1. Scope and operator
This policy applies to the Intelivestors stock screening, research, community, account, and support features. External websites and SEC source pages follow their own policies.
2. Information we process
| Category | Information | Purpose |
|---|---|---|
| Account and verification | Display name, email address, verification request and result, account status, and terms acceptance time | Registration, sign-in, verification, and password reset |
| Security credentials | Keyed contact hash, salted and server-secret-protected password hash, verification-code hash, and session-token hashes | Authentication and session protection with less raw exposure |
| Community | Posts, comments, selected sector and ticker tags, likes, reports, blocks, and language | Discussion, moderation, and community safety |
| Usage analytics | Feature event, screen path, language, device category, referral channel, country code, and a daily pseudonymous visitor value | Understand errors, performance, and feature use |
| Security events | Pseudonymous network and account values, event type, time, and review status | Detect and respond to abuse, intrusion attempts, and token reuse |
A raw contact identifier is used transiently to process registration and sign-in. The primary Intelivestors account database stores a keyed hash instead. When you request email verification, the raw address is sent to Resend. The current release supports email registration only.
3. Device and session storage
The mobile app keeps the refresh token in operating-system secure storage and uses the short-lived access token in memory. The server stores token hashes, not raw tokens. The watchlist and recent snapshots used to detect notable changes are stored only on the device until the user removes them or clears the app data. The watchlist itself is not sent to the server.
4. Service providers
- Cloudflare: app APIs, public pages, database, network delivery, and security.
- Resend: sends a verification code when email verification is selected.
Intelivestors manages provider terms and configuration so service providers process information only to deliver the service and apply protections consistent with this policy. Providers may process technical logs under their own policies to operate and secure their services. Depending on service location, information may be processed outside your country. Any additional notice or consent required for a release region will be reflected in the applicable launch terms.
5. Analytics and security retention
Analytics does not store the raw IP address. It uses a keyed, daily visitor value and aggregate counts. Browser DNT and Global Privacy Control signals disable web analytics. When the mobile app opens a company detail, only its ticker is added to an aggregate daily view count; no account ID, device ID, or raw IP address is stored with that count. Company daily-view aggregates have a 2-day cleanup target. Daily unique web values have an 8-day cleanup target, aggregate web analytics a 400-day target, and pseudonymous security events a 90-day target. Cleanup is triggered by later service activity, so a record can remain past its target until the next cleanup run. Records may be preserved longer when legally required or reasonably necessary for an actual dispute, to the extent allowed by applicable law.
6. Retention and deletion
Account and community records are kept while the account is active. Verification codes and sessions become unusable at their defined expiry; their records and rate-limit values are removed when later service activity triggers cleanup. Account deletion removes the profile, credentials, sessions, posts, comments, and linked records. Aggregate analytics and pseudonymous security events that are not directly linked to the account may remain under the cleanup targets above.
7. Your choices and rights
You can sign out or delete the account in app settings, or delete it here after authentication. For access, correction, restriction, or other privacy requests, use the dedicated privacy address. We will verify identity and applicable legal requirements before acting.
8. Safeguards
We use encryption in transit, keyed hashing for contacts and tokens, strong password hashing, short access sessions, rate limits, non-public raw data, security-event logging, and an owner review console. Configured operational channels notify the owner about high-risk events and new community reports. No system can guarantee absolute security. Confirmed incidents are contained, investigated, and disclosed to affected users when required by applicable law.
9. Contact and changes
Send privacy requests to privacy@intelivestors.com. Material changes will update the effective date and be announced in the app or on this page.
Data controller: Intelivestors. The operator can be identified through the seller information displayed on the App Store and contacted through the dedicated privacy address above.