Privacy

What StockOrNot keeps about you, and where.

No advertising, no analytics and no tracking scripts, on the website or in the iPhone app. What is kept is what the cart and the alerts need in order to work, and this page lists all of it.

Last updated October 14, 2026.

Without an account

Nothing about you is kept anywhere but on your device, apart from the short request logs described below. The cart, with any notes and planned amounts, and the cards you have already swiped past are kept in your browser's own storage on this device, or in the iPhone app's own storage on the phone. Clearing this site's data in your browser, or deleting the app, removes all of it.

With an account

Signing in asks for an email address and sends a one-time sign-in link or code to it. There is no password. With an account, these are kept in the site's database, hosted by Supabase:

• Your email address, to sign you in and, if you ask for them, to send earnings alerts.
• That you agreed to the terms: which version, and when, recorded as the account is created.
• Sign-in records: Supabase, which runs sign-in, logs the IP address and browser of each sign-in and session, for security.
• Your cart: the companies and funds in it, when you added them and at what price, your notes and planned amounts, and, on the website, a record of the last order sent for each, so a retry cannot place it twice.
• Your alert settings, and a log of which alerts have been sent, so no report is emailed twice.

The database only lets you read or change your own rows. That rule is enforced by the database itself, so it holds even against a request crafted by hand.

Earnings alerts

Alerts are off until you switch them on. When they are on, an email goes out through Resend a week before a company in your cart reports, listing the companies and what the street expects. Turn them off at any time under Account, then Earnings alerts, with the link at the bottom of every alert, or by replying "unsubscribe".

The iPhone app

The app keeps the same things as the website, in the same way, and an account is just as optional there. What is different about it:

• It stays on the phone. Without an account, the cart and everything else above are kept in the app's own storage on the phone, and nowhere else. The app fetches the same public data files and headlines the website shows from stockornot.com; Vercel logs those requests like any visit to the site, and they carry nothing else about you.
• Reminders are scheduled by the phone. If you switch on "Notify me on this iPhone" and allow notifications, the phone itself schedules a notification a week before anything in your cart reports. Nothing about them is sent anywhere: there is no push service and no device token. Switch them off in the same place, or in the iPhone's Settings under Notifications.
• Exports go only where you send them. Export CSV, Download my data and Share open the iPhone's share sheet, and the file or link goes to the place you choose there and nowhere else.
• No brokerage and no purchases. The app does not connect to a brokerage, place orders, hold money or sell anything. The parts of this page about a brokerage apply to the website only.
• No other permissions. Notifications are the only thing the app asks permission for, and it works without them.

A brokerage connection (website only)

If you connect an Alpaca account on the website, the keys or sign-in token are encrypted into a cookie in your browser that only this site's server can read. They are not stored in any database here. The cookie expires after 30 days, or at once when you disconnect. Orders you confirm go to Alpaca through this site's server, which keeps no copy; Alpaca's own privacy policy covers your account there.

Who else is involved

• Vercel hosts the site and the data the app reads. Like any web host it keeps short-lived request logs, which include IP addresses.
• Supabase holds accounts and the data listed above, and sends the sign-in emails.
• Resend delivers those sign-in emails for Supabase, and the earnings alerts, which go only to people who switched them on.
• GitHub runs the nightly job that sends the alerts. While it runs it reads the email address, cart and alert settings of people who switched alerts on, and keeps none of them.
• Alpaca, only if you connect a brokerage account on the website.
• Finnhub supplies market data and news. Its requests come from this site's server and carry nothing about you.

These are the only services that handle anything about you. Each gets only what its part needs, uses it only to provide that part, and is bound by its own privacy and data-protection terms to protect it at least as well as this page does. Nothing is sold, rented, shared for marketing, or used to train AI models. The typeface and the sign-in library are served from this site, not from a font service or a code CDN.

How long it is kept

Everything listed under "With an account" is kept until you delete the account, and goes at once when you do; a signed-in session's record goes when you sign out on that device. The services above keep their own short logs for security and delivery, then delete them: Vercel's request logs for a day or less, Supabase's log of sign-ins for up to 7 days, and Resend's record of each email it sent for 30 days. Without an account, nothing about you is kept anywhere but on your device, apart from those request logs.

Cookies and browser storage

Cookies are set only for a brokerage connection on the website: the sealed connection described above, and, while you are signing in to Alpaca, a second one that lasts ten minutes and only checks that the sign-in came back to the browser that started it. Everything else stays in your browser's own storage, or the app's, and is written only when you use the part it belongs to: your cart, the cards you have swiped, your scoring style, whether the deck and Compare show companies or ETFs, the two companies and the two funds in Compare, that you hid the earnings notice, and, once you sign in, your session (you stay signed in on that device until you sign out) and which account the cart on the device belongs to. In the app, switching reminders on also keeps that choice and the date of the data they were last set from. If you add the website to your home screen and open it from there, it keeps a copy of the site's own pages, scripts, typeface and public data so it can open without a signal; a visit in a browser tab keeps no such copy. While a sign-in link is on its way, the address it was sent to is kept too, so the site can tell you if a link signs you in to a different account. It goes once you are signed in or when you sign out, and in any case the first time StockOrNot opens more than a day later. Nothing is stored before you use the part it is for, and none of it is advertising, analytics or tracking, so there is nothing to accept or refuse and no cookie banner.

Getting a copy, and deleting it

Signed in, the Account tab has Download my data, a file with your account, the saved cart with its notes and amounts, the alert settings and the alerts sent, and every StockOrNot setting this browser or the app holds (the sign-in session itself, a key to the account, is left out); in the app it opens the share sheet. Supabase's sign-in records are kept by Supabase for security and are not in the file; write in for a copy. Without an account, Export CSV in the cart gives you the cart.

The Account tab also has Delete my account. It asks once more, then deletes the account, the email address and everything attached to it at once, for good, and on the website disconnects that browser from any brokerage account. Supabase's own sign-in log and its routine backups keep their copies only until those expire on their own schedule (the log within 7 days). You can also empty the cart and switch alerts off at any time, and signing out removes the session from that browser or phone. If anything here does not work, write to hello@stockornot.com from the account's address: a copy or a deletion is done within 30 days, and you get a reply when it is. The support page has the rest.

Do Not Track, and children

There is nothing here to track you with: no advertising, no analytics and no third-party scripts, so every visitor is treated the way a browser's Do Not Track signal asks, whether or not it is sent. StockOrNot is meant for adults; it is not for anyone under 18, and it does not knowingly keep information about children under 13.

Changes

If what is kept changes, for instance if paid membership is ever offered, this page changes first, and the date at the top moves.