Privacy Policy

We collect only the minimum data necessary to provide the service. We do not sell your personal information to third parties.

Account data

• –Email address — used to create your account, send transactional emails (verification, password reset), and identify you across sessions.
• –Hashed password — stored using bcrypt. We never store your plaintext password.
• –Account tier (free/premium) — used to gate access to premium features.
• –Account creation date.

Paper trading data

• –Tickers, entry/exit prices, trade notes, and dates you enter when creating paper trades.
• –Portfolio positions and P&L calculations derived from your entries.
• –This data is stored on our servers and is associated with your account.

Usage and technical data

• –Server access logs (IP address, browser user-agent, request timestamps) — retained for up to 30 days for security and debugging.
• –We do not use analytics tools that track individual browsing behaviour beyond what your browser sends in standard HTTP requests.

Data we do NOT collect

• –We do not collect your real brokerage account details, real trades, or financial holdings.
• –We do not collect payment card data (Stripe handles payments directly; we receive only a subscription status).
• –We do not collect phone numbers or physical addresses.

• –Authentication — your email and hashed password let you log in and keep your session secure via signed JWT tokens.
• –Transactional email — we send verification emails when you sign up and password-reset emails when you request them. We do not send marketing email unless you explicitly opt in.
• –Portfolio tracking — your paper trade entries are stored so your positions persist across sessions and devices.
• –Service improvement — anonymised, aggregated usage patterns (e.g. which signals are most viewed) may be used to improve the product. This data cannot be linked back to you.
• –Security and abuse prevention — server logs are used to detect and block malicious activity.
• –Legal compliance — we may retain or disclose data if required by applicable law or a valid legal process.

We use a small number of third-party services. Each receives only the data necessary for its function.

Resend (transactional email)

We use Resend to deliver verification and password-reset emails. When we send you an email, your email address and the email content are transmitted to Resend's servers. Resend's privacy policy is available at resend.com/privacy.

Google AdSense

Our free tier is supported by display advertising via Google AdSense. Google may use cookies and device identifiers to serve personalised ads based on your browsing history across sites. This applies to all visitors regardless of whether you have an account.

You can opt out of personalised ads at adssettings.google.com or via your browser's cookie settings. Google's privacy policy is at policies.google.com/privacy.

Stripe (payments)

Premium subscriptions are processed by Stripe. Payment card data goes directly to Stripe and never touches our servers. We receive only a subscription status flag (active/inactive). Stripe's privacy policy is at stripe.com/privacy.

Railway (infrastructure)

Our backend API and database run on Railway. Your account and portfolio data are stored on Railway's servers. Railway is SOC 2 compliant.

Vercel (frontend hosting)

The signalstocks.io website is served via Vercel. Vercel may log standard HTTP request metadata (IP, browser, timestamps) per their infrastructure privacy policy.

We use a minimal set of cookies and similar technologies.

Authentication

Your login state is stored in localStorage (not a cookie) as a signed JWT token. This token is required to access protected pages. Clearing your browser's local storage logs you out.

Advertising cookies (Google AdSense)

Google AdSense sets third-party cookies on your device to measure ad performance and serve personalised advertisements. These cookies may track your activity across websites that display Google ads.

• –Cookie name: _ga, _gid, IDE, DSID, and others set by Google.
• –Purpose: ad targeting, frequency capping, conversion measurement.
• –Duration: varies (session to 2 years).
• –How to opt out: adssettings.google.com, or install an ad blocker.

No tracking cookies from us

We do not set our own tracking or analytics cookies. We do not use third-party analytics platforms such as Google Analytics.

• –Account data is retained for as long as your account is active.
• –If you delete your account, your email and hashed password are marked inactive immediately. Paper trade history is deleted within 30 days.
• –Server access logs are purged after 30 days.
• –Email delivery records held by Resend are subject to their own retention policy.

Depending on where you live, you may have rights under GDPR, CCPA, or similar privacy laws. Regardless of jurisdiction, we honour the following for all users:

Delete your account

Go to Settings → Delete Account. This immediately deactivates your account and queues deletion of your personal data within 30 days.

Access your data

You can view all paper trade data you've entered in the Portfolio section of the dashboard. To request a full export of your account data, email us at the address below and we will respond within 30 days.

Correct your data

You can update your password in Settings. To correct other account information, contact us.

Opt out of personalised ads

Visit adssettings.google.com or use a browser extension to block advertising cookies.

Withdraw consent / opt out (California residents)

We do not sell personal information. If you are a California resident and wish to exercise rights under the CCPA, please contact us at the email below.

We may update this policy as the service evolves. When we make material changes we will update the effective date at the top of this page. Continued use of SignalStocks after a policy update constitutes acceptance of the revised terms.

Questions, data requests, or concerns about this policy? Reach us at:

We aim to respond to all privacy-related requests within 30 days.