Effective: May 1, 2026 · Last updated: October 1, 2026
1. Information We Collect
Account Information
When you create an account, we collect your name, email address, and password (stored as a bcrypt hash). If you use Google OAuth, we receive your Google profile name and email.
Usage Data
We collect data about how you use the platform, including screening activity, portfolio operations, and feature usage. This helps us improve the product and enforce rate limits.
RemoraAI Chat Messages
What you type to RemoraAI in the app, or to the chat widget on our website, is stored so we can see how the assistant is used and what people need. We store your side of the turn — the question, not the assistant's reply — up to 2,000 characters. Messages from the website widget are stored without an account id, because you are not signed in. This is not your conversations in ChatGPT or Claude; those never reach us (see section 8).
Payment Information
Payment processing is handled entirely by Stripe. We never store credit card numbers, bank accounts, or other payment credentials on our servers. We receive confirmation of payment status from Stripe to manage your subscription.
2. How We Use Your Information
- To provide and operate the Remora platform
- To manage your account and subscription
- To send transactional emails (welcome, password reset, trial expiry notifications)
- To send morning briefing notifications you have opted into
- To enforce usage limits and prevent abuse
- To improve platform performance and features
3. Data Storage and Security
Your data is stored in a PostgreSQL database hosted on Supabase. All connections use TLS encryption. Passwords are hashed with bcrypt. JWT tokens expire after 60 minutes, and refresh tokens expire after 30 days.
API keys for MCP access are stored as unsalted SHA-256 hashes of a 256-bit randomly generated token. The plaintext key is shown once at creation and never stored.
4. Third-Party Services
We use the following third-party services:
- Stripe — payment processing and subscription management
- Resend — transactional email delivery
- Anthropic — AI features (the RemoraAI assistant and MCP tools); portfolio data and queries you submit are sent to Anthropic to generate responses
- Supabase — database hosting; account sign-in is handled by Remora's own JWT system, not Supabase Auth
- PostHog — product analytics, including autocaptured interface interactions and session replay of application pages; recordings are retained for 30 days
- Sentry — application error monitoring, server-side only; the browser Sentry DSN is empty, so no telemetry is sent from your browser to Sentry
- X (Twitter) Ads — advertising conversion measurement. A conversion pixel loads in your browser on our production pages and receives conversion events from the site; because it loads directly, X also receives your IP address and user agent. Your email address is SHA-256 hashed in your browser before it reaches the pixel, so the pixel receives a hash and never a plaintext address; the hashing fails closed — if your browser cannot hash it, the field is dropped rather than sent in the clear. Separately, our server sends conversion events to X's Conversions API carrying a SHA-256 hash of your email address, never a plaintext address
- TradingView — the embedded price chart on the screener; it receives the ticker symbol being charted and your browser's connection to it
- Polygon.io — market data (options chains, prices, Greeks)
- Google OAuth — optional sign-in method
- Google Fonts — web fonts loaded from
fonts.googleapis.com and fonts.gstatic.com on most pages; your browser connects to Google directly, so Google receives your IP address and user agent
- Railway — application hosting
Each service processes data according to their own privacy policies. We only share the minimum information required for each service to function.
5. Who We Share Data With
We do not sell your personal data, and we do not share it for advertising profiling beyond the conversion measurement described above. We share it only with the categories of recipient below, and only to the extent each one needs to do its job.
- Service providers (processors) acting on our instructions — the companies listed in section 4. In summary: Railway hosts the application; Supabase hosts the PostgreSQL database; Stripe processes payments; Resend delivers transactional and lifecycle email; PostHog provides product analytics and session replay; Sentry receives server-side error reports; Polygon.io supplies market data; and Anthropic processes the prompts and portfolio data you submit to the in-app RemoraAI assistant.
- Independent third parties your browser contacts directly — TradingView and Google Fonts are not acting on our instructions. Because your browser loads them itself, they receive your IP address and user agent directly, under their own privacy policies, as described in section 4.
- AI assistants you connect yourself — if you connect Remora to ChatGPT, Claude, or another MCP client, that client receives the data its authorized scopes allow. Section 8 describes this in detail. Nothing is shared until you authorize it, and you choose the client.
- Advertising measurement — X (Twitter) Ads receives conversion events, with your email address only ever as a SHA-256 hash, as described in section 4.
- Professional advisers — lawyers, accountants, and auditors, where they need access to advise us.
- Law enforcement and regulators — where we are legally required to disclose, or to protect our rights, our users, or the public.
- An acquirer — if Remora is ever involved in a merger, acquisition, or sale of assets, your data may transfer as part of that transaction. We would notify you by email before it changed hands.
We do not share your data with other Remora users. Portfolios, watchlists, and trade history are private to your account.
6. How Long We Keep Data
- Account, portfolios, watchlists, and trade history — kept for as long as your account exists. Deletion is by request to support@heyremora.com, and we complete it within 30 days of the request.
- Cancelled subscriptions — account data is kept for 90 days after cancellation, so you can resubscribe without losing your history, and is then deleted.
- Payment records — retained by Stripe under its own retention schedule, and kept by us for as long as tax and accounting law requires.
- Product analytics — retained by PostHog under its own retention schedule. Session replay recordings are retained for 30 days and then deleted.
- Error reports — retained by Sentry under its own retention schedule. We configure Sentry not to send local variables, so error reports do not carry the contents of your portfolio.
- MCP tool-call records — when an AI assistant calls a Remora tool, we record which tool ran, whether it succeeded, and how long it took. We do not record the arguments or the results. These are kept while your account exists.
- RemoraAI chat messages — kept while your account exists. Messages from the website chat widget carry no account id, so they are kept until we purge them. There is no automatic expiry on either today; your chat log is removed as part of a deletion request, and you can ask us to clear it at any time without closing your account.
- Options-flow snapshots — the market-wide unusual-activity snapshots behind the flow pages are pruned after 30 days. They are market data and are not specific to you.
- Server logs — kept by our hosting provider for a limited period and then rotated out. We do not use them to build a profile of you.
7. Your Controls
- Access — You can view all your data through the platform at any time.
- Export — Portfolio and trade data can be exported as a PDF report from the platform. For a machine-readable copy of your data, email support@heyremora.com and we will send it.
- Deletion — Deletion is by request: email support@heyremora.com (the Delete account button on the Account page opens the same request) and we complete it within 30 days. The request covers your account, portfolios and trade history, revokes every AI assistant you have connected, and removes your RemoraAI chat log.
- Correction — Update your name and profile information yourself on the Account page.
- Email preferences — Turn the morning briefing and other optional emails on or off on the Account page, or use the unsubscribe link in any one of them. Transactional email about your account and billing cannot be switched off while the account is open.
- Disconnecting AI assistants — Every AI assistant you have authorized is listed under Account → Connected AI apps, where you can revoke any one of them. Revoking takes effect immediately. API keys for local MCP setups are revoked under Account → API Keys.
- Analytics and advertising — Blocking the PostHog and X scripts in your browser stops that collection, and the platform keeps working without them.
- Complaints — If you believe we have mishandled your data, email support@heyremora.com. Depending on where you live, you may also have the right to complain to your local data-protection authority.
8. AI Assistants (ChatGPT, Claude, and MCP Clients)
Remora can be connected to an AI assistant — ChatGPT, Claude, Claude Code, Cursor, VS Code, or any other MCP client — so you can screen options and ask about your portfolio in a conversation. This section explains exactly what that connection does.
You authorize it, and you choose the scopes
Nothing is shared with an assistant until you sign in to Remora from that assistant and approve the connection. A connection asks for read access by default: market data, and your own portfolios and watchlists. Write access — changing a portfolio or saving a configuration — is a separate permission that is only granted if you grant it. An assistant can never see another user's data, and it can never see your password.
Remora cannot trade
Remora has no broker connection. No assistant, and no tool we expose, can place, modify, or cancel a real order, or move money. Everything an assistant gets back is analysis.
We do not see your conversation
Nothing you say to ChatGPT or Claude reaches us. We see only the tool calls those assistants make and their parameters — the ticker, the filters, the portfolio you asked about — never your chat history, your prompts, or the assistant's replies. We log which tool ran, whether it succeeded, and how long it took, so we can keep the service working.
This is about assistants you connect over MCP. RemoraAI, the assistant built into our own app and website, is different: what you type there is ours to store, and section 1 describes what we keep.
The assistant's operator has its own policy
Your conversation itself is held by whoever runs the assistant — OpenAI for ChatGPT, Anthropic for Claude, and so on — under their privacy policy, not ours. What they do with the Remora data that appears in your conversation is governed by their terms.
You can revoke at any time
Tokens are listed under Account → Connected AI apps and can be revoked there, which cuts that assistant off immediately. Access tokens are short-lived, and revoking removes the whole grant and every token in it, not just the current one.
We do not sell this data
We do not sell any data, and we do not use your portfolio or your tool calls to train AI models.
9. Cookies
We use localStorage for authentication tokens, theme preference, and report configuration. We also use third-party cookies and similar identifiers: PostHog sets them for product analytics and session replay, and the X (Twitter) advertising pixel sets them on our pages to measure ad conversions. We do not sell your data.
10. Changes to This Policy
We may update this policy as our service evolves. Material changes will be communicated via email to all registered users.
11. Contact
For privacy-related questions or data requests, contact us at support@heyremora.com. Our support page has everything else.