How we collect, use, and protect your information.
Effective: May 1, 2026
When you create an account, we collect your name, email address, and password (stored as a bcrypt hash). If you use Google OAuth, we receive your Google profile name and email.
We collect data about how you use the platform, including screening activity, portfolio operations, and feature usage. This helps us improve the product and enforce rate limits.
Payment processing is handled entirely by Stripe. We never store credit card numbers, bank accounts, or other payment credentials on our servers. We receive confirmation of payment status from Stripe to manage your subscription.
Your data is stored in a PostgreSQL database hosted on Railway. All connections use TLS encryption. Passwords are hashed with bcrypt. JWT tokens expire after 60 minutes, and refresh tokens expire after 30 days.
API keys for MCP access are stored as salted SHA-256 hashes. The plaintext key is shown once at creation and never stored.
We use the following third-party services:
Each service processes data according to their own privacy policies. We only share the minimum information required for each service to function.
Your account data, portfolios, and trade history are retained for as long as your account is active. After account deletion, data is removed within 30 days. Cancelled subscriptions retain data for 90 days before deletion.
We use localStorage for authentication tokens, theme preference, and report configuration. We do not use third-party tracking cookies or advertising pixels.
We may update this policy as our service evolves. Material changes will be communicated via email to all registered users.
For privacy-related questions or data requests, contact us at support@heyremora.com.