Privacy Policy

Last updated: July 2026

This Privacy Policy explains how st-ox ("we", "us", "our") collects, uses, and protects your information when you use st-ox.com.

1. Information we collect

When you create an account we collect:

• Email address — used to identify your account and, if you opt in, to send you notification emails (see below).
• Password — stored as a hashed value (PBKDF2, 100,000 iterations, SHA-256). We never store your plaintext password.
• Portfolio data — holdings, cash balances, your trading journal (buy/sell records and realized gains), watchlists, settings, and price history you enter or generate in the app.
• Anything you submit to us — messages sent through the in-app feedback form.

We do not collect your name, phone number, or payment information. To operate the service we also process limited technical data: your IP address is used transiently to rate-limit sign-in and registration attempts (anti-abuse), and we store basic account-activity timestamps such as your last sign-in and last-seen time.

2. How we use your information

• To provide and operate the st-ox service.
• To authenticate your session and keep your portfolio data in sync across devices.
• To fetch live stock quotes and FX rates on your behalf via Yahoo Finance and other public APIs.
• To send you notification emails you have explicitly enabled — for example, trailing-stop price alerts. This is opt-in and off by default; you can turn it off at any time in Settings.
• To understand, in aggregate, how the site is used, via Google Analytics (see sections 4 and 5).

We do not sell, rent, or share your personal data with third parties for marketing purposes.

3. Data storage

Your data is stored in a Cloudflare D1 database hosted within Cloudflare's global infrastructure. Cloudflare's data centres are located primarily in the EU and US. For more information see Cloudflare's Privacy Policy.

4. Cookies and analytics

We use a session cookie (session) to keep you signed in. It is HttpOnly, Secure, and SameSite=Lax, scoped to st-ox.com; on the alternate stock-explode.pages.dev address it falls back to SameSite=None. It expires after 30 days of inactivity.

We also use Google Analytics to understand, in aggregate, how the site is used. Google Analytics sets its own cookies (for example _ga) and processes usage data such as pages viewed, device and browser type, and an approximate location derived from your IP address. We do not use advertising cookies and do not use analytics to identify you personally. You can opt out with the Google Analytics Opt-out Browser Add-on, or by blocking cookies in your browser.

5. Third-party services

The Service relies on the following external services:

• Yahoo Finance — stock quotes, historical prices, and dividend data.
• Frankfurter API — foreign exchange rates.
• Finnhub — analyst consensus ratings (only if you provide your own API key in Settings).
• TradingView — embedded chart, screener, and technical-analysis widgets.
• Google Analytics (Google) — aggregate usage analytics; see section 4.
• Resend — email delivery. If you enable trailing-stop email alerts, your account email address and the alert content are sent to Resend to deliver the notification. No email is sent unless you opt in.

These services have their own privacy policies and may log your IP address when requests are made.

6. Your rights (GDPR)

If you are in the European Economic Area you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (via Settings → Account).
• Delete your account and all associated data (via Settings → Clear All Data, or by contacting us).
• Object to or restrict processing of your data.

To exercise any of these rights, contact us at [email protected].

7. Data retention

We retain your data for as long as your account is active. You can delete all your data at any time from Settings → Clear All Data. Deleted data is permanently removed from our database.

8. Security

All connections to st-ox are encrypted via HTTPS. Passwords are hashed and salted before storage. Session tokens are randomly generated 32-byte hex strings.

9. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes.

10. Contact

If you have any questions about this Privacy Policy, contact us at [email protected].