Privacy Policy

1. Scope

This policy explains how Dilldrup LLC, doing business as Stonks Computer ("we", "us"), handles personal information in connection with the Stonks Computer website and application (the "Service"). It does not cover third-party sites you reach from here.

This policy is versioned. The version and effective date appear at the top. When you created your account we recorded which version you accepted.

2. Information we collect

Account information you give us:

• your email address, which is also your login identifier;
• a cryptographic hash of your password — we never store the password itself;
• your account role and status, and the time of your last sign-in;
• a record of which version of our Terms of Service and Privacy Policy you accepted, when, and the IP address and browser user-agent the acceptance came from.

Information created as you use the Service:

• strategies, analyzer configurations and schedules you create;
• analysis runs, strategy runs, backtests, training jobs and their results;
• stocks you favourite and stocks you have recently viewed;
• share links you generate, and the results they point to.

Technical information:

• a session cookie that keeps you signed in (see section 5);
• server logs containing IP address, timestamp, request path, response status and user-agent, generated by our web servers and by our network provider.

3. How we use it

• to operate the Service — authenticate you, run the analyses and jobs you request, and show you your own results;
• to keep the Service secure and to investigate abuse, fraud and outages;
• to maintain a record of agreement to our Terms and this policy;
• to communicate with you about your account — verification, security notices, and material changes to these documents;
• to comply with legal obligations and to establish or defend legal claims.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it to build advertising profiles. We do not use your personal information to train machine-learning models offered to other users; the models in the Service are trained on market and financial data, not on user data.

4. Who else processes it

We use a small number of infrastructure providers who process data on our behalf, under contract and for no purpose of their own:

• Amazon Web Services — application hosting, database, cache and object storage, in the US East (Ohio) region;
• Cloudflare — DNS, TLS termination, network protection and, while the Service is in private preview, the access gate in front of it.

We may also disclose information if required by law, subpoena or other legal process, or where necessary to protect our rights, safety, or the security of the Service — and, if we are ever involved in a merger, acquisition or sale of assets, to the counterparty, subject to this policy.

5. Cookies

We use one cookie that matters: a signed, HTTP-only session cookie that keeps you signed in. It is set with SameSite=Lax, is marked Secure in production, expires after 30 days, and cannot be read by JavaScript. It holds your user id, role, email and an API token for our own backend.

We do not use advertising cookies, third-party analytics cookies, or tracking pixels. Our network provider may set its own operational cookies for security and access control. Clearing cookies signs you out.

6. How long we keep it

• account information: for as long as your account exists, and then for up to 30 days after deletion in backups;
• content you create (strategies, runs, backtests): until you delete it, or until your account is deleted;
• records of agreement to these documents: for as long as your account exists and for six years afterwards, because their purpose is to evidence what was agreed;
• server logs: up to 90 days, except where retained longer for an active security or legal matter.

7. Security

Traffic is encrypted in transit with TLS. Passwords are stored only as salted hashes. Databases are not reachable from the public internet, and administrative functions require a separate, separately-authenticated console. Access to production systems is limited to those who need it.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information we will notify you as required by law.

8. Your rights

Wherever you live, you can ask us to give you a copy of your personal information, correct it, or delete it. Write to [email protected] from your account email and we will respond within 30 days.

If you are a California resident, the CCPA/CPRA gives you rights to know, delete, correct, and to opt out of sale or sharing — we do not sell or share personal information as those terms are defined, so there is nothing to opt out of — and the right not to be discriminated against for exercising them.

If you are in the European Economic Area or the United Kingdom, you additionally have rights to restrict or object to processing and to data portability, and you may complain to your local supervisory authority. Our lawful bases are performance of a contract (operating the Service), legitimate interests (security, preventing abuse) and legal obligation.

9. International transfers

The Service is operated from the United States and personal information is stored and processed there. If you access it from elsewhere, you are transferring information to the United States, which may not provide the same level of protection as your home jurisdiction.

10. Children

The Service is not directed to anyone under 18 and we do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

11. Changes to this policy

We may revise this policy. Each revision gets a new version number and effective date published at this address. If a revision materially changes how we handle your information, we will make reasonable efforts to notify you before it takes effect.

12. Contact

Questions, or to exercise any right in section 8: [email protected].