Privacy & Cookies

1. What we collect

• Account data: email address, username, and a salted hash of your password (we never store the password itself), plus account creation time and subscription status.
• Portfolio data: the holdings you enter in My Portfolio (ticker, share count and average cost), stored on our server against your account so it follows you between devices.
• Technical data: standard server logs (IP address, requested path, timestamp, user agent) kept for security and troubleshooting.
• AI assistant messages: what you type to the NOVO AI Bot is sent to our AI provider to generate a reply. We do not store chat transcripts on our servers.

We do not run advertising, we do not use analytics or tracking scripts, and we do not sell your personal data.

2. Cookies and browser storage

We use only what is strictly necessary to run the Service, so there is no consent banner:

• Session cookie (first-party, HttpOnly, signed): keeps you signed in. Without it you cannot use the dashboard.
• Local storage in your browser (never sent to us): your theme, watchlist, dividend-calculator inputs, All Stocks filters, chat panel width and the last signed-in email. Clear it any time in your browser settings.

3. Who else sees data

• Market-data sources (such as Yahoo Finance): ticker symbols and search terms you use are sent to them to fetch quotes. Your account details are not.
• AI provider (Anthropic): receives the messages you send the NOVO AI Bot and the dashboard context needed to answer.
• Google Fonts: your browser loads fonts from Google, which receives your IP address.
• Payment processor: if paid plans are offered, card details are handled by the payment processor and never touch our servers.
• Hosting: the Service runs on Amazon Web Services infrastructure.
• We may disclose information when required by law or to protect the Service.

4. Public Signal Record

The Signal Record page is public and contains only the engine's signals and their performance. It contains no user data.

5. Retention and deletion

Account and portfolio data are kept while your account exists. You can ask us to delete your account and its portfolio data at any time. Server logs are kept only for a limited time under the server's log rotation.

6. Security

Traffic is encrypted in transit, passwords are salted and hashed, and login attempts are rate-limited. No system is perfectly secure, so use a unique password.

7. Your rights

Depending on where you live you may have the right to access, correct, export or delete your personal data, or to object to its processing. Contact us to exercise these rights.

8. Children

The Service is not directed to anyone under 18 and we do not knowingly collect their data.

9. Changes and contact

We will update the date above when this policy changes.