StockAttic Privacy Policy

Effective Date: September 2, 2026

Last Updated: September 2, 2026

This Privacy Policy explains how StockAttic Technologies LTD collects, uses, discloses, retains, and protects personal information when you use StockAttic, including the web application at https://app.stockattic.com, mobile applications, account features, research tools, subscriptions, community features, support workflows, notifications, APIs where enabled, and AI-assisted analysis.

This policy is written for a cross-border product. Your rights may differ depending on where you live and which privacy laws apply to you.

Information We Collect

StockAttic may collect and process:

Account information, such as name, email address, user role, organization membership, email verification status, and account settings.
Authentication information, such as password hashes, password reset records, session records, bearer-token session records, MFA enrollment records, recovery controls, device identifiers, IP address, user agent, and login/security metadata.
Subscription and billing information, such as plan, entitlement, billing customer, checkout session, subscription, invoice, refund, dispute, provider, transaction reference, app-store purchase, and payment-status metadata.
Product information, such as watchlists, saved securities, portfolios, holdings entered for portfolio tools, research bookmarks, stock-call interactions, screener activity, alerts, notification preferences, lesson progress, quiz attempts, video playback authorization records, saved research, journal or strategy entries, and feature usage.
Community and support information, such as posts, comments, reports, blocks, moderation actions, support tickets, support messages, support attachments, account deletion requests, and related correspondence.
AI and automated-analysis information, such as prompts, questions, generated responses, citations, execution metadata, safety reports, user reports of AI output, and related diagnostic records.
Device, traffic, and technical information, such as app surface, browser, operating system, device type, referrer, campaign attribution, approximate country inferred from request headers, cookies, local settings, and service logs.
Communications information, such as transactional emails, notification delivery records, marketing preferences, unsubscribe events, push tokens, Telegram routing records where enabled, and support communications.

StockAttic does not intentionally store full payment card numbers in its own application database. Card, wallet, bank, app-store, or payment credentials are handled by the applicable payment provider, app store, or financial infrastructure provider where enabled.

Sources of Information

Information may come from you, your device, your browser, your organization administrator, payment providers, app stores, market-data providers, AI providers, support systems, email providers, notification providers, storage/video providers, security systems, and other service providers used to operate StockAttic.

How We Use Information

StockAttic uses personal information to:

Create, authenticate, secure, and administer accounts.
Provide research, market intelligence, watchlists, portfolios, alerts, education, support, community, subscription, mobile, API, and AI features.
Verify email addresses, passwords, MFA, sessions, devices, and mobile bearer tokens.
Process checkout, subscriptions, provider status, invoices, refunds, disputes, chargebacks, entitlement projections, and billing notifications.
Deliver service notices, transactional emails, push notifications, in-app notifications, Telegram notifications where enabled, and optional marketing communications.
Respond to support requests, investigate reports, moderate community content, enforce policies, and protect users.
Analyze service performance, product usage, campaign attribution, feature adoption, abuse patterns, security events, and billing operations.
Test, validate, and improve AI, market-data, research, support, notification, billing, and security systems.
Comply with legal, tax, accounting, fraud-prevention, sanctions, dispute, audit, and regulatory obligations where applicable.

Legal or Appropriate Bases

Depending on your location and applicable law, StockAttic may process personal information because it is necessary to provide the service or perform a contract, because you consented, because StockAttic has a legitimate interest in operating and securing the service, because processing is necessary for compliance with legal obligations, or because another lawful basis applies.

StockAttic does not claim that every privacy framework applies to every user. Where a law such as GDPR, UK GDPR, CCPA/CPRA, NDPA, or another privacy law applies to a particular user or processing activity, StockAttic will handle applicable requests according to that law.

Service Providers and Disclosures

StockAttic may disclose information to service providers and processors that help operate the service, including hosting, database, security, payment, app-store billing, email, marketing, support, analytics/traffic attribution, push notification, Telegram, object storage, video streaming, AI, market-data, and financial-infrastructure providers.

The codebase includes integrations or architecture for providers such as Stripe, Paystack, Flutterwave, PayPal, SeerBit, Fincra, Kora, Apple App Store, Google Play Billing, MailWizz, transactional email providers, Expo, Bunny Stream, S3-compatible storage including Backblaze B2, AI providers, market-data providers, and third-party financial infrastructure where enabled. A provider listed here may be disabled, sandboxed, unavailable, or used only when configured.

StockAttic may also disclose information if required by law, to enforce agreements, to protect rights and safety, to investigate fraud or abuse, to complete a corporate transaction, or with your direction or consent.

International Processing

StockAttic is a cross-border service. Personal information may be processed in countries other than your country of residence. Those countries may have different privacy and data-protection laws. Where applicable law requires transfer safeguards, StockAttic will use appropriate safeguards for the relevant transfer.

Cookies, Local Storage, and Mobile Storage

StockAttic uses cookies and similar storage for sessions, security, admin-entry checks, traffic attribution, visit measurement, and preferences. The web app uses local storage for interface preferences such as theme and sidebar state. The mobile app may use Expo SecureStore for session tokens and device identifiers. See the Cookie Policy for more detail.

Communications and Marketing

StockAttic may send account, security, billing, subscription, support, legal, policy, and service communications. These mandatory communications may be sent even if you opt out of optional marketing messages.

Where marketing features are enabled, StockAttic may process email addresses, plan status, names, list membership, subscription status, and unsubscribe records to manage marketing communications. You can use unsubscribe mechanisms where provided or change available preferences in the service.

Retention

StockAttic keeps personal information for as long as reasonably necessary for the purposes described in this policy, including account operation, feature delivery, billing, tax, accounting, fraud prevention, security, dispute handling, support, moderation, AI safety, audit, legal compliance, backups, and service integrity.

Retention periods may differ by data category, provider, jurisdiction, and legal obligation. StockAttic does not publish a fixed retention period where the repo does not verify an approved period.

Account Deletion

Users may request account deletion through supported mobile, account, or support workflows. Deletion may require identity verification and confirmation. Fulfillment may revoke web sessions, revoke mobile bearer sessions, disable registered devices, remove push tokens, suppress optional notifications, remove password hashes, mark the account deleted, and anonymize or delete profile data where permitted.

StockAttic may retain billing, tax, accounting, fraud-prevention, chargeback, dispute, security, audit, support, moderation, AI-safety, and legal records where required or reasonably necessary. Account deletion is separate from subscription cancellation, especially for subscriptions managed by Apple, Google, payment providers, or external billing sources.

Security

StockAttic uses technical and organizational measures intended to protect personal information, including hashed passwords, session controls, MFA features, secure token handling, webhook verification, access controls, audit logs, provider credential separation, and restricted administrative workflows. No system can be guaranteed completely secure.

Your Choices and Rights

Depending on your location and applicable law, you may have rights to access, correct, delete, restrict, object to, port, appeal, or receive information about certain processing of your personal information. You may also have rights to withdraw consent where processing is based on consent.

You can manage available notification preferences, mobile operating-system push permissions, subscriptions through the applicable billing source, support requests, and account deletion requests. To make a privacy request, contact StockAttic through the support or legal contact method provided within the StockAttic service.

Children

StockAttic is not intended for children under 13 and does not knowingly collect personal information from children under 13. If StockAttic learns that it has collected personal information from a child under 13 without appropriate consent, it will take reasonable steps to delete or otherwise handle the information as required by applicable law.

Changes

StockAttic may update this Privacy Policy from time to time. The Effective Date and Last Updated date identify the current version.

Contact

Contact StockAttic through the support or legal contact method provided within the StockAttic service.