← Back to home

Privacy Policy

Effective 2026-09-01 · Last updated 2026-09-10

The short version. We collect the minimum we need to run RockTurners: your account identity (via Clerk), portfolios and strategies you build, billing metadata (via Stripe), and operational logs. We do not sell or rent your information. We do not use your holdings or custom strategies to train AI models. Our public marketing pages use Google Analytics with every advertising feature disabled and the Global Privacy Control opt-out signal honored; the authenticated application carries no third-party analytics tag (see § 8).

Pre-release notice. The Service is operated by RockTurners, LLC and is currently a private, invite-only research preview that is not open to the public. This Policy is published in advance and takes effect on 2026-09-01; that advance publication exceeds the 14-day notice period described in § 12. This Privacy Policy is a working draft; references to data controllership and contact authority will be re-issued in finalized form as the Service moves out of preview. Until then RockTurners, LLC handles requests on a best-effort basis at the addresses below.

1. Who this applies to

This Privacy Policy covers personal information processed by RockTurners, LLC (“RockTurners”, “we”) through the website at rockturners.com and the connected web application at rockturners.com/app/ (collectively, the “Service”). RockTurners is in a pre-release period; references to the controller will be re-issued in finalized form as the Service moves out of preview.

2. What we collect

Account identity

Authentication is handled by Clerk. When you sign up Clerk collects your email address, password (hashed; we never see the plaintext), optionally your display name and phone number, and session metadata. We receive a stable clerk_user_id and your email.

Product data you create

• Portfolios and holdings — names, tickers, share counts, cost basis, notes, and exclusion flags.
• Strategies — custom names, descriptions, system prompts, and criteria JSON you author or fork.
• Scans and analysis runs — which strategies you ran, when, the resulting verdicts, and AI-generated output tied to your account.
• Alert screens and preferences — screen definitions, cadences, channels (email/SMS/in-app/webhook), and per-fire history.

Billing metadata

Payments are processed by Stripe. We receive plan code, subscription status (trialing, active, past_due, canceled), and a Stripe customer identifier. For the prepaid compute wallet (used by accounts enrolled in the pay-as-you-go option and for usage beyond a plan's included compute), we also keep your wallet balance and a transaction history — top-ups, per-operation charges, and the Stripe payment reference for each top-up — so your Account page can show exactly what was charged and why. We never see your full card number — that data stays with Stripe.

Operational telemetry

• Standard server access logs (IP, user-agent, timestamp, route, status code) used for abuse detection, rate-limiting, and incident response.
• A sign-in event log (your account ID, session ID, IP address, browser user-agent, and timestamp) kept for account-security review — for example, spotting sign-ins you don’t recognize — and for aggregate usage metrics such as daily active users. See Section 6 for how long we keep it.
• Application Insights / error traces (where enabled) that may include the authenticated user’s stable ID to correlate errors.
• Per-call AI cost metadata (tokens consumed, model used, dollar amount) for billing transparency.

What we do not collect

• Brokerage credentials, account numbers, or real trades — RockTurners does not connect to brokers and cannot execute transactions.
• Government IDs, SSNs, or other tax identifiers.
• Third-party tracking cookies for behavioral advertising.

3. How we use it

• Run the Service — load your saved portfolios, execute scans, deliver alerts, render your dashboard.
• Bill you — enforce plan entitlements and monthly caps, and settle metered pay-as-you-go charges against your prepaid wallet balance.
• Secure the Service — detect abuse, rate-limit, respond to incidents, comply with legal obligations.
• Communicate with you — transactional email (receipts, account warnings, alert deliveries) and, only if you opt in, product updates. You can unsubscribe from non-transactional email at any time.
• Improve the product — aggregated, non-identifying usage patterns (e.g., “average scan size”). We do not use your private portfolios, strategies, or analysis output to train foundation models.

4. AI processing

When you run a scan or analysis, the system sends SEC filings, market data, and a strategy prompt to the AI provider you (or your strategy) selected. Your custom strategy prompt and the ticker universe you chose are part of that call. Portfolio holdings are not sent unless a specific feature (e.g., portfolio-aware scans) is in use, in which case only the tickers — not share counts or cost basis — are transmitted. No account is excepted from this rule: an earlier pre-release prototype included a founder-only analysis feature that sent the operator’s own holdings; that feature was removed from the platform. See our Conflicts of Interest disclosure (§ 4).

You choose the engine; we offer only models an operator has enabled in our catalog on a configured provider. The providers currently enabled are listed in § 5 (Subprocessors); we may add others — for example DeepSeek, Mistral, or OpenRouter (which routes your request to an upstream provider) — and will list any new engine in § 5 before it processes your data. Each call is made under that provider’s commercial API terms. We prefer providers whose terms exclude using API inputs to train public models; terms vary by provider. See § 5 (Subprocessors) and § 11 (International transfers), and our AI Disclosure for model choice, output limits, and known failure modes.

5. Subprocessors

We rely on the third parties below to deliver the Service. Each is bound by contract to handle personal data only on our instructions and consistent with applicable law.

Platform & infrastructure

AI model inference engines

When a scan runs Stage 2, we send prompts, filing excerpts, and the generated analysis to an AI provider — never your share counts or cost basis, for any account. The tables below name every engine enabled in our model catalog. Engines absent from this page are not wired up and receive none of your data; if we activate a new one we will list it here first.

Currently active

Receives prompts, filing excerpts, and generated analysis to produce your results.

Enabled in our catalog, selectable as an evaluation engine

These engines are enabled in our model catalog and can be chosen as the evaluation engine where an operator has supplied credentials. They receive the same data categories as the active engine when selected, and nothing at all when they are not.

If we add or change a subprocessor that materially affects your data, we’ll update this page at least 14 days before the change takes effect. Engines listed as selectable but not yet active are not wired up to process your data; they appear here as advance notice before any activation.

6. Where your data is stored

Application data is stored in a managed PostgreSQL database hosted in the United States. Backups are encrypted at rest and retained for up to 30 days. Analytical logs are retained for up to 90 days unless a longer period is required for an active incident investigation. Sign-in security logs (see “Operational telemetry” in Section 2) are retained for up to 12 months — the security-industry norm for authentication records — then reduced to aggregate, non-identifying daily counts.

Compliance records. For each scan result we retain the model used, a prompt snapshot, the raw AI response, and the per-call cost — books-and-records that document how each verdict was produced. These are a distinct category from the analytical logs above and are kept for regulatory and audit purposes for as long as required by applicable law.

7. Your rights

Depending on where you live, you may have the right to:

• Access a copy of the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete your account and associated data (“right to be forgotten”).
• Export your saved portfolios and custom strategies in a machine-readable format.
• Opt out of non-transactional email and SMS.

To exercise any of these rights, email [email protected]. We verify your identity against the account before acting on a request, then acknowledge and complete it within 30 days. During the pre-release period these requests are handled manually by the operator; manual handling does not extend that 30-day commitment. Self-serve export and erasure in-product are planned as the Service leaves preview. For account deletion we remove our copies on that schedule, and Clerk and Stripe remove theirs on their own processor timelines (typically 30–90 days). Separately, records the law requires us to keep are retained and then deleted: financial and tax records for 7 years, and the compliance/audit records described in § 6.

8. Cookies and similar technologies

We use a small number of strictly necessary cookies:

• Clerk session cookies for authentication.
• A CSRF token for the billing flow.
• Stripe Checkout cookies set during a payment flow.

Analytics cookies (marketing site only)

The public marketing pages at rockturners.com and www.rockturners.com use Google Analytics 4 to measure page views, traffic sources, and whether a visit leads to a waitlist signup. Its first-party cookies (_ga and a _ga_* container cookie) are set only on those marketing hostnames — never inside the authenticated application, which carries no Google tag. Google receives device and browser metadata, page URLs and referrers, and a signup-completed event that contains no name, no email address, and no other submitted form content. Every advertising feature is disabled: the tag’s advertising consent signals (ad storage, ad user data, ad personalization) are permanently denied, Google Signals and demographics are off, and Google’s “products & services” data sharing is off. Google Analytics 4 does not log or store visitor IP addresses. Analytics identifiers are retained by Google for 14 months and then deleted automatically.

Your opt-out choices. We honor the Global Privacy Control (GPC) browser signal, the universal opt-out mechanism recognized under the Colorado Privacy Act: when your browser sends it, analytics cookies are not set. Blocking or deleting the _ga cookies in your browser has the same effect. Analytics never gates any feature — every page works identically with it blocked.

Advance notice. This analytics disclosure is published ahead of activation, the same way § 5 lists engines before they are wired up: collection begins no earlier than 14 days after this page’s Last-updated date, consistent with § 12.

Third-party embeds (TradingView)

Inside the application, the optional price-chart view embeds a widget served directly by TradingView. The widget loads only when you open that chart view — not on page load — and when it does, TradingView receives your IP address, user-agent, and the ticker being charted, and may set its own cookies under TradingView’s privacy policy. We send TradingView no account identity and no portfolio contents.

We do not use third-party advertising cookies and do not allow cross-site behavioral tracking.

9. Children

RockTurners is not intended for children under 18 and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact [email protected] and we will delete it.

10. Security

We enforce HTTPS on all endpoints, parameterize every database query to eliminate SQL injection, apply strict Content-Security-Policy / HSTS / frame-deny headers, and rate-limit cost-bearing routes. API secrets are stored in managed key vaults, never in source control. No system is perfectly secure — if you discover a vulnerability, email [email protected] and we will respond within 2 business days.

11. International transfers

We operate in the United States, and our subprocessors may process data in the United States and the European Economic Area. Where required, transfers out of the EEA are governed by Standard Contractual Clauses or equivalent safeguards.

Some AI engines we may integrate with process data outside the United States — for example, Mistral in the European Union and DeepSeek in China; OpenRouter forwards requests to upstream providers across a range of jurisdictions. We enable such an engine only after listing it in § 5. These analyses run on public SEC filings and market data (and, for portfolio-aware scans, ticker symbols only); we do not transmit account identity, share counts, or cost basis to these providers, for any account.

Access to the Service may be geo-restricted by jurisdiction for compliance with U.S. economic sanctions and export-control laws.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be announced in the Service and/or by email at least 14 days before they take effect. The effective date above reflects the current version.

13. Contact

[email protected] (general) · [email protected] (privacy requests) · [email protected] (security reports)

© 2026 RockTurners, LLC.