Privacy Policy

If you create an account: your email address, an optional display name, and a password — stored only as a one-way bcrypt hash, never in plain text and never recoverable by us. We also record when the account was created and when it last signed in.

Once signed in: whatever you explicitly add — watchlist entries, alert rules, and the alert history they produce. All of it is scoped to your account; every query behind these pages filters by your user id.

If you search for a term the index hasn't crawled yet: the term itself is recorded, tied to your account if you're signed in, or kept only in this browser's local storage if you're not. Signing out clears the local copy.

Standard server logs: IP address and request metadata, used only to rate-limit abuse (login attempts, account creation, search requests) and kept only as long as needed for that.

Aggregate usage analytics: Google Analytics 4 records which pages are visited, roughly where from, and on what kind of device, so we can tell which parts of the index are actually useful. It is not tied to your account, it is not used for advertising or remarketing, and IP addresses are anonymised by Google before storage. Any browser “Do Not Track” or content-blocking extension stops it, and nothing on this site breaks when it is blocked.

What we do not collect: no advertising trackers, no cross-site tracking pixels, no data brokers, no payment information (nothing here is bought or sold).

Your email is used for exactly three things: signing you in, password-reset links, and alert emails when a rule you configured fires. Nothing else — no marketing, no digests you didn't ask for.

A search term you type may be sent to a third-party embedding API (to judge which results are actually about it — see the scoring methodology) and, if configured, an email-delivery provider to send you a message. Neither receives your password, email history, or anything beyond what's needed for that one call.

Session: one signed, HTTP-only token so you stay signed in. It carries your user id and role, cannot be read by page scripts, and expires automatically after 30 days or immediately when you sign out.

Analytics: Google Analytics sets its own first-party cookies (_ga, _ga_*) to tell one visit from the next. They hold a random id, never your email or account. Blocking them costs you nothing here.

You can remove any watchlist entry or alert rule yourself from those pages at any time.

To have your account and everything tied to it deleted, email opportunitymarket.org@gmail.com from the address on the account. We'll confirm once it's done.