sub-processors that perform a service on our behalf, under contract, with confidentiality and security obligations.
5.1 Currently Active
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| MaxMind, Inc. (GeoLite2) | Offline IP-to-geolocation database (file-based — runs on our servers; no API calls to MaxMind from production) | None (offline lookup) | N/A |
5.2 Planned (Activated as Features Land)
The following are not yet active. They become active as the corresponding features ship; the active list above will be updated.
| Sub-processor | Purpose | Data shared (when active) |
|---|---|---|
| Stripe, Inc. | Payment processing | Email; subscription status; payment-instrument metadata (Stripe handles your full payment instrument; we do not see card numbers) |
| Email service provider (TBD) | Transactional email (account verification, security alerts, billing receipts) | Email address; message content |
| AI / LLM provider (TBD) | Pro+ AI synthesis and AI coach features | Aggregated, de-identified market-data prompts; no PII transmitted |
We will update this list and notify users by in-app notice plus email when a new sub-processor becomes active. A request to be notified by email about new sub-processors can be made to [email protected].
5.3 Other Disclosure Scenarios
We may also disclose personal information:
- in response to a subpoena, court order, regulatory request, or other lawful demand (we evaluate every request and challenge overbroad ones);
- to enforce our Terms or protect our rights, our users' rights, or the public's rights;
- in connection with a corporate transaction (merger, acquisition, financing, sale of assets, bankruptcy) — with notice and the opportunity for you to delete your account before the transfer takes effect.
We do not sell personal information. We do not "share" personal information for cross-context behavioral advertising as that term is defined under the California Privacy Rights Act.
6. Data Retention
| Data | Retention period |
|---|---|
| Account record (email, password hash, account state) | For the life of the account, plus 90 days after account closure (to handle billing reconciliation, fraud investigation, support follow-ups) |
| Session records | Per SESSION_TTL_SECONDS configuration (sessions expire and are revoked) — closed sessions are retained 90 days for security audit |
| Subscription / billing records | 7 years for tax, audit, and dispute resolution purposes |
Audit logs (privileged_action_audits, legal_acceptances, legal_documents) | Indefinitely, consistent with our FINRA-aspirational compliance posture. Audit data is append-only at the database layer; deletion is enforced-disabled by trigger |
| AI conversations (pseudonymous store) | Until you delete the chat. Closing your account does not delete your conversations — they are retained under the pseudonymous identifier, both to meet our record-retention obligations and to improve our own models. On account deletion the link between you and that pseudonym is severed immediately and cannot be recreated (see §10.1) |
| AI feedback working copies (pseudonymous store): a reply you marked, the message it answered with names, handles and contact details removed, and your mark (see §10.1) | 30 days from when you make the mark, then permanently deleted. Deleted sooner if you undo the mark before it is added to our training set, or delete the chat it belongs to |
| Anonymous AI training records: the anonymous copy of your answer to an AI follow-up, and the anonymous record made from a mark (see §10.1) | Indefinitely. They contain no username, no account identifier and no other personal information, so they are kept as anonymous market data, and closing your account does not remove them |
| Support correspondence | 3 years |
| Server logs (request logs, error logs) | 90 days |
| Cookies | See the Cookie Policy |
If you exercise a deletion right (see §7), we will delete or anonymize personal information in the account record and operational stores, but we will retain audit-relevant data (legal acceptance evidence, security audit logs) where retention is required by law or necessary to defend legal claims.
7. Your Rights
Depending on your location, you may have some or all of the following rights:
- Access — request a copy of the personal information we hold about you.
- Correction — request that we correct inaccurate or incomplete information.
- Deletion — request that we delete your personal information (subject to retention obligations described in §6).
- Portability — request your personal information in a structured, commonly used, machine-readable format.
- Restriction — request that we restrict processing of your personal information.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent.
- Lodge a complaint — with a supervisory authority (your local data protection authority in the EEA/UK; the California Privacy Protection Agency in California; equivalent bodies elsewhere).
7.1 California-specific rights (CCPA / CPRA)
California residents have the right to know what personal information we collect, to whom we disclose it, and to request deletion. We do not sell personal information and do not "share" personal information for cross-context behavioral advertising. We do not engage in profiling that produces legal or similarly significant effects. California residents may also opt out of any future "sale" or "share" via [email protected] — though as of the version date of this Policy, neither activity is occurring.
7.2 How to Exercise Rights
In the app. If you are signed in, you can exercise your access, portability, and deletion rights directly: Download my data and Delete my account are available in your account settings. Both require a second authentication step before they run, so that no one holding your session can export or destroy your account without it.
Download my data returns your own account record — your account and subscription details, your settings and preferences, your username and watchlists, and your acceptance history. It does not include our own market calculations, scores, or derived analytics: those are our analysis of public market data, not personal information about you.
Delete my account removes your account and the personal profile derived from your use of it. As described in §10.1, your AI conversation transcripts are retained under a random pseudonym and the link between those transcripts and you is destroyed — after deletion there is no way for us to connect them back to you. Individual chats you delete yourself are removed outright.
By email. You may instead send any request in §7 to [email protected] from the email associated with your account. We will verify your identity (typically by confirming the request from the account email, plus a follow-up authentication step) and respond within thirty (30) days, or such other period as required by law.
Our staff can see that a data request was made, so that we can support it and follow up with you. Making a request never delays, restricts, or conditions the request itself.
8. International Data Transfers
We are based in the United States and our infrastructure is hosted in the United States. If you access the Service from outside the United States, your personal information will be transferred to and processed in the United States. We rely on appropriate safeguards (standard contractual clauses where applicable, plus the security measures described in §9) for such transfers.
9. Security
We implement reasonable technical and organizational measures to protect personal information, including:
- Passwords are hashed with PBKDF2-SHA256 at 600,000 iterations (
werkzeug.security.generate_password_hash). We never store passwords in plaintext. - System secrets (API keys, third-party credentials) are encrypted at rest with AES-256-GCM in our SysAdmin Secrets Vault, with key-encryption-key (KEK) material loaded from environment at boot and fail-closed if missing.
- Session tokens are stored as SHA-256 hashes; the raw token is held only by the user's browser.
- Sessions carry an irreversible device fingerprint (one-way SHA-256 hash of UA / Accept-Language / screen resolution / timezone offset) for audit binding.
- Audit logs are append-only at the database layer (SQLite
BEFORE UPDATE/BEFORE DELETEtriggers fail-closed at boot; tampering is detectable). - Transport is TLS for all network traffic.
- Access to production data is gated by RBAC with audit logging of every privileged action.
No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.
In the event of a personal data breach, we will notify affected users without undue delay, and in any case within 72 hours where required by GDPR or similar law.
10. AI Features and Pro+ Tier
When you use Pro+ AI synthesis features (e.g., "Deep AI synthesis", "AI coach"), the inputs to those features are derived from publicly available market data and your own usage context. We do not transmit your account email, password, payment information, or other PII to any AI provider as part of feature-input prompts. AI outputs are subject to the disclaimers in the Risk Disclosure document — they are tools, not advice.
We do not permit AI providers to train their models on our prompt traffic. Where the AI provider's terms allow training-by-default, we explicitly opt out via API parameters where supported.
10.1 Your AI conversations
Saved so you can pick up where you left off. Pro+ AI conversations are saved: you can leave a chat, come back later, and continue it. You can start new chats, rename them, and delete any chat at any time — deleting a chat removes its content from the conversation store.
Stored separately, under a pseudonym. Your AI conversations live in their own database, physically separate from your account record. Inside that store, your chats are keyed by a random identifier that contains nothing about you — not your email, not your username, not your account number. The link between your account and that identifier is held separately, is never shown to any person, and exists only so the Service can show you your own chats. Our own staff tools have no screen that turns a conversation back into an account; doing so is restricted to a logged, break-glass procedure reserved for abuse investigation or legal compulsion.
What the AI sees when you chat. To give useful answers, the AI is shown public market data (including the full price and volume history for an item you're asking about), what is currently on your screen, the preferences you set in your AI settings, and the conversation itself. It is never shown your email, password, payment details, or any other account credentials.
How conversations improve the AI. Your conversations and the optional outcome feedback you give are used to improve our own models, under the same anonymous regime described below in this section: the training copies carry no username, no account identifier, and no personal information of any kind; free text is stripped of names, handles, and contact details. We still do not allow any third-party AI provider to train on your traffic.
When you delete. Deleting a chat removes it from the conversation store. Deleting your account permanently severs the link between you and the pseudonymous identifier — anything remaining in the conversation store can no longer be connected to you, by us or anyone else. Because the identifier is a stored random value rather than anything derived from your account, once that link is gone it cannot be recreated.
Improving our own AI from your feedback (anonymous). There are two ways you can tell us how the AI did, and both are entirely optional.
1. The AI may follow up. From time to time, it may ask about a trade you discussed with it — for example, how a play turned out, or whether you noticed something it didn't. You can reply or ignore it; skipping is completely fine, is not recorded as a refusal, and affects nothing else.
2. You can mark a reply yourself. Under a reply, you can mark it as a good read, or say that something was off. If something was off, you can also pick what: the read itself, the reason why, a move in the market it missed, its timing, the size of the move, stale numbers, or the math. You are never asked to do this, never reminded, and never shown a tally of how often you have.
What that mark records. Whether you marked the reply as a good read or as off, and what was off if you picked it. With the mark we keep a copy of the reply as the AI wrote it, and a copy of the message it answered with names, handles and contact details removed. It also records which item the reply was about, if it was about one, and what market data the AI had actually been given at the time — so that when it misses something, we can tell whether it reasoned badly or was never shown the data. When the answer is the second one, that is a fault in our data pipeline rather than anything about you, and that mark is never added to our training set.
How long it stays yours. A mark is held under your pseudonymous identifier at first, and can be withdrawn during that period: until it is added to our training set, you can undo it, and undoing it deletes the mark and both copies at once. Either way, the mark and both copies are permanently deleted 30 days after you make it. A mark is added to our training set only if it says what was off about a reply that concerned a specific item, and only after at least a day has passed. What is added is an anonymous record: the item, what was off, the time it concerns rounded to the hour where it has one and roughly how long a stretch it covers, the experience level you chose in your AI settings (a default level if you have not chosen one), and a few internal markers recording how the mark was made and whether we were able to check it against the market. It holds no text at all — not the wording of the reply, and nothing you wrote — and no username, no account identifier and no other personal information. That record is kept indefinitely (see §6). If you delete your account before a mark is added, the mark is deleted instead.
If you reply to a follow-up, your answer is used in two separate ways:
- To help your own advisor (Pro+): it helps the AI remember how you like to trade, so it becomes more useful to you. This stays tied to your account, and deleting your account deletes it — the advisor's memory of you is not retained. That is different from your conversations, which are kept under the pseudonymous identifier with the link to you severed (see §6 and §10.1): the conversations are a record we are obliged to keep, while the memory is only a convenience for you, so it goes when you do.
- To improve our models, anonymously: a copy of the market observation — carrying no username, no account identifier, and no personal information of any kind — is added to an anonymous dataset we use to refine our own AI. That copy is anonymous by construction: it holds no link back to you, free text is stripped of names, handles, and contact details, and timestamps are coarsened. Because it contains no personal information, it is retained as anonymous market data, not as data about you.
This is separate from, and does not change, the paragraph above: we still do not let third-party AI providers train on your prompt traffic. This is our own model improvement, built only from feedback you choose to give. By using the AI features you agree to this anonymous collection as described here; if you would rather not contribute, simply don't answer the follow-up questions and don't mark any replies — both are opt-in by doing, and doing nothing contributes nothing.
Corrected 2026-09-14. The previous version of this section described things the Service does not do. It said you could point at a stretch of time on the chart and add a short note to a mark; neither option exists. It said the permanent copy keeps the wording of the reply you marked; the permanent record holds no text at all. And it said a mark that shows a gap in our data is used to fill the gap; no process does that, and such a mark is never added to our training set. §6 also gave anonymous AI training copies "a minimum of 30 days" and said they are deleted once used; the working copies are deleted after 30 days whether used or not, and the anonymous records are kept indefinitely. §6 now lists both as they are kept.
Also corrected 2026-09-14 — in the Service, not in this policy. Two of the promises above were true of only part of what we keep. Free text was stripped of names, handles and contact details where you typed it, but not from the values recorded alongside it — the figures sent with your answer to a follow-up, or the description of what was on your screen when the AI spoke. And of the times on an anonymous record, one was rounded to the hour while the others were exact. We have changed the Service so that both promises now hold for the whole record — every piece of text on it is stripped, and no time on it is finer than the hour — rather than narrowing what this section claims. We have now checked this twice and found another place each time, so the promise is written as a property of the whole record rather than a list of the parts we happened to remember. What we remove are the identifiers we can recognise: an email address, a handle, a link, a long run of digits, and any username we know is yours. A personal detail written as ordinary prose is not something we can find, so please keep personal details out of a note about a trade.
Where our AI runs. Our AI runs on hardware we own and operate. We do not send your conversations, your marks, or anything you write to a third-party AI provider — not for answering, and not for training. This is a deliberate choice about where your data lives, not only a promise about how it is used.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by in-app notice and email and will require fresh affirmative acceptance. Non-material changes (clarifications, formatting) will be reflected by an updated version date without forced re-acceptance. The current effective version and full version history are available at /legal/privacy.
12. Contact
For privacy questions, requests, or complaints:
[ENTITY NAME]
Attn: Privacy
[REGISTERED ADDRESS]
[email protected]
Last updated: 2026-09-14