Privy Trades — Privacy Policy

Template notice. This is a working draft written to be broadly compatible with the EU/UK GDPR, the California CPRA, and the Australian Privacy Act. It is not legal advice and must be reviewed by a qualified lawyer in each market you operate in before launch, and the placeholders below (operator name, contact address, hosting region) completed.

1. Who we are

Privy Trades ("we", "us") operates this website and app: a satirical, tabloid-style tracker of public securities-disclosure filings, and a research desk built on them. We are the data controller for the personal information described here. Contact: [privacy@your-domain] · [postal address]. If we have appointed an EU/UK representative or Data Protection Officer, their details appear here: [if applicable].

2. What we collect

Account data — your chosen username, your email address (required, so we can send you a verification link and let you reset your password), and a password (stored only as a salted PBKDF2 hash; we never store or see the plaintext).
Activity you create — your watchlist, favourites, reader theories and comments, the "Cred" you earn, kudos you give, and your notification settings.
Technical data — a session cookie to keep you signed in, and standard server logs (IP address, browser type, timestamps) kept for security and abuse-prevention.

The market data itself (insider filings, congressional disclosures, 13F holdings, exchange announcements) is public record, not your personal information. Names that appear in filings are published because the filing is a public disclosure — see our Terms.

3. Why we use it, and our legal bases

To provide the account, watchlist, theories and notifications you ask for — performance of our contract with you.
To keep the service secure and prevent abuse — our legitimate interests.
To send you the alerts you opt into — your consent, which you can withdraw at any time in settings.

4. Cookies

We use a single strictly-necessary cookie (privy_session) to keep you signed in. It is httpOnly and SameSite=Strict. We do not use advertising or cross-site tracking cookies. Because it is strictly necessary, it does not require consent, but you can clear it by signing out.

5. Sharing

We do not sell your personal information. We share it only with service providers that host or operate the service on our behalf (e.g. our hosting provider), under contract, and where legally required (e.g. a valid court order). Your username and the theories/comments you post are public to other users by design.

6. Where your data is held

The service is hosted in [region]. If we transfer personal data out of the EEA/UK/Australia, we rely on appropriate safeguards (e.g. Standard Contractual Clauses).

7. How long we keep it

We keep account data while your account is open. You can delete your account at any time using the “Delete my account & data” link in the site footer: this immediately and permanently erases your username, email, password hash, watchlist, favourites, notification settings, and the theories and kudos you posted. We may retain limited records where the law requires it (e.g. security or fraud-prevention logs) for no longer than necessary.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your data, to object to or restrict processing, to withdraw consent, and (California) to know and to opt out of any "sale" or "sharing" — we do neither. To exercise any right, contact [privacy@your-domain]. You may also complain to your data-protection regulator (e.g. the ICO, your EU DPA, or the OAIC in Australia).

9. Children

Privy Trades is not directed at children under 16 and you must be at least 18 (or the age of majority where you live) to hold an account — see the Terms.

10. Security & changes

We protect accounts with hashed passwords and session tokens, but no system is perfectly secure. We will post any material change to this policy here and, for significant changes, ask you to re-accept. Continued use after an update means you accept the revised policy.