Privacy Policy

Last updated: October 2026

This Privacy Policy explains how st-ox ("we", "us", "our") collects, uses, and protects your information when you use st-ox.com.

The person responsible for your data (the data controller) is Tarmo Kõuhkna, a private individual in Estonia. Address and contact details are in the Imprint.

1. Information we collect

When you create an account we collect:

• Email address — used to identify your account and to send you emails about your own portfolio (see below).
• Password — stored as a hashed value (PBKDF2, 100,000 iterations, SHA-256). We never store your plaintext password.
• Portfolio data — holdings, cash balances, your trading journal (buy/sell records and realized gains), watchlists, saved option strategies (their legs and the prices you entered them at), settings (including your Finnhub API key, if you enter one), and price data cached by the app.
• Anything you submit to us — messages sent through the in-app feedback form.

We do not collect your name, phone number, or payment information. To operate the service we also process limited technical data: your IP address is stored in a short-lived counter to rate-limit sign-in, registration and feedback attempts (anti-abuse); these counters are cleaned up automatically once they are older than about a day, so an entry can occasionally last a little longer. Our server also keeps short-lived operational logs (request metadata such as time, path, status and errors), which Cloudflare retains for a few days. We also store basic account-activity timestamps such as your last sign-in and last-seen time.

2. How we use your information

• To provide and operate the st-ox service.
• To authenticate your session and keep your portfolio data in sync across devices.
• To fetch live stock quotes and FX rates on your behalf via Yahoo Finance and other public APIs.
• To send you a weekly summary of your own portfolio — on by default for accounts created on the English pages and off by default for accounts created on the German pages; you can switch it on or off at any time in Settings, and turn it off with the link in any summary — and, only if you enable them, trailing-stop price alerts (off by default). We also email you when we reply to feedback you send.
• To understand, in aggregate, how the site is used, via Cloudflare Web Analytics (see sections 4 and 5).

We do not sell or rent your personal data, and we do not share it with third parties for marketing purposes.

Legal bases (GDPR Art. 6): providing your account and the features you use, syncing your data, fetching quotes, and sending the emails you switched on or the replies you asked for rest on performance of our contract with you (Art. 6(1)(b)). Rate limiting and other abuse protection, security, short-lived operational logs, aggregate analytics, and the weekly summary where it is on by default rest on our legitimate interests in running a secure service, understanding how it is used and keeping you informed about your own portfolio (Art. 6(1)(f)). You can object to this at any time (see section 6), and you can turn the weekly summary off in Settings.

3. Data storage

Your data is stored in a Cloudflare D1 database hosted within Cloudflare's global infrastructure. Cloudflare operates a global network and we do not choose the database region, so your data may be stored and processed in any country where Cloudflare operates, including outside the EU. Cloudflare and Resend are US-based companies; where data is transferred outside the European Economic Area, we rely on the safeguards these providers offer in their data processing terms, such as the EU Standard Contractual Clauses. For more information see Cloudflare's Privacy Policy.

4. Cookies and analytics

We use a session cookie (session) to keep you signed in. It is HttpOnly, Secure, and SameSite=Lax, scoped to st-ox.com; on the alternate stock-explode.pages.dev address it falls back to SameSite=None. It expires 30 days after you sign in.

We count visits with Cloudflare Web Analytics, which is cookieless: it stores nothing on your device, does not fingerprint your browser and does not follow you across other sites. For each page view it records aggregate data — the page, the referring site, browser and device type, and the country derived from your IP address — and we only ever see totals, never a profile of an individual visitor. We do not use advertising cookies or any other analytics.

The app also keeps a local copy of your portfolio data, your settings (such as theme and language, and your Finnhub API key if you entered one) and cached market data in your browser's local storage. That is needed to provide the Service you asked for and is never used for tracking.

5. Third-party services

The Service relies on the following external services:

• Yahoo Finance — stock quotes, historical prices, and dividend data.
• Frankfurter API — foreign exchange rates.
• Finnhub — analyst consensus ratings (only if you provide your own API key in Settings; the key is stored with your settings and used by our server to query Finnhub on your behalf).
• TradingView — embedded chart, technical-analysis and fundamentals widgets, and the stock-screener data behind the Screener page (requested by your browser directly).
• corsproxy.io and AllOrigins — fallback relays used only if our own market-data endpoint is unreachable. When a fallback is used, the request (including the ticker symbol being looked up) passes through that relay instead.
• FRED (Federal Reserve Bank of St. Louis) — the economic series behind the Valuation page. Requested by our server, not your browser, so no request of yours reaches them.
• SEC EDGAR, Bing News and Google News — company filings and news headlines behind the What changed panel. Requested by our server; the requests carry only a ticker symbol or company name.
• Cloudflare — hosting of the website and our server, and cookieless Web Analytics; see section 4.
• Resend — email delivery. Your account email address and the content of each email are sent to Resend to deliver it: the weekly portfolio summary, trailing-stop alerts if you enable them, replies to feedback you send, and a notification to us when you send feedback (containing your message, your email address and how many positions and watchlist entries you have).
• Microsoft (Outlook.com) — hosts the mailbox where we receive those feedback notifications and any reply you send to an email from us. Microsoft is a US-based company certified under the EU-U.S. Data Privacy Framework.

These services have their own privacy policies and may log the IP address a request comes from. TradingView and, if our own endpoint is unreachable, the fallback relays are contacted directly by your browser, so they see your IP address. Yahoo Finance, Frankfurter, Finnhub, SEC EDGAR and the news sources are contacted by our server, so they see our server's address, not yours.

We do not send your holdings, cash balances or trade history to any of these providers, with two exceptions that are inherent to how the service works: Cloudflare stores your data (section 3), and Resend delivers the emails we send you, which can contain figures from your portfolio (such as the weekly summary). Market-data and news requests carry only the ticker symbol or company name being looked up.

6. Your rights (GDPR)

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (your email address and password via Settings → Account; your portfolio data directly in the app).
• Delete your account and all associated data at any time, yourself, from Settings → Danger zone → Delete account (or by contacting us).
• Object to or restrict processing of your data.
• Receive the data you provided in a common, machine-readable format (you can export your trading journal as CSV from the app; for anything else, ask us).
• Withdraw any consent at any time, for example by switching off the optional emails in Settings.
• Lodge a complaint with a data protection authority: in Estonia the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), or the authority in your country of residence.

To exercise any of these rights, contact us at [email protected].

7. Data retention

We retain your data for as long as your account exists. You control removal, and both options act on our database immediately — there is no soft-delete, and we keep no backup copy of our own. Cloudflare's database service automatically keeps a short-term change history for a limited period; we do not use it to restore deleted accounts.

Settings → Clear All Data erases your holdings, cash balances, realized-trade log, watchlists, saved option strategies and cached price history, and clears the caches held in your browser. Your account, email address and preferences are kept, so you stay signed in and can start again from empty.

Settings → Danger zone → Delete account erases everything we store in our database for your account: all of the above plus your email address, sign-in credentials, saved settings and any feedback you have sent. Your password is required to confirm. Once done, the account no longer exists and we cannot recover it. One thing is not removed automatically: the notification email we receive when you send feedback (see section 5), which we delete on request. Rate-limit counters tied to your IP address rather than your account (for sign-in, registration and feedback) expire on their own within about a day, as described in section 1.

If you would rather we did it for you, email [email protected] and we will erase the account on request.

8. Security

All connections to st-ox are encrypted via HTTPS. Passwords are hashed and salted before storage. Session tokens are randomly generated 32-byte hex strings.

9. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes.

10. Contact

If you have any questions about this Privacy Policy, contact us at [email protected].