TradeAlert LLC (“TradeAlert,” “we,” “our,” or “us”) operates the trading alert service available at tradealerthq.com (the “Service”). This Privacy Policy explains what personal information we collect, how we use and share it, and the choices and rights available to you.

By creating an account or using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect

Information you provide directly:

Account information. When you register, we collect your email address, username, and password. Passwords are stored as a secure hash by Supabase Auth — we never see or store your plaintext password.
Phone number. If you opt into SMS alerts, we collect your mobile phone number. SMS alerts are not currently offered, so we are not collecting phone numbers at this time.
Discord ID. When you link your Discord account to receive alerts, we store your Discord user ID, verified via a direct-message confirmation flow. We do not store your Discord username or avatar — where the dashboard shows them, they are fetched from Discord at the moment of display and not retained.
Ticker preferences. The list of ticker symbols you configure for alert monitoring.
Support communications. If you contact us for support, we retain the subject and content of your message together with your account identifier, email address, display name, and Discord ID (where linked), so that we can identify you and reply. We also retain the ticket’s status and any internal note we add while handling it.

Information collected automatically or through third parties:

Payment data. Billing is handled entirely by Stripe, Inc. We do not store your credit card number, CVV, or full payment card details. We store only a Stripe Customer ID and a card fingerprint (used solely to detect trial abuse across multiple accounts). See Stripe’s Privacy Policy.
Usage and log data. Our hosting infrastructure (Vercel) and database (Supabase) may log IP addresses, request timestamps, and error events as part of normal operation. We do not run advertising trackers on the site.
Product analytics. We use PostHog to understand how the Service is used — page views, page exits, and a small number of product events such as completing onboarding or starting a subscription. Analytics requests are routed through our own domain rather than sent from your browser to PostHog directly. PostHog is configured without cookies or browser storage, so it stores no tracking identifier on your device and cannot follow you across sites or sessions. Signed-out visitors are not profiled. Once you sign in, we send PostHog your account identifier and email address so product events can be attributed to your account.
Error and performance monitoring. We use Sentry to capture application errors and a sample of performance traces. Sentry is configured not to collect request bodies, headers, or user data automatically, but the diagnostic context we attach to a specific failure can include identifiers such as your account ID or email address where they are relevant to the error.
Rate-limiting data. Your user ID — or, on endpoints reached before you sign in, your IP address — is used as a transient key in Upstash Redis to enforce API rate limits. On sign-in, password-reset and confirmation-resend requests, the email address submitted is also used as a key, so that repeated attempts against one account cannot be hidden by changing IP address. No message content or other personal data is stored there. Keys expire on their own; most within an hour, and the longest we set is eight hours.

2. How We Use Your Information

We use your personal information to:

Create and manage your account
Deliver trading alerts via your chosen channels (Discord, SMS, email)
Process subscription payments and billing through Stripe
Send transactional emails (account confirmation, password reset, billing receipts)
Respond to support requests
Detect and prevent fraud, trial abuse, and unauthorized account access
Enforce our Terms of Service
Comply with applicable legal obligations

We do not sell your personal information to third parties. We do not use your data for advertising targeting or share it with data brokers.

3. Third-Party Services

We share personal information only as necessary to operate the Service or as required by law:

Stripe. Processes subscription payments. We share your email address with Stripe to create a billing customer record. Stripe’s Privacy Policy governs data it collects directly.
Supabase. Hosts our database and authentication system on AWS infrastructure in the United States. Your account data, ticker preferences, and subscription state are stored there.
Discord. If you link your Discord account, we use the Discord API to send alerts and manage your server roles. We share your Discord ID with Discord APIs only; Discord’s own Privacy Policy governs that platform. Separately, we operate an internal Discord channel for operational alerts. Two things reach it: a support ticket you submit, and — if a free trial is started on a payment card that has already been used for a trial on another account — a notice containing your email address, the plan chosen, and the last eight characters of the card fingerprint Stripe gives us. That fingerprint is an identifier derived from the card by Stripe; it is not your card number, and we never receive or store card numbers.
Resend. Delivers our transactional email — account confirmation, password reset, and billing or subscription notices. We share your email address and the contents of those messages with Resend so that it can send them.
Twilio and SMS carriers. SMS alerts are not currently offered. The functionality is built but switched off, and no phone numbers are being sent to Twilio today. If we enable SMS, we will share your mobile number with Twilio to verify it and to deliver alert messages, and your mobile carrier will handle those messages in transit.
Vercel. Hosts and serves the TradeAlert web application. Vercel may process connection metadata (IP address, request headers) as part of request routing and DDoS protection.
Railway. Hosts the two background services that receive trading signals and deliver your alerts. Those services read your email address and, if SMS is ever enabled, your mobile number in order to send each alert, and they write operational logs to Railway’s platform.
Google. If you choose “Continue with Google” to sign up or sign in, Google authenticates you and returns your email address and basic profile information to us. Google’s own Privacy Policy governs what it collects during that sign-in. We do not use Google for anything else — no analytics, no advertising, and no fonts or other assets loaded from Google in our web pages or emails.
Upstash. Your user ID is used as a rate-limiting key. On sign-in, signup, password-reset, and similar unauthenticated endpoints, your IP address is used as the key instead, since no account is known yet. On sign-in, password-reset and confirmation-resend requests, the submitted email address is also used as a key. No other personal data is shared. Keys expire on their own; most within an hour, and the longest we set is eight hours.
PostHog. Receives the product analytics described in Section 1 — page views, page exits, and product events, plus your account identifier and email address once you are signed in. Data is held on PostHog’s United States cloud.
Sentry. Receives application error reports and a sample of performance traces. These may include your account identifier or email address within the diagnostic context attached to a specific failure.
Cloudflare. We use Cloudflare Turnstile to screen automated signup and login attempts. Cloudflare receives your IP address and browser signals in order to run that check. It is not used for advertising or profiling.
Finnhub. Powers ticker symbol search. Your search text is forwarded from our servers to Finnhub without your account identifier, email address, IP address, or any other information identifying you.
Law enforcement and legal process. We may disclose information if required by law, court order, or government authority, or to protect the rights, property, or safety of TradeAlert, its users, or the public.
Business transfer. If TradeAlert LLC is acquired, merged, or its assets are transferred, your information may be transferred to the successor entity, subject to equivalent privacy commitments.

4. Data Retention

We retain your account information and subscription history for as long as your account is active and for a reasonable period afterward for legal, fraud-prevention, and dispute-resolution purposes. If you delete your account, we delete your personal information from our active systems within 30 days, except where longer retention is required by law (for example, Stripe retains payment transaction records per applicable financial regulations).

Ticker preferences and subscription history associated with a deleted account are removed at the time of deletion. Rate-limiting keys in Upstash expire automatically and are not retained.

Deleting your account removes your records from our own database immediately, and cancels your subscription and your Discord access at the same time. It does not by itself erase copies held by the third parties listed in Section 3 — in particular, our analytics provider (PostHog) and our error-reporting provider (Sentry) may still hold records associated with your account identifier or email address, and Stripe retains payment records as described above. If you want those copies erased as well, contact us and we will request their deletion from each provider.

5. Your Rights

Depending on where you live, you may have the following rights regarding your personal information. To exercise any of them, contact us at support@tradealerthq.com. We will respond within the timeframe required by applicable law (typically 30–45 days).

Rights available to all users:

Access and correction. You may view your account information at any time from your account settings, and change your display name there. Your email address is shown but cannot be changed from the dashboard today, and phone numbers are not currently collected because SMS is switched off. To change your email address, to request a copy of all personal data we hold about you, or to correct anything you cannot edit yourself, contact us and we will do it for you.
Account deletion. You may delete your account at any time from your account settings. This cancels your subscription, removes your personal data from our active systems, and revokes your Discord access.
Notification preferences. You may update your notification channels (Discord, SMS, email) at any time from your account settings.

Additional rights for EEA and UK residents (GDPR):

Our lawful basis for processing your personal data is performance of a contract — we process your data to deliver the Service you have subscribed to. Where we process data for fraud prevention or legal compliance, we rely on legitimate interests or legal obligation, respectively.

Right to erasure. You may request deletion of your personal data. We will comply unless we have a legal basis to retain it.
Right to data portability. You may request your personal data in a structured, machine-readable format for transfer to another controller.
Right to rectification. You may request correction of inaccurate or incomplete personal data.
Right to restrict processing. In certain circumstances, you may request that we limit how we use your data while a dispute is resolved.
Right to object. You may object to processing based on legitimate interests. We will cease such processing unless we have compelling grounds that override your interests.
Right to withdraw consent. Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
Right to lodge a complaint. You have the right to lodge a complaint with your local data protection authority if you believe we have processed your data unlawfully.

Additional rights for California residents (CCPA):

Right to know. You may request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
Right to delete. You may request deletion of personal information we have collected, subject to certain exceptions.
Right to opt out of sale. We do not sell personal information. No opt-out is required.
Right to non-discrimination. We will not discriminate against you for exercising any CCPA rights.

To submit a verifiable request under the CCPA, contact us at support@tradealerthq.com. We will respond within 45 days.

6. Cookies

We use a minimal number of cookies necessary to operate the Service. Specifically:

Authentication session cookies. When you log in, Supabase Auth sets a session cookie that keeps you signed in across page loads. This cookie is essential for the Service to function and is not used for advertising.
Terms-acceptance cookie. If you sign up with Google, we set a short-lived cookie named pending_tos that tells our server, across the sign-in redirect, that you ticked the age and Terms boxes. Our server then records your acceptance against your account, with the time it received it. It lasts five minutes and is deleted as soon as you return.

We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies. We do not integrate Google Analytics, Meta Pixel, or any similar advertising tracking technology.

We do use product analytics (PostHog — see Section 1), but it is deliberately configured without cookies or browser storage and is served through our own domain, so it places nothing on your device and issues no third-party request from your browser. That is why the Service does not present an analytics cookie banner.

You may configure your browser to block or delete cookies, but doing so will prevent you from remaining logged in to the Service.

7. Security

We implement reasonable technical and organizational measures to protect your personal information, including encryption in transit (TLS), hashed password storage via Supabase Auth, and row-level security policies restricting database access to authorized operations. However, no transmission over the internet is 100% secure. We cannot guarantee absolute security and are not responsible for unauthorized access resulting from circumstances outside our reasonable control.

8. International Data Transfers

TradeAlert is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. Users in the European Economic Area (EEA), United Kingdom, or Switzerland should be aware that U.S. data protection laws may differ from those in their home jurisdiction. By using the Service, you acknowledge this transfer. Where required, we rely on available legal transfer mechanisms (such as standard contractual clauses) to lawfully transfer data from the EEA or UK.

9. Children’s Privacy

The Service is not directed to persons under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have inadvertently collected information from a minor, we will delete it promptly. If you believe we may have collected information from a minor, please contact us at support@tradealerthq.com.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. For material changes, we will notify you by email or by a notice in the Service before the change takes effect. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

11. Contact

Questions, data requests, or complaints regarding this Privacy Policy: support@tradealerthq.com

For information about subscription billing and refunds, please review our Refund Policy.

TradeAlert