← Back to home

Privacy Policy

Effective 2026-10-03 · Last updated 2026-10-08

The short version. We collect the minimum we need to run RockTurners: your account identity (via Clerk), portfolios and strategies you build, billing metadata (via Stripe), and operational logs. We do not sell or rent your information. We do not use your holdings or custom strategies to train AI models. Our public marketing pages use Google Analytics with every advertising feature disabled and the Global Privacy Control opt-out signal honored; the authenticated application carries no third-party analytics tag (see § 8).

Operator. The Service is operated by RockTurners, LLC. This Policy took effect on 2026-10-03, when it was re-issued to describe shared General Analysis reads and the record of Security-page screen requests (§ 2); the previous version was effective from 2026-09-01. This Privacy Policy is a working draft; references to data controllership and contact authority will be re-issued in finalized form. Until then RockTurners, LLC handles requests on a best-effort basis at the addresses below.

1. Who this applies to

This Privacy Policy covers personal information processed by RockTurners, LLC (“RockTurners”, “we”) through the website at rockturners.com and the connected web application at app.rockturners.com/app/ (collectively, the “Service”).

2. What we collect

Invite requests (collected before public sign-up opened)

Before public sign-up opened on 2026-10-01, visitors could request an invite on our website. For each request we stored the email address and name entered and, where provided, the requester's role, the tool they used, the strategy they were interested in, their experience level, how they planned to use the Service, whether they opted in to product updates, and which page the request came from. We used this to review and send invites, to email a confirmation (every such email carried an unsubscribe link), and to notify the operator, who reviewed each request by hand. We did not store the requester's IP address with the request; it was passed once to Cloudflare Turnstile to check that the request was not automated. This Policy promised to keep a request only until the requester asked us to delete it or we closed the invite list, whichever came first. The invite list closed on 2026-10-01: the website no longer offers an invite form, and the requests the list collected are being deleted from our records, including the operator's notification copies; they are not used for any other purpose. If you believe we still hold a request of yours, email [email protected].

Account identity

Authentication is handled by Clerk. When you sign up Clerk collects your email address, password (hashed; we never see the plaintext), optionally your display name and phone number, and session metadata. We receive a stable clerk_user_id and your email.

Product data you create

• Portfolios and holdings — names, tickers, share counts, cost basis, notes, and exclusion flags.
• Strategies — custom names, descriptions, system prompts, and criteria JSON you author or fork.
• Strategy Lab inputs — the text you paste, upload or type when you import a methodology or describe a screen, kept with your account together with how the import tool interpreted it (what it mapped, what it left out and why, and the draft it built). We keep them, including drafts you discard, until you delete your account or ask us to delete them (§ 7).
• Scans and analysis runs — which strategies you ran, when, the resulting verdicts, and AI-generated output tied to your account. A General Analysis read of a single company may be published as that company's shared read for every member (Terms § 7); the shared copy is held by the Service, not your account, and never shows who requested it or anything about the requester's portfolios.
• Security screen requests — when you ask for a company to be screened from its Security page, the ticker, the time, and what the request turned into (an existing read was shown, a new read was started, or it was declined and why). We use this only to enforce daily limits and to measure the feature; it is never shown to other members and is deleted after 90 days.
• Alert screens and preferences — screen definitions, cadences, channels (email/SMS/in-app/webhook), and per-fire history.
• Alert phone number and SMS consent — if you turn on text alerts, the mobile number you enter on the Account page, the time you gave consent, the version of the consent wording you agreed to, and the time you opted out (for example by replying STOP). Consent belongs to one number: changing or removing the number withdraws it. See § 3 (Mobile information) for how that data is and is not shared.

Billing metadata

Payments are processed by Stripe. We receive plan code, subscription status (trialing, active, past_due, canceled), and a Stripe customer identifier. When a subscription is canceled or ends, we also receive how it ended (canceled by you, a failed payment, or a payment dispute) and when access ends, and, if you cancel, the reason you choose and any comment you type in Stripe’s cancellation form. We link these to your account so we can understand why subscribers cancel. If you use the prepaid compute wallet (for compute beyond a plan's included budget, or on an account that was enrolled in the retired pay-as-you-go option), we also keep your wallet balance and a transaction history — top-ups, per-operation charges, and the Stripe payment reference for each top-up — so your Account page can show exactly what was charged and why. We never see your full card number — that data stays with Stripe.

Operational telemetry

• Standard server access logs (IP, user-agent, timestamp, route, status code) used for abuse detection, rate-limiting, and incident response.
• A sign-in event log (your account ID, session ID, IP address, browser user-agent, and timestamp) kept for account-security review — for example, spotting sign-ins you don’t recognize — and for aggregate usage metrics such as daily active users. See Section 6 for how long we keep it.
• Application Insights / error traces (where enabled) that may include the authenticated user’s stable ID to correlate errors.
• Per-call AI cost metadata (tokens consumed, model used, dollar amount) for billing transparency.

What we do not collect

• Brokerage credentials, account numbers, or real trades — RockTurners does not connect to brokers and cannot execute transactions.
• Government IDs, SSNs, or other tax identifiers.
• Third-party tracking cookies for behavioral advertising.

3. How we use it

• Run the Service — load your saved portfolios, execute scans, deliver alerts, render your dashboard.
• Bill you — enforce plan entitlements and monthly caps, settle compute charges beyond your plan against your prepaid wallet balance, and send the billing notices described in our Terms § 5 (trial-ending and annual-renewal reminders).
• Secure the Service — detect abuse, rate-limit, respond to incidents, comply with legal obligations.
• Communicate with you — transactional email (receipts, account warnings, alert deliveries, text alerts you have turned on) and, only if you opt in, product updates. You can unsubscribe from non-transactional email at any time.
• Improve the product — aggregated, non-identifying usage patterns (e.g., “average scan size”), plus, for the Strategy Lab import tool only, the review described in the next item. We do not use your private portfolios, strategies, Strategy Lab inputs, or analysis output to train foundation models.
• Operate and improve the Strategy Lab import tool — the tool sends your Strategy Lab inputs (§ 2) to an AI provider (§ 4) to build your draft, and keeps them so you can return to it. Our team reviews them, and may run them through an improved version of the tool, to find what it misreads or leaves out. They are never shown to other members or included in research output.

Mobile information

Mobile phone numbers, SMS opt-in data, and SMS consent are never sold, rented, or shared with third parties or affiliates for their marketing or promotional purposes. Twilio receives your number and the message text only to deliver the alerts you asked for (§ 5). Nothing else in this Policy permits any other sharing of that information. The text-alert program itself — what is sent, how often, and how to stop it — is described in our Terms § 16.

4. AI processing

When you run a scan or analysis, the system sends SEC filings, market data, and a strategy prompt to the AI provider you (or your strategy) selected. Your custom strategy prompt and the ticker universe you chose are part of that call. When you import a methodology or describe a screen in the Strategy Lab, the text you provide is sent to the AI provider that builds the draft (§ 2, Strategy Lab inputs). Portfolio holdings are not sent unless a specific feature (e.g., portfolio-aware scans) is in use, in which case only the tickers — not share counts or cost basis — are transmitted. No account is excepted from this rule: an earlier pre-release prototype included a founder-only analysis feature that sent the operator’s own holdings; that feature was removed from the platform. See our Conflicts of Interest disclosure (§ 4).

You choose the engine; we offer only models an operator has enabled in our catalog on a configured provider. The providers currently enabled are listed in § 5 (Subprocessors); we may add others — for example DeepSeek, Mistral, or OpenRouter (which routes your request to an upstream provider) — and will list any new engine in § 5 before it processes your data. Each call is made under that provider’s commercial API terms. We prefer providers whose terms exclude using API inputs to train public models; terms vary by provider. See § 5 (Subprocessors) and § 11 (International transfers), and our AI Disclosure for model choice, output limits, and known failure modes.

5. Subprocessors

We rely on the third parties below to deliver the Service. Each is bound by contract to handle personal data only on our instructions and consistent with applicable law.

Platform & infrastructure

AI model inference engines

When a scan runs Stage 2, we send prompts, filing excerpts, and the generated analysis to an AI provider — never your share counts or cost basis, for any account. The tables below name every engine enabled in our model catalog. Engines absent from this page are not wired up and receive none of your data; if we activate a new one we will list it here first.

Currently active

Receives prompts, filing excerpts, and generated analysis to produce your results.

Enabled in our catalog, selectable as an evaluation engine

These engines are enabled in our model catalog and can be chosen as the evaluation engine where an operator has supplied credentials. They receive the same data categories as the active engine when selected, and nothing at all when they are not.

If we add or change a subprocessor that materially affects your data, we’ll update this page at least 14 days before the change takes effect. Engines listed as selectable but not yet active are not wired up to process your data; they appear here as advance notice before any activation.

6. Where your data is stored

Application data is stored in a managed PostgreSQL database hosted in the United States. Backups are encrypted at rest and retained for up to 30 days. Analytical logs are retained for up to 90 days unless a longer period is required for an active incident investigation. Sign-in security logs (see “Operational telemetry” in Section 2) are retained for up to 12 months — the security-industry norm for authentication records — then reduced to aggregate, non-identifying daily counts.

Compliance records. For each scan result we retain the model used, a prompt snapshot, the raw AI response, and the per-call cost — books-and-records that document how each verdict was produced. These are a distinct category from the analytical logs above and are kept for regulatory and audit purposes for as long as required by applicable law.

7. Your rights

Depending on where you live, you may have the right to:

• Access a copy of the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete your account and associated data (“right to be forgotten”).
• Export your saved portfolios and custom strategies in a machine-readable format.
• Opt out of non-transactional email (use the unsubscribe link) and of text alerts (reply STOP, or clear your number on the Account page).

To exercise any of these rights, email [email protected]. We verify your identity against the account before acting on a request, then acknowledge and complete it within 30 days. These requests are handled manually by the operator; manual handling does not extend that 30-day commitment. Self-serve export and erasure in-product are planned. For account deletion we remove our copies on that schedule, and Clerk and Stripe remove theirs on their own processor timelines (typically 30–90 days). Separately, records the law requires us to keep are retained and then deleted: financial and tax records for 7 years, and the compliance/audit records described in § 6.

8. Cookies and similar technologies

We use a small number of strictly necessary cookies:

• Clerk session cookies for authentication.
• A CSRF token for the billing flow.
• Stripe Checkout cookies set during a payment flow.
• rt_authed, a first-party cookie the application sets on rockturners.com while you are signed in and clears when you sign out. It holds only the application's host name, so the public website can show you an “Open app” button instead of “Sign up”; it carries no identity, is readable by our own pages only, and expires after one day.

Analytics cookies (marketing site only)

The public marketing pages at rockturners.com and www.rockturners.com use Google Analytics 4 to measure page views and traffic sources. Its first-party cookies (_ga and a _ga_* container cookie) are set only on those marketing hostnames — never inside the authenticated application, which carries no Google tag. Google receives device and browser metadata, page URLs and referrers, and no submitted form content. Every advertising feature is disabled: the tag’s advertising consent signals (ad storage, ad user data, ad personalization) are permanently denied, Google Signals and demographics are off, and Google’s “products & services” data sharing is off. Google Analytics 4 does not log or store visitor IP addresses. Analytics identifiers are retained by Google for 14 months and then deleted automatically.

Your opt-out choices. We honor the Global Privacy Control (GPC) browser signal, the universal opt-out mechanism recognized under the Colorado Privacy Act: when your browser sends it, analytics cookies are not set. Blocking or deleting the _ga cookies in your browser has the same effect. Analytics never gates any feature — every page works identically with it blocked.

Advance notice. This analytics disclosure first appeared in the 2026-08-01 edition of this policy, ahead of activation, the same way § 5 lists engines before they are wired up; collection began on 2026-08-12. Any change to what we collect is announced under § 12 before it takes effect.

Third-party embeds (TradingView)

Inside the application, the optional price-chart view embeds a widget served directly by TradingView. The widget loads only when you click to open a chart — not on page load or when the chart tab opens — and when it does, TradingView receives your IP address, user-agent, and the ticker being charted, and may set its own cookies under TradingView’s privacy policy. We send TradingView no account identity and no portfolio contents.

We do not use third-party advertising cookies and do not allow cross-site behavioral tracking.

9. Children

RockTurners is not intended for children under 18 and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact [email protected] and we will delete it.

10. Security

We enforce HTTPS on all endpoints, parameterize every database query to eliminate SQL injection, apply strict Content-Security-Policy / HSTS / frame-deny headers, and rate-limit cost-bearing routes. API secrets are stored in managed key vaults, never in source control. No system is perfectly secure — if you discover a vulnerability, email [email protected] and we will respond within 2 business days.

11. International transfers

We operate in the United States, and our subprocessors may process data in the United States and the European Economic Area. Where required, transfers out of the EEA are governed by Standard Contractual Clauses or equivalent safeguards.

Some AI engines we may integrate with process data outside the United States — for example, Mistral in the European Union and DeepSeek in China; OpenRouter forwards requests to upstream providers across a range of jurisdictions. We enable such an engine only after listing it in § 5. These analyses run on public SEC filings and market data (and, for portfolio-aware scans, ticker symbols only); we do not transmit account identity, share counts, or cost basis to these providers, for any account.

Access to the Service may be geo-restricted by jurisdiction for compliance with U.S. economic sanctions and export-control laws.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be announced in the Service and/or by email at least 14 days before they take effect. The effective date above reflects the current version.

13. Contact

[email protected] (general) · [email protected] (privacy requests) · [email protected] (security reports)

© 2026 RockTurners, LLC.