Privacy

• Account — your email address and an identifier from our authentication provider. Passwords are never stored by us; sign-in is handled by Clerk.
• What you write — your theses, criteria, positions, fills, notes, and reviews. This is the product; it's yours.
• Venue connections — if you connect a venue, the wallet address (not a secret) and a read-only session key, which is encrypted at rest with AES-256-GCM before it touches the database. It is used only to read your positions, never to trade.
• Alerts — the email address you choose for watcher alerts, which may differ from your account email.
• Billing — your plan and the customer/subscription identifiers issued by Stripe. We never see or store your card details; payment data goes directly to Stripe.

No advertising trackers, no third-party analytics scripts, no cross-site profiling. We don't sell or rent personal data to anyone, and we don't use your journal content to advertise to you. The only cookies we set are the ones the product needs: your session, and a referral code if you arrived through someone's link.

Theses, positions, and watcher alerts are scoped to your account — other users cannot see them. The one exception is deliberate: a receipt page you share is public by design, and shows only the process record (title, statement, dates, criteria counts, status, and — once closed — the return as a multiple of your risk budget). Receipts never include dollar amounts, position sizes, wallet addresses, or venue details.

We use a small number of subprocessors:

• Clerk — authentication and account management
• Neon — the Postgres database
• Vercel — web hosting
• Fly.io — the background worker that runs watchers and venue syncs
• Stripe — payments and subscription billing
• Resend — alert and notification email

These providers operate in several countries, so your data may be processed outside where you live. Market and news data we read (for example public options data and news-volume indices) is fetched without sending your personal information.

Traffic is encrypted in transit. Venue session keys are encrypted at rest with AES-256-GCM using a key held outside the database, and the web app never transmits them to a venue — only the background worker decrypts them, and only to read positions. We ask for read-only keys and tell you to revoke them at the venue whenever you like. No system is perfectly secure; don't give any application a key with more permission than it needs.

Email support@tally.markets from your account address to get a copy of your data, correct it, or have your account and its contents deleted. Deletion removes your journal, connections, and preferences; we keep the minimum billing records we're required to retain for tax and accounting purposes. Depending on where you live you may have additional statutory rights (for example under GDPR or UK GDPR) — those apply, and the same address reaches us.

You can disconnect a venue at any time from your dashboard, and turn alert emails off from the same place.

We keep your journal for as long as your account exists — closed and abandoned theses included, because the record is the point. If we materially change this policy we'll post the update here with a new date. Questions: support@tally.markets.