Privacy Policy

This Privacy Policy explains what personal data TickerTruth ("we", "us") collects, how we use it, and the rights you have over it. This policy is written to align with the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA) for our users covered by those laws, as well as general good practice for all users.

1. Data We Collect

• Account data: email address, hashed password (or Google sign-in identifier), account creation date.
• Usage data: your watchlist, portfolio holdings you choose to enter, and app interaction data needed to operate the Service (e.g., active session identifiers for security purposes).
• Technical data: IP address (used only transiently for security/session purposes, not stored long-term), browser type, device type.

2. How We Use Your Data

• To create and maintain your account and provide the Service.
• To enforce single-session login security (detecting when your account is signed in elsewhere) and automatic sign-out after 30 minutes of inactivity.
• To communicate with you about your account, billing, or Service changes.
• We do not sell your personal data to third parties.

3. Legal Basis for Processing (EU/UK Users)

We process your data on the basis of: performance of a contract (providing the Service you signed up for), our legitimate interests (security, fraud prevention, service improvement), and, where required, your consent.

4. Data Storage & Security

Your data is stored using Google Firebase (Firestore and Firebase Authentication), which applies industry-standard security controls. We restrict access to your data via security rules that only permit you (and authorized administrators) to read or modify your own account information.

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within [30] days, except where retention is required by law (e.g., billing records).

6. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent at any time, where processing is based on consent
• California residents: the right to know, delete, and opt out of the "sale" or "sharing" of personal information (we do not sell personal information)

To exercise any of these rights, contact us at [privacy@yourdomain.com]. We will respond within the timeframe required by applicable law (generally 30 days for GDPR, 45 days for CCPA).

7. Cookies & Similar Technologies

[Describe any cookies/local storage used — e.g., "We use browser local storage to keep you signed in and to enforce one active session per account. We do not use third-party advertising or tracking cookies."]

8. International Data Transfers

Your data may be processed in the United States via our infrastructure provider (Google Cloud/Firebase). Where required, we rely on Standard Contractual Clauses or equivalent safeguards for transfers of EU/UK personal data.

9. Children's Privacy

The Service is not directed at, and we do not knowingly collect data from, individuals under the age of [18].

10. Changes to This Policy

We may update this policy from time to time. We will post the updated version here with a new "Last updated" date.

11. Contact

Data protection inquiries: [privacy@yourdomain.com]

← Back to sign in