Privacy Policy — stockrow

Last updated: November 4, 2026

The privacy of your data — and it is your data, not ours — is a big deal to us. This policy lays out what data we collect and why, how it is handled, and your rights with respect to it. We have never sold your data, and we never will.

It applies to stockrow.com and to everything served from it: the website, the API, and the MCP server that connects AI assistants. “You” means anyone who visits the site or has an account.

What we collect and why

Our guiding principle is to collect only what we need.

Identity and access

When you create an account we ask for your email address and, unless you sign in with Google or by an emailed link, a password, which we store only as a hash. If you sign in with Google, we receive your Google account’s identifier and email address. We use these to run your account and to send you essential messages about it.

What you keep in your account

We store what you save with us — the companies you follow, your screens, alerts and exports, and your API keys — so that you can use the product. We keep it for as long as your account is active.

Billing information

If you subscribe to Powerpack, your card details go directly to our payment processor, Stripe, and never reach our servers. We keep your Stripe customer and subscription references and the status of your plan, for your account’s history and for billing support. If you cancel, we may ask why, and keep your answer.

Email

We send account messages, the notifications and alerts you set up, and, unless you unsubscribe, Stockrow Weekly and tips on getting started. We record what we sent you and whether it was delivered, opened or clicked, so we can tell what is useful and stop sending to addresses that bounce. Every bulk message has an unsubscribe link.

IP addresses and logs

We record the IP addresses of your two most recent sign-ins, for security and fraud prevention, for as long as your account is active. Our web servers’ access logs include IP addresses and browser details, and are kept for 14 days. When something breaks, an error report goes to our error tracker, Sentry.

Website interactions

We count page views and product events, such as which pages are visited, which website referred you and which features are used, with Plausible, which we run on our own server. We use this to decide what to improve and to test new designs.

Cookies

A cookie is a piece of text stored by your browser. We use first-party cookies to keep you signed in, to protect forms against forgery and to keep the version of a page you see consistent while we test a new one. We do not use advertising cookies. If you use Google sign-in, Google’s own script runs on the pages that offer it. You can block cookies in your browser settings, but you will not be able to sign in without them.

AI assistants, the API and the MCP server

When you connect an AI assistant, you sign in to stockrow and approve it. We store that connection and a daily count of requests for each key or connection and endpoint or tool, which is how rate limits work. Our servers also process the requests themselves, such as the ticker or screen asked for. We do not receive your conversation with the assistant, only the calls it makes to us. What the assistant does with our answers is governed by its provider’s privacy policy. You can disconnect an assistant at any time on your API page.

Voluntary correspondence

When you write to us, through the contact form or by email, we keep the message and your email address, so that we have the history if you write again.

When we access or disclose your information

To provide the service. We use a few third-party processors to run stockrow: Stripe (payments), Mailgun (email), Cloudflare (network delivery, security and file storage), Hetzner (hosting), Sentry (error reports) and Google (sign-in, if you choose it, and business email).

To help you, or to fix a problem. We look at your account’s data only when we need to: to answer a support request, to fix a bug or to run the service.

To investigate abuse. If we have reason to believe an account is breaking our Terms and Conditions, we may look at how it has been used and act on what we find, including notifying the appropriate authorities where warranted.

Aggregated data. We may use aggregated or de-identified data, which no longer identifies you, for any purpose, including marketing and analytics.

When the law requires it. We disclose user data to a government or a court only when compelled by valid legal process, or in a genuine emergency. We will tell you before we do, unless we are legally prohibited from telling you.

If stockrow changes hands. If stockrow is acquired or merged — we do not plan on it — we will notify you before your personal information is transferred or becomes subject to a different privacy policy.

Your rights with respect to your information

We apply the same rights to everyone, wherever you live:

Right to know. You can know what personal information we collect and how it is used, which is what this policy is for.
Right of access. You can ask for the personal information we hold about you.
Right to correction. You can correct your information, in your account settings or by asking us.
Right to erasure. You can ask us to erase your personal information. As stockrow cannot work without an email address, this closes your account.
Right to restrict processing, and to object. In certain situations, you can limit or object to how your information is used.
Right to portability. You can receive your personal information in a form you can take elsewhere.
Right to non-discrimination. We will not charge you more or serve you worse for exercising these rights, although some of them may by their nature stop you using the service.
Right to complain. You can complain to your data protection authority about how we handle your information.

To exercise any of these, write to [email protected]. We may need to verify that the request comes from you, usually by a reply from the address on the account. Some information may be exempt under applicable law, for example billing records we must keep.

How we secure your data

All data is encrypted with TLS on its way between our servers and your browser. Passwords are stored only as hashes, and API keys are shown in full only when they are made. Most other data is not encrypted while it lives in our database, since it has to be ready to send to you when you need it.

Data retention

We keep your information for as long as it takes to do what we collected it for, after which we delete or aggregate it. Cancelling a subscription does not close your account: it stays, on the free plan, until you ask us to delete it. When you do, we will delete your personal information from our active systems within 60 days, except what we must keep to meet legal obligations, resolve disputes and enforce our agreements.

Location of data

Some of the processors above operate in the United States and elsewhere, so your information may be processed outside the country you live in. By using stockrow, you understand that it may be transferred there.

Changes and questions

We may update this policy to comply with regulations and to reflect new practices. When we make a significant change we will refresh the date at the top of this page and take any other appropriate steps to notify you.

Have a question or a concern about this policy, your data or your rights? Write to [email protected] and we will be happy to try to answer it.