Privacy Policy

1. Who we are

The Service is operated by StockOne.io (“we”, “us”, “our”), which is the controller of your personal data. You can contact us at any time at contact@stockone.io.

2. Information we collect

• Google account information. When you use “Sign in with Google”, sign-in is handled by our authentication provider, Supabase Auth, and we receive your name, email address, profile picture and Google account identifier. We request only the openid, email and profile scopes. We do not get access to your Gmail, Google Drive, Contacts, Calendar or any other Google data.
• Data you create in the Service. Your virtual portfolios (virtual cash balance, holdings, buy and sell transactions and portfolio value history), the tickers on your watchlist and your risk-monitoring preferences, and the time you last read the news feed.
• Server logs. Our hosting providers keep server logs (such as IP address, user agent and request time) for security and operational purposes.

3. Cookies and browser storage

• Authentication cookies. Supabase session cookies keep you signed in. They are strictly necessary for the Service to work.
• Theme cookie. A theme cookie remembers your light or dark mode preference for 1 year.
• Analytics consent. Your answer to the analytics banner is stored in your browser's localStorage. If you reject analytics, that choice is remembered for 14 days, after which the banner asks again.
• Google Analytics cookies. Only if you click “Accept” in the banner, Google Analytics sets its own cookies (for example _ga and _ga_*).

There is currently no in-app setting to withdraw your consent after accepting. You can withdraw it at any time by clearing this site's data (cookies and storage) in your browser, which will show the banner again and also sign you out, or by contacting us at contact@stockone.io.

4. Analytics

• Vercel Web Analytics and Vercel Speed Insights collect aggregated page-view and performance metrics. They do not use cookies.
• Google Analytics 4 is loaded only after you click “Accept” in the consent banner. If you reject it or do not answer, Google Analytics is not loaded.

5. How we use your information

We use personal data to:

• sign you in and maintain your account;
• provide the Service's features, such as your virtual portfolio, watchlist, news and analysis;
• generate AI-assisted analysis reports for tickers on your watchlist — only ticker symbols and public market data are used for this, never your name or email address;
• keep the Service secure and prevent abuse;
• understand aggregated usage and performance (Google Analytics only with your consent).

We do not sell your personal data, we do not use it for advertising or ad profiling, and we do not make automated decisions that produce legal or similarly significant effects on you.

6. Google user data

StockOne's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Google user data only to sign you in and to display your name and profile picture in the Service.
• We do not use Google user data for advertising.
• We do not transfer Google user data to third parties, except to the service providers we need to operate the Service (see section 8).
• No human reads your Google user data unless you have given your consent, it is necessary for security purposes, or it is required to comply with applicable law.
• You can revoke StockOne's access to your Google account at any time at myaccount.google.com/connections.

7. Legal bases for processing

Under the EU General Data Protection Regulation (GDPR), we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR) — to create and maintain your account and provide the Service's features under our Terms of Service.
• Consent (Art. 6(1)(a) GDPR) — for Google Analytics. You can withdraw your consent at any time; this does not affect the lawfulness of processing before the withdrawal.
• Legitimate interests (Art. 6(1)(f) GDPR) — to keep the Service secure, prevent abuse and ensure its essential operation, including server logs and cookie-free, aggregated Vercel analytics.

8. Service providers and international transfers

We share personal data only with the service providers we need to operate the Service:

• Supabase — database and authentication;
• Vercel — hosting, Vercel Web Analytics and Vercel Speed Insights;
• Google — Sign in with Google, and Google Analytics only if you consent.

These providers may process data outside the European Economic Area (EEA), for example in the United States. Where they do, they rely on appropriate safeguards such as the EU Standard Contractual Clauses.

We obtain market data from third-party sources such as Yahoo Finance, Finnhub and SEC EDGAR. We do not send them any personal data.

9. Data retention

• We keep your account data and the data you create in the Service for as long as your account exists.
• You can request deletion of your account by emailing us at contact@stockone.io. When your account is deleted, your portfolios, transactions and watchlist are deleted with it.
• Server logs kept by our hosting providers and Google Analytics data are retained according to those providers' retention settings.

10. Your rights

Under the GDPR, you have the right to:

• access your personal data;
• have inaccurate data rectified;
• have your data erased;
• restrict processing;
• data portability;
• object to processing based on our legitimate interests;
• withdraw your consent at any time.

To exercise any of these rights, contact us at contact@stockone.io. You also have the right to lodge a complaint with a data protection supervisory authority. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl).

11. Security

We protect your data with HTTPS encryption and row-level access controls in our database. However, no system is 100% secure, and we cannot guarantee absolute security.

12. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child under 16 has provided us with personal data, please contact us so we can delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. If we make material changes, we will highlight them clearly.

14. Contact

StockOne.io is the data controller responsible for your personal data. If you have any questions about this Privacy Policy or your data, contact us at contact@stockone.io.