Privacy Policy

Your email address, when you sign in. It’s how we identify your account and send sign-in links. It’s never shown publicly.

Your Google account ID, if you sign in with Google. Google tells us your email address and confirms it’s verified, along with an ID for your Google account, which we keep so the link to your Stockfiti account holds if your email changes. We don’t get your Google password, contacts or anything else in your Google account.

Your tags: the ticker, message, style and paint you choose, with the time you posted and the symbol’s delayed price at that moment (to show how it has moved since). Tags are public by design. We record which account posted each tag, and the result of our automated moderation checks. If you have a handle when you post, the tag shows it and appears on your public profile; tags posted without a handle, or before profiles existed, stay anonymous.

Your handle, profile, comments and reactions. The handle you pick is shown publicly on your comments and on tags you post with it. Your profile page (/u/your-handle) shows those tags, the month you joined, and how many tags, reactions received and comments you have; it never shows your email, and it’s kept out of search results. Comments and replies are public, as are reaction counts; we record which account left each comment, reaction and like, so you can undo them and so limits apply.

Because tags and comments are public, search engines can index them (with the handle on each comment or tag), and they appear in link previews when someone shares them on other sites.

Symbols you follow and your notifications. We keep the symbols you follow, to send the Monday email and alerts about them, and a record of reactions, comments and replies on your tags and comments, and of alerts on your symbols, to show you in your notifications. Both are private to you.

Your bull and bear calls. If you add a call to a tag, it’s public with the tag, along with how it turned out once it’s scored. If the tag shows your handle, the call counts toward the record on your profile and can put your handle on the public leaderboard.

Discord channels you connect. If you connect a Discord channel, we keep its webhook URL, the name Discord gives it, and the tickers you chose, so we can post tags there. The URL works like a password for posting to that channel, so we never show it again after you add it.

A hashed version of your IP address. We store a salted one-way hash (not the address itself) with tags, reports, comments, sign-in requests and contact messages, to enforce rate limits and prevent abuse. Our web server also keeps standard access logs, which include IP addresses, for about 14 days; our application logs leave the address out.

Reports and messages you send us: the reason you give when reporting a tag or comment, which we record against your account so each person reports something once (the person you report isn’t told who it was), and anything you write in the contact form.

Usage and error data, if enabled: page views, clicks and recordings of how pages are used (PostHog), and crash reports with technical details about your browser (Sentry). Text you type into forms is masked and not captured.

Ad measurement and site analytics. Our pages run the Google tag for Google Ads and Google Analytics. It tells us how well our ads work (whether visitors who came from one of our Google ads go on to sign up or subscribe) and how people find and use the site (pages visited, where visits come from, and general device and location information). It uses Google cookies and sends Google your IP address and the pages you visit. We’ve turned off ad personalization, so Google doesn’t use this to build audiences or show you targeted ads.

Bot checks. On the contact form, the sign-in form and the admin sign-in, Cloudflare Turnstile checks that a person is sending it. It looks at technical signals from your browser and device, and we send Cloudflare your IP address to verify the result. It isn’t used for advertising.

• to run Stockfiti: sign you in, show your tags, and count your daily limit;
• to keep it safe: moderate content, handle reports, and stop spam, abuse and market manipulation;
• to answer your messages and send service emails (sign-in links, important changes);
• to send the Monday email about the symbols you follow, which you can turn off on your account page or from any of those emails;
• to email you alerts when a symbol you follow flips bullish or bearish or is tagged far more than usual, which you can also turn off on your account page or from any alert;
• to email you when a stock you follow is a week from reporting earnings, so you can make your call, which you can turn off on your account page or from any of those emails;
• to post the day’s top public tags to Discord channels members connect, and to Stockfiti’s own social accounts;
• to understand how the site is used and fix problems;
• to measure how well our ads work (not to target ads to you);
• to meet legal obligations and enforce our Terms.

We process your data to provide the service you asked for (contract), to keep it secure and improve it (legitimate interests), to comply with the law (legal obligation), and, for optional analytics where required, with your consent.

We don’t sell your personal information or share it for targeted advertising. We share it only with providers that run parts of Stockfiti for us:

• Amazon Web Services: hosting, database backups, and sending email;
• Cloudflare: the Turnstile bot check on our sign-in and contact forms;
• Google: Sign in with Google, if you use it, Google Analytics, and measuring our Google Ads, with ad personalization turned off;
• PostHog: product analytics, if enabled;
• Sentry: error reporting, if enabled.

Public tags, including the handle shown on them and any call, can be posted to Discord channels that members connect and to Stockfiti’s accounts on X and other social sites. Those sites handle them under their own privacy policies. We don’t send them your email or anything else that isn’t already public on the tag.

We may also disclose information if the law requires it, to protect the rights and safety of users or the public, or as part of a merger or sale of the business, in which case this policy continues to apply to your data.

We use one essential cookie, stockfiti_session, to keep you signed in (up to 30 days). Staff use a separate admin cookie. Your browser’s local storage keeps an unsent tag draft and where to return after signing in, and nothing leaves your device from there.

If analytics is enabled, PostHog sets its own cookie to recognize repeat visits.

When the sign-in window opens, Google’s sign-in button loads from Google, and Google may set its own cookies to show it and to sign you in.

The Google tag sets Google cookies to measure our ads, such as whether a visit that started from one of our ads led to a sign-up, and for Google Analytics to recognize repeat visits. Ad personalization is turned off, so they aren’t used to target ads to you.

• Account records: while your account exists.
• Tags: until we remove them. Tags can’t be deleted from the site; email us to have one of yours taken down. If you delete your account, you can ask us to remove your tags too; otherwise they stay up, no longer linked to you.
• Comments: until you delete them or we remove them. A deleted comment that has replies stays as a “deleted” placeholder with no text or handle. If you delete your account, your comments stay up without your handle unless you ask us to remove them.
• Reactions and likes: until you undo them or your account is deleted.
• Followed symbols and notifications: until you unfollow, or the tag or comment they’re about is removed, or your account is deleted. Alerts on symbols stay in your notifications until your account is deleted.
• Connected Discord channels: until you disconnect them, the webhook is deleted in Discord, or your account is deleted.
• Sign-in links: deleted about a day after they expire.
• Contact messages and reports: as long as needed to handle them and keep a record.
• Database backups: 30 days.

You can ask to access, correct, export or delete your personal information, or object to or restrict how we use it, by emailing legal@stockfiti.com from the address on your account. We’ll respond within the time the law requires (usually 30 days). We won’t treat you differently for exercising these rights.

California residents have these rights under the CCPA; we don’t sell or share personal information as those terms are defined there. If you’re in the EEA or UK, you can also complain to your local data protection authority.

We use encryption in transit (HTTPS), hash IP addresses and sign-in tokens, keep secrets out of our code, and limit who can access production systems. No system is perfectly secure; if we learn of a breach affecting your data, we’ll notify you as the law requires.

Stockfiti isn’t for children under 13, and we don’t knowingly collect their information. If you believe a child has signed up, contact us and we’ll delete the account.

Stockfiti is run from the United States, and your information is stored there. If you use it from elsewhere, your information will be transferred to the US.

We’ll update the date at the top when this policy changes, and tell signed-in users by email or on the site before material changes take effect.

X & Company LLC, 506 Traveler Ln, Madison, WI 53718. Email legal@stockfiti.com, or use the contact form and choose “Privacy.”