Privacy Policy

1. What we collect

When you use Undertow we collect:

• Account data · email address, hashed password, and (if you use Google sign-in) your Google profile name and picture.
• Trader profile · the optional preferences you set during onboarding (instruments, risk tolerance, trading style).
• Product usage · routes visited, tickers viewed, chat prompts, and alert preferences. Used to operate and improve the service.
• Billing data · handled by Stripe; we receive your subscription status but never see your card details.
• Device & log data · IP address, user agent, and standard server logs, retained for security and abuse prevention.
• Push subscription · if you opt in, the browser-issued endpoint used to deliver push notifications.

2. How we use it

• Provide, personalize, and improve the Undertow platform.
• Process payments and manage subscriptions.
• Send transactional emails and push alerts you have opted into.
• Detect fraud, abuse, and security incidents.
• Comply with legal obligations.

We do not sell your personal data. We do not use your personal data to train third-party AI models.

3. Subprocessors

We rely on trusted third parties to run the service:

• Supabase · authentication, database, storage.
• Cloudflare · hosting, CDN, edge compute.
• Stripe · payment processing.
• Polygon & MASSIVE · market data providers.
• Anthropic · AI model provider for the co-pilot and brief.

4. Data retention

Account and trader-profile data are retained while your account is active. Product usage and log data are retained for up to 24 months. Options snapshot data is trimmed to a rolling 2-day window. On account deletion we remove your personal data within 30 days, excluding what we must retain for legal or accounting purposes.

5. Your rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. Email hello@getundertow.com to exercise any of these rights.

6. Cookies

We use strictly necessary cookies to keep you signed in and to secure the session. We do not use advertising cookies. Stripe may set cookies during checkout as part of its fraud prevention.

7. Security

We use row-level security on our database, encrypt data in transit (TLS 1.2+) and at rest, and follow least-privilege access controls. No system is ever perfectly secure · please report suspected vulnerabilities to hello@getundertow.com.

8. Children

Undertow is not directed to children under 18 and we do not knowingly collect data from minors.

9. Changes

We may update this policy from time to time. Material changes will be announced by email or in-app notice.

10. Contact

Questions? Email hello@getundertow.com.