Privacy Policy

Effective date: August 2, 2026 · Last updated: October 10, 2026

1. Who Is Responsible

GreeksView is run by Fathomline Analytics LLC · 4601 E. Douglas Ave., Ste 150, Wichita, KS 67218 · contact@greeksview.com. It is an analytics product, not a brokerage: we do not hold your money, clear trades or hold your brokerage account.

2. What We Collect

Account data: email address, display name, password (bcrypt hash only), subscription tier and the plan you picked at sign-up. We also keep when you signed up, when you last signed in, whether your email is verified, whether the account is active, a count and time of recent failed sign-ins (used to lock the account temporarily after repeated failures), and the time your sign-in sessions were last ended (for example by signing out or changing your password). We keep the time you accepted the Terms, your email preferences (whether you have unsubscribed from announcements, and the token behind the unsubscribe link) and, if you enable live trading, the time you did. If our staff grant you a trial or complimentary Pro access, we keep when it was granted, when it ends and the short note our staff typed when granting it. If you claim a one-day terminal pass, we keep when it ends. We also keep a hashed copy of the verification and password-reset links we emailed you, until you delete your account.
Ad click ID: if you arrive from a Google or Microsoft ad, we keep the ad click ID, which of the two it came from and when you clicked, with your account when you sign up. The ID travels in the page address and the sign-up form, not in a cookie.
Billing data: we do not store card numbers; Stripe handles card details. We keep Stripe customer and subscription identifiers, your plan and billing status (such as the date a paid plan began), when we last checked your billing with Stripe, and the end date of any cancellation we have emailed you about.
Contact and support messages: if you use the contact form we receive what you type (your name and email, an optional account email, an optional customer type, a topic, a subject and your message) at our support mailbox, and the notification carries the IP address the message came from. We email you a confirmation. These messages are email; the app does not save them in its database.
Cloud-sync data (all plans, opt-in): if you use cloud sync (the Push button under Settings, Sync & Backup), it uploads the settings stored in your browser, which can include watchlists, recently viewed symbols, favorites, price alerts, drawings, screener presets and trade-journal notes (and so the tickers in them). It never uploads API keys, broker tokens, market data or AI conversation history, and our server rejects them if a client tries.
Shared chart images: if you share a chart we store the image, its ticker and title and the date, linked to your account. A shared chart is public: anyone with the link can open the image, and browsers and networks may cache it for up to a year. There is no control for removing a single image; we keep your newest 100 and delete the rest, and deleting your account removes them from our servers. Copies already cached or saved elsewhere are not recalled.
Operational logs: our hosting provider, Render, keeps standard request logs under its own settings. Our application’s own logs carry internal account IDs and error details; they can also contain an email address (when a message cannot be delivered). Contact-form messages are not written to them: each one is sent to our support mailbox by email. If the app hits a script error in your browser, it sends us the error message and the file and line where it happened, and we write them to our application log with no account ID attached.
Security activity log: sign-in, sign-out, failed sign-in, email verification, password reset, password change (including refused or blocked attempts), and unsubscribing from or resubscribing to announcements, each with the time, a truncated network prefix (e.g. 203.0.113.0/24, not your full IP) and a coarse device family (e.g. “Chrome on macOS”, not your full browser fingerprint). It also records when you enable live trading, and each live request that places or replaces an order through our broker relay: the time, the broker’s response status and the request path (for a replacement, that includes the order’s ID), never the symbol, size or price. Cancellations and position closes are not recorded, and neither are requests to the paper environment. Kept for 90 days and then deleted automatically. Under Settings → Profile → Account Activity you can see your 25 most recent entries; “Download my data” under Settings → Profile → Your Data returns the whole record.
Connection status: whether your broker credentials were last accepted or refused, when, and which method you connected with (an API key pair, or Alpaca’s authorisation screen). That is the whole record: never the key itself, never which account it belongs to, and never what the request asked for. It exists so that a connection which has stopped working can be told apart from one that was never set up. Superseded on each change.
Section usage: anonymous daily totals of how many times each section of the app (for example “GEX” or “Screener”) was opened and roughly how long it was on screen, added up across everyone who uses it. No account, IP address or browser details are attached to these totals, and there is no record of individual actions or their order. They are first-party, stored in our own database — there is no third-party analytics service. Section names only: no symbols, strikes, expiries, orders or position values are ever recorded. The totals are kept for 365 days. Earlier versions of the app kept these counts with your account; those older records are no longer shown, stay in your download until they are deleted 365 days after the day they count, or at once if you delete your account. You can turn this off under Settings → Profile → Account Activity. This choice is kept with your other browser settings, so it follows you if you use cloud sync; otherwise set it on each browser you use.
Page-visit counts: when you open one of our pages, on the public site or in the app, we add one to a count for that day and hour, the kind of page (for example “a market detail page”, never the ticker symbol or ID in its address) and a broad source: search, social, AI chat service, email, paid, direct, our own pages, other, or automated. No IP address, browser details or account is attached. Daily counts are kept for 180 days and hourly counts for 14 days.
Ticker view counts: we count how many times each ticker symbol is viewed each day, keeping only the symbol, the kind of page it was viewed on and the total, with no account, IP address or browser details attached. In the app (the desk and the chart), a symbol is counted only when you pick it or open a link to it, never for the symbol a page opens on by default, and your picks of the same symbol on the same kind of page are counted once a day (a restart of our servers can count one again that day). To count you once a day, our server keeps in its memory, until the day ends (UTC) or it restarts, a keyed code made from your account (or, if you are not signed in, your network address) with each symbol and kind of page it counted, and, to limit how many pages whose address names a ticker it counts from one place each minute, a keyed code made from your network address, signed in or not; neither is written to our database. Turning off usage recording under Settings → Profile → Account Activity stops these counts too. A page whose address names a ticker is counted when we serve it, and that setting does not reach it. A page we are still trying out with a small group of readers counts nothing. The totals are kept for 180 days.
Daily market-data limit: to apply a daily limit to each account, we keep a short code for each distinct market-data request you make, linked to your internal account ID, for up to two days. It is held in our shared cache and in server memory, not in our database. Because the number of possible requests is small, a code can be matched back to the symbols you asked for.

3. What We Deliberately Do NOT Collect

Your broker credentials (Alpaca API keys, or an Alpaca access token if you connect with Alpaca) are encrypted in your browser and are never stored on our servers. Alpaca market-data requests go from your browser straight to Alpaca. Account, position and order requests pass through our broker relay, which forwards your credential on that single request and does not store or log it. How the browser vault works, and what it does not protect against, is described on our security architecture page.
The contents of your trades, positions or account balances. Requests that carry them pass through our broker relay, which does not store them; the only record is the security-log entry described above.
Your watchlists, recently viewed symbols, favorites, price alerts or journal notes. They are kept in your browser unless you push them to cloud sync (see above).
Advertising cookies, third-party trackers or third-party analytics services. We set no advertising cookie and run no third-party tracking script. If you arrive from a Google or Microsoft ad, we keep the ad click ID with your account and may send that ID and your sign-up time back to the ad network so it can count the conversion. The section-usage counts described above are first-party only: they stay in our own database and are never shared or sold. The ticker view counts are first-party in the same way, and are never shared or sold either.
A stored list of the symbols you look up, apart from what you upload yourself with cloud sync (which can include your recently viewed symbols) and what you choose to keep with us as described above. Of the market-data requests you make, the only record that names a symbol and is linked to your account is the daily-limit code described above, kept for up to two days. Requests for our provider’s market data pass through our servers, so we see the ticker symbols you request while we handle each request, and answers are cached by request for all readers. Our section-usage counts hold section names only.
A stored record of which tickers you view, apart from what you upload yourself with cloud sync, what you choose to keep with us and any daily-limit codes, each as described above. The ticker view counts described above are totals across all readers, with no account attached; the once-a-day codes behind them stay in server memory, as described above.

4. How We Use Data

To authenticate you and operate your subscription.
To provide optional cloud sync you explicitly initiate.
To keep the service secure (the security log), and to count visits to our pages and use of the app’s sections without attaching an account to either. Views of each ticker are counted the same way, as totals with no account attached.
To email you. We send service and security email: verification, welcome, password-reset and password-change notices, sign-in lock notices, billing notices, a notice if someone tries to register an address that already has an account, a confirmation when you contact us or delete your account, and messages from us about your account. These are not optional. We may also send occasional product announcements to account holders; each carries an unsubscribe link, and unsubscribing stops announcements but not service and security notices.

5. Sharing

We do not sell personal data. The following receive data, each for the purpose given:

Stripe (payments): your email address, our internal account ID and your payment details when you subscribe or buy.
Resend (transactional email): your email address and the content of the emails we send, including the notification of a contact-form message to our support mailbox (what you typed in the form, and the IP address it came from).
Render (hosting): runs our servers and cache.
Supabase (database): holds our database.
Your broker (Alpaca, and any other broker you connect): only on your instruction and with your credentials. Your browser talks to Alpaca directly for the market data your Alpaca account supplies; account and order requests pass through our broker relay, as described above.
Google and Microsoft ad networks: if you arrive from one of their ads, we keep the ad click ID with your account and may send that ID and your sign-up time back to the ad network so it can count the conversion.
A licensed market-data provider: receives the ticker symbols we request on your behalf, never your name, email or account.
We also disclose data where the law requires it.

6. Cookies, Browser Storage and Third Parties

Cookies: one essential sign-in cookie, named __Host-ov_token on our site; it is HttpOnly, SameSite=Lax and Secure. It persists after you close your browser, until you sign out or it expires after a period of inactivity; while you keep using the app it is renewed. Our staff’s admin console uses its own separate cookie. We set no advertising or analytics cookies.
Stored in your browser: your encrypted broker credentials (the encrypted data sits in local storage and the key is held in IndexedDB), preferences such as theme and font, your usage opt-out, a note that you saw the risk acknowledgement, and caches of data your screens loaded. Clearing your browser’s site data removes all of it.
Third parties your browser contacts: Google Fonts, when you choose a non-default font; Stripe, when you start checkout (our upgrade page loads Stripe’s script at that point); the StockTwits widget, with the ticker you are viewing, when you open that tab in the app; and your own broker, directly. We do not use any of them for advertising.
Research brief pages load Google Fonts whenever they open.

7. How Long We Keep Data

Account data, plan and billing status, and cloud-synced settings: until you delete them or your account.
Security log: 90 days, then deleted automatically.
Section usage: 365 days, then deleted automatically.
Page-visit counts: 180 days for the daily counts and 14 days for the hourly counts, then deleted automatically.
Ticker view counts: 180 days, then deleted automatically.
Payment records: held by Stripe under its own policy.

8. Your Choices

Export or delete your cloud-synced settings. Cloud sync holds your settings, never market data.
Clear all locally stored data (including API keys) via your browser's site-data settings.
Unsubscribe from announcements with the link in any announcement email.
Download your data at any time from Settings → Profile → Your Data. You get a JSON file containing a copy of your account details (including your Stripe customer and subscription IDs and your sign-up attribution), saved settings, security log and usage records. It leaves out your password hash, tokens, API keys and market data.
Your download also lists your shared charts (title, symbol and time; not the images).
Delete your account yourself, immediately, from Settings → Profile → Your Data, with your password and by typing DELETE. It immediately cancels any active subscription (unused time is not refunded unless these terms or law require it), then erases your profile, settings, sign-in and security-log history and usage records outright — it is not a hidden “deleted” flag. It cannot be undone, so download your data beforehand if you want it.
Deleting your account also deletes your shared chart images from our servers.

What we keep after you delete. Stripe keeps its own customer and payment records, which include your email address and our internal account ID, under its own policy. If our staff erase an account for you, we keep a minimal audit entry (internal ID, masked address, date). Our staff’s audit log of what staff do to an account in the admin console (the action, the internal account ID, the time and a short note) is not erased with the account. If our staff added your email address to an early-access list for a feature, that entry is not removed. Backups are outside this self-service erasure, and so are emails you have sent to our support mailbox.

9. Security

Passwords are hashed with bcrypt. Sessions use signed, httpOnly cookies. Traffic is encrypted in transit. No method is 100% secure; notify us immediately at contact@greeksview.com if you suspect unauthorized access.

10. Contact

Fathomline Analytics LLC · 4601 E. Douglas Ave., Ste 150, Wichita, KS 67218 · contact@greeksview.com