Privacy

Account data: your email address, and an account identifier. If you sign in with Google we receive your email address from Google; we do not receive your password.

Your content: the theses you write, your kill criteria, target prices, conviction scores, decision journal entries, and the audits generated against your theses.

Usage data: basic product analytics (pages viewed, features used) via PostHog, to understand what is and is not working.

Theses, audits, decisions and version history are private to your account by default. Access is enforced in the database itself through row-level security, not only in application code, so another user cannot read your data even if a page were to request it incorrectly.

Company-level data — SEC filings, transcripts, extracted financials — is shared across all accounts, because it is public information about public companies. Which companies you track is not shared.

To produce an audit, the text of your thesis is sent together with the relevant filing to our AI provider (Fireworks AI) for evaluation. The same applies to conversations with the AI thought partner. This is necessary for the product to function.

We do not sell your data, and we do not use your theses to train models.

Strictly necessary. Signing in sets a session cookie. Without it there is no way to keep you signed in, so it has no opt-out — but it is only set once you actually sign in.

Analytics. We ask before storing anything for analytics. Until you choose, PostHog runs in memory only: it records that a page was viewed within a single visit, and writes nothing to your device, so there is no identifier that follows you between visits. Accept and it can remember a visitor across sessions, which is what makes it possible to tell a returning user from a new one. Decline and it stops sending anything at all.

Referrals. Opening an invite link stores the invite code in a first-party cookie for 60 days, so the person who invited you gets credited when you sign up. It contains a code, not anything about you.

We use no advertising cookies, run no ad networks, and never sell or share your data with data brokers. Your choice is remembered for six months, after which we ask again.

These are the third parties involved in running the product. Each one is here because something would not work without it, and each receives only what that job requires.

• Supabase — database, authentication and storage. Holds your account and everything you write. This is the system of record.
• Vercel — hosting. Processes requests and keeps standard server logs, which include IP addresses.
• Fireworks AI — generates audits and powers the thesis conversation. Receives the text of the thesis being evaluated together with the filing being evaluated against it. It does not receive your email address or account identifier.
• Stripe — payments, only if you subscribe. Card details go directly to Stripe and never reach our servers. Stripe receives your email address and billing details.
• PostHog — product analytics, subject to the choice above.
• Formspark — delivers messages sent through the contact form, which means whatever you put in that form.
• SEC EDGAR, Financial Modeling Prep and ROIC.ai — public company filings, prices and transcripts. Requests concern companies, not people; nothing about you is sent to them.

Transactional email — account confirmation and password resets — is sent by Supabase.

You can delete an individual thesis at any time, which permanently removes its audits, version history and decision journal. You can delete your entire account from Settings, which removes your account and everything attached to it. Deletion is not reversible.

For any privacy question, or to request a copy of your data, get in touch through the contact form.