Privacy Policy

The short version: an email address if you want an API key, a count of the calls you make, and no payment details at all. We do not sell anything to anyone.

1. What we collect

• Email address — only if you create an account. It is the account's identity and where login links are sent.
• API key — generated by us, used to authenticate your API calls.
• Password — only if you choose to set one. Stored as a bcrypt hash; we never see or store the password itself.
• Usage logs — which endpoint you called and when, so your monthly allowance can be counted and shown to you.
• Page views and searches — the path visited and, on a company page, the ticker. Recorded against a salted digest of your address, not against your account.
• A salted digest of your IP address — for rate limiting and abuse control. We do not store IP addresses. The digest is enough to tell two visitors apart for a day; it is not reversible into an address, and it is not a person — one office shares an address, and one phone moving from wifi to cellular produces two.

2. What we do not collect

No payment information, of any kind. There is no payment processor on this site and no card form. Payment is arranged directly with 01dominique.c@gmail.com by e-transfer or PayPal, so card and banking details never reach this service and are never stored by it.

No tracking cookies, no advertising identifiers, no third-party analytics, and no cross-site tracking of any kind.

3. Why we collect it

• To run the service and let you make API calls.
• To count usage against your allowance, and to show you that count.
• To send you login links and account email.
• To rate-limit and to stop abuse.
• To understand which companies are looked at, so the site can be improved. This is aggregate interest in tickers, not a profile of you.

4. Who else sees it

• Railway — hosting. The application and its database run there.
• AgentMail — email delivery. Receives your address and the message when we send you a login link or an account email.
• OpenRouter — only if you use the optional question box on a company page. Your question and the filed figures for that company are sent to a language model to answer it. Do not type anything private into that box. If you never use it, nothing is sent.

We do not sell your data, and we do not share it for advertising. We will disclose data if the law requires it.

5. Security, stated honestly

• The site is served over HTTPS.
• Passwords are hashed with bcrypt and are not recoverable by us.
• Session cookies are signed, HttpOnly and Secure.
• API keys are stored as issued, not encrypted or hashed. That is a deliberate trade: the key is read-only over data that is already public, and a recoverable key means a lost key is a lookup rather than a re-registration. It also means you should treat your key as a password, and that anyone with access to our database could read it. If you would rather it were not sitting there, you can regenerate it at any time, and access is revocable.

No system is perfectly secure and we do not claim otherwise.

6. How long we keep it

• Account data — for as long as the account exists, or until you ask us to delete it.
• Usage logs — kept so your allowance can be counted and audited.
• Page views and digests — retained in aggregate for analytics. They are not linked to your account.
• Login links — deleted shortly after they expire.

7. Your rights

Under PIPEDA and comparable law you may ask for access to the personal information we hold about you, its correction, or its deletion.

• Access — your account, tier, usage and key are all on your dashboard. Ask 01dominique.c@gmail.com for anything beyond that.
• Correction — email 01dominique.c@gmail.com to change the address on an account.
• Deletion — email 01dominique.c@gmail.com and we will delete the account, its key and its usage logs. Aggregate figures that are not linked to you may remain.

If you are unhappy with how we have handled a request, you can complain to the Office of the Privacy Commissioner of Canada.

8. Cookies

One cookie, set only when you sign in, holding a signed session. It is how the dashboard knows who you are. There are no tracking or advertising cookies. Your browser also stores your API key locally if you paste one in; that never leaves your device except as the header on your own API calls.

9. Where the data lives

The service is operated from Ontario, Canada, and hosted on infrastructure that may process data outside Canada. Using the service means accepting that.

10. Changes

Material changes will be announced by email to account holders, or by a notice on the site.

11. Contact

Privacy questions, access requests and deletion requests: 01dominique.c@gmail.com.