Privacy Policy

Last updated: July 2026

This Privacy Policy explains how st-ox ("we", "us", "our") collects, uses, and protects your information when you use st-ox.com.

1. Information we collect

When you create an account we collect:

• Email address — used to identify your account and, if you opt in, to send you notification emails (see below).
• Password — stored as a hashed value (PBKDF2, 100,000 iterations, SHA-256). We never store your plaintext password.
• Portfolio data — holdings, cash balances, your trading journal (buy/sell records and realized gains), watchlists, settings, and price history you enter or generate in the app.
• Anything you submit to us — messages sent through the in-app feedback form.

We do not collect your name, phone number, or payment information. To operate the service we also process limited technical data: your IP address is used transiently to rate-limit sign-in and registration attempts (anti-abuse), and we store basic account-activity timestamps such as your last sign-in and last-seen time.

2. How we use your information

• To provide and operate the st-ox service.
• To authenticate your session and keep your portfolio data in sync across devices.
• To fetch live stock quotes and FX rates on your behalf via Yahoo Finance and other public APIs.
• To send you notification emails you have explicitly enabled — for example, trailing-stop price alerts. This is opt-in and off by default; you can turn it off at any time in Settings.
• To understand, in aggregate, how the site is used, via Google Analytics (see sections 4 and 5).

We do not sell, rent, or share your personal data with third parties for marketing purposes.

3. Data storage

Your data is stored in a Cloudflare D1 database hosted within Cloudflare's global infrastructure. Cloudflare's data centres are located primarily in the EU and US. For more information see Cloudflare's Privacy Policy.

4. Cookies and analytics

We use a session cookie (session) to keep you signed in. It is HttpOnly, Secure, and SameSite=Lax, scoped to st-ox.com; on the alternate stock-explode.pages.dev address it falls back to SameSite=None. It expires after 30 days of inactivity.

We also use Google Analytics to understand, in aggregate, how the site is used. Google Analytics sets its own cookies (for example _ga) and processes usage data such as pages viewed, device and browser type, and an approximate location derived from your IP address. We do not use advertising cookies and do not use analytics to identify you personally. You can opt out with the Google Analytics Opt-out Browser Add-on, or by blocking cookies in your browser.

5. Third-party services

The Service relies on the following external services:

• Yahoo Finance — stock quotes, historical prices, and dividend data.
• Frankfurter API — foreign exchange rates.
• Finnhub — analyst consensus ratings (only if you provide your own API key in Settings).
• TradingView — embedded chart and technical-analysis widgets, and the stock-screener data behind the Screener page (requested by your browser directly).
• jsDelivr — content-delivery network serving the charting library. Your browser requests it on every page load.
• corsproxy.io and AllOrigins — fallback relays used only if our own market-data endpoint is unreachable. When a fallback is used, the request (including the ticker symbol being looked up) passes through that relay instead.
• FRED (Federal Reserve Bank of St. Louis) — the economic series behind the Valuation page. Requested by our server, not your browser, so no request of yours reaches them.
• Google Analytics (Google) — aggregate usage analytics; see section 4.
• Resend — email delivery. If you enable trailing-stop email alerts, your account email address and the alert content are sent to Resend to deliver the notification. No email is sent unless you opt in.

These services have their own privacy policies and may log your IP address when requests are made. Except where noted above, these requests are made by your browser, so your IP address is visible to that provider.

We never send your holdings, cash balances, trade history or account details to any of these providers. Market-data requests carry only the ticker symbol being looked up.

6. Your rights (GDPR)

If you are in the European Economic Area you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (via Settings → Account).
• Delete your account and all associated data at any time, yourself, from Settings → Danger zone → Delete account (or by contacting us).
• Object to or restrict processing of your data.

To exercise any of these rights, contact us at [email protected].

7. Data retention

We retain your data for as long as your account is active. You control removal, and both options act on our database immediately — there is no soft-delete, no backup copy, and no recovery period.

Settings → Clear All Data erases your holdings, cash balances, realized-trade log, watchlists and cached price history, and clears the caches held in your browser. Your account, email address and preferences are kept, so you stay signed in and can start again from empty.

Settings → Danger zone → Delete account erases everything: all of the above plus your email address, sign-in credentials, saved settings and any feedback you have sent. Your password is required to confirm. Once done, the account no longer exists and cannot be recovered.

If you would rather we did it for you, email [email protected] and we will erase the account on request.

8. Security

All connections to st-ox are encrypted via HTTPS. Passwords are hashed and salted before storage. Session tokens are randomly generated 32-byte hex strings.

9. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes.

10. Contact

If you have any questions about this Privacy Policy, contact us at [email protected].