Privacy policy
Last updated July 31, 2026
Who controls your data
On Pure LLC is the data controller responsible for TradeandTell. Its postal address is On Pure LLC · 514 Americas Way, PMB 24953 · Box Elder, SD 57719.
What we collect
- Account data: email, username, display name, and any optional profile fields you provide (bio, Substack URL, X handle, website).
- Portfolio data: the trades, notes, and cash flows you record. This is yours.
- Payment data: handled by Stripe. We see only the metadata needed to fulfill subscriptions; Stripe holds the card information.
- Usage telemetry: basic server logs (IP, user agent, request paths) and aggregate analytics.
What's public by default
Profiles are public unless you toggle them private in settings. Portfolios you mark as public are viewable by anyone, including via embed widgets, RSS feeds, and Open Graph cards. Profile visibility and per-portfolio visibility are independent toggles.
How we use it
To run the service: authenticating you, rendering your portfolios, processing payments, sending you notifications you opted into, and improving the product. We do not sell your personal data. We do not rent it. We do not show ads.
Automated decision-making
TradeandTell does not use personal data for solely automated decision-making, including profiling, that produces legal effects or similarly significantly affects you. Automated rankings, performance calculations, and AI-generated summaries provide information; they do not make such decisions about you.
Sub-processors
We use third parties to run the service. The full list:
- Supabase — database + authentication
- Vercel — application hosting + cron + logs
- Polygon.io — market data lookups (we don't send them personal information)
- Stripe — payment processing for paid follows
- Cloudflare R2 — encrypted backups of the database
- SEC EDGAR — public 13F filing data (no personal data sent)
- SnapTrade — brokerage account linking and trade/position sync for connected brokerages
- Resend — delivery of account, notification, and digest emails (receives your email address)
- Anthropic — AI-generated portfolio summaries (receives the computed figures shown on the page)
- OpenAI — text-to-speech narration of those summaries (receives the summary text)
How long we keep it
- Account data: retained while your account exists. When you delete your account, deletion is immediate and cascades through the associated account records.
- Server and request logs: retained for 60 days.
- Payment records: transaction records may be retained longer by Stripe under its own retention requirements and by us where tax, accounting, or other law requires financial records to be kept.
- Backups: deleted data may remain in encrypted backup copies until those copies expire under the active backup rotation.
Your rights
You can download a full data export from Settings under "Your data," or permanently delete your account from Settings under "Danger zone." You can also edit or delete your profile, portfolios, and trades from your account.
- Access: you may request a copy of your personal data and information about how we process it.
- Rectification: you may ask us to correct inaccurate or incomplete personal data.
- Erasure: you may ask us to delete your personal data.
- Restriction: you may ask us to limit how we process your personal data.
- Portability: you may request your personal data in a structured, commonly used, machine-readable format and ask us to transmit it where applicable.
- Objection: you may object to processing where that right applies.
If you cannot use the in-app controls, exercise these rights by emailing privacy@tradeandtell.com. We'll respond without undue delay and in any event within one month.
Where processing relies on your consent, you may withdraw that consent at any time without affecting processing carried out before withdrawal. Use the notification email toggles in Settings or contact us at the address above.
UK readers may complain to the Information Commissioner's Office. Readers elsewhere may complain to their local supervisory authority.
Information required for an account
An email address and password are required when you create an account with email. If you use Google sign-in, Google supplies the authentication credential instead of a TradeandTell password. We cannot create or provide an account without an email address and a supported authentication method.
Cookies
Supabase sets a strictly necessary authentication cookie to keep you logged in. Vercel Web Analytics collects aggregate page-view metrics without cookies or cross-site identifiers. We don't set marketing or cross-site tracking cookies. If we ever do, we'll ask first.
Children
The service isn't intended for users under 18. We don't knowingly collect data from children. If you believe we have, email us and we'll delete it.
Security
Data is encrypted in transit (TLS) and at rest. Backups are encrypted off-site. We follow industry-standard practices but no system is perfectly secure. If you suspect a vulnerability, email security@tradeandtell.com. If a personal-data breach requires notification under applicable law, we will notify affected users and the relevant supervisory authority without undue delay as required by that law.
Changes
We'll post the new version with a revised "Last updated" date. Material changes get an email or in-app notice.