Privacy Policy

1. Who We Are

Stock Insight (the "Service") is operated by the operator of Stock Insight (the "Operator", "we", "us"), a sole trader based in Australia (ABN 35 717 967 868). This Privacy Policy explains what personal information the Service collects, why, who it is shared with, how long it is kept, and the choices you have. It sits alongside our Terms of Service & Legal Disclaimers; capitalised terms not defined here have the meaning given there.

For privacy enquiries or to exercise any of the rights described below, contact the Operator via the contact method published on the Service.

2. Information We Collect

We collect only what we need to operate accounts and produce reports:

• Account & identity: when you sign in, our identity provider (Google Firebase Authentication) supplies your email address, a stable user identifier, and your display name, which we use to create and recognise your account.
• Authentication cookie: a single HttpOnly session cookie (__session) is set when you sign in, so that report pages you open in a new tab can confirm it is you. It lasts up to 14 days and is used only to authenticate read-only report navigation.
• Usage & log data: records of the analyses you request — such as the ticker, chosen report language, timestamps, and job status — together with standard server logs generated as the Service runs.
• Account state: your plan/tier, remaining credits, quota-reset date, and (if you purchase a paid plan) a customer and subscription identifier issued by our payment processor. We do not see or store your full card number.
• Theme preference: your light/dark choice is stored locally in your browser (localStorage) and is never sent to or stored on our servers.

What we do not collect: we do not collect financial-profile data such as income, net worth, or risk tolerance; reports contain no personal information about you; and we do not run advertising, analytics pixels, or third-party tracking cookies.

3. How & Why We Use It

We use the information above to: create and authenticate your account; generate, store, and serve the reports you request; apply free-tier limits and (where applicable) process paid plans; keep the Service secure and diagnose problems; and meet our legal obligations. Where a legal basis is required (for example for users in the EU/UK), we rely on performing our contract with you to operate your account and deliver reports, and on our legitimate interest in keeping the Service secure and working.

We do not sell your personal information, and we do not use it for advertising or automated decisions that produce legal or similarly significant effects about you.

4. Who We Share It With

We share personal information only with the service providers that help us run the Service, and only as needed for them to perform that function:

• Google Firebase Authentication — verifies your sign-in and issues your session cookie.
• Google Cloud (Firestore & Cloud Storage) — stores account records, job metadata, and rendered report files.
• Payment processor (Lemon Squeezy) — handles checkout and subscriptions for paid plans; it processes your payment details under its own privacy policy.
• Market & logo data providers — Financial Modeling Prep (market data) and logo.dev (company logos) receive the ticker being analysed, not your identity.

Several of these providers operate globally, so your information may be processed in countries outside your own, including the United States. We rely on the providers' contractual and legal safeguards for such transfers. We may also disclose information where required by law or to protect the rights, safety, and security of the Service and its users.

5. How Long We Keep It

• Session cookie: up to 14 days, after which you are signed out and must re-authenticate.
• Rendered reports: retained for up to 365 days, then automatically deleted from storage.
• Account record & job history: kept while your account is open, and removed when you delete your account (see below).

We may retain limited records for longer where necessary to comply with legal obligations, resolve disputes, or enforce our agreements.

6. Your Choices & Rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to object to or restrict certain processing. We honour these rights for all users wherever practicable:

• Delete your account: you can permanently delete your account and its data yourself from your account page at any time. This removes your account record and the analysis jobs you own (which also withdraws your reports and disables their links).
• Access or correct your information: contact the Operator via the published contact method and we will help you review or correct your details.

You will not be charged or treated differently for exercising these rights. If you believe we have mishandled your information, you may also lodge a complaint with your local data-protection authority — in Australia, the Office of the Australian Information Commissioner (OAIC).

7. Cookies

The Service uses a single, strictly necessary authentication cookie (__session) so that report pages opened in a new tab can confirm you are signed in. We do not use advertising or analytics cookies, and we do not track you across other websites. Your light/dark theme preference is stored in your browser's local storage, not in a cookie. Blocking the authentication cookie will prevent you from viewing your reports.

8. Security

We take reasonable technical and organisational measures to protect your information, including authentication over encrypted connections, an HttpOnly session cookie, and storing reports in a private, access-controlled location. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Children

The Service is intended only for people aged 18 or over, consistent with our Terms of Service. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Updates take effect when posted on this page with a revised "Last updated" date, and material changes will be announced via the Service or by email where reasonably practicable. Continued use of the Service after an update takes effect means you accept the updated policy.