Privacy Policy

We collect the following categories of information: Account Information. When you create an account, we collect your email address and authentication credentials via Supabase Auth. We do not store passwords directly; authentication is handled by Supabase's secure auth infrastructure. API Keys. You may configure third-party API keys (Alpaca, Finnhub, Anthropic) within the Service. These keys are stored as encrypted environment variables in your Vercel deployment and are never logged, transmitted to our servers, or accessible to Sintinel staff. Usage Data. We collect basic analytics including pages viewed, features used, and error logs to improve the Service. This data is anonymized and aggregated. Market Data. Sentiment scores, raw signals, watchlists, trade history, and model configurations are stored in your Supabase database. This data belongs to you.

We use collected information to: › Provide and maintain the Service, including sentiment scoring, quantitative modeling, and trade execution. › Send transactional emails (account verification, password resets, billing receipts). › Improve the Service through aggregated, anonymized usage analytics. › Respond to support requests. We do not use your data for advertising, profiling, or marketing purposes. We do not sell or share your data with third parties for their marketing purposes.

When AI-powered sentiment scoring is enabled, text snippets from publicly available sources (news headlines, Reddit posts) are sent to Anthropic's API (Claude) for analysis. These snippets do not contain personally identifiable information. Anthropic's data retention policies apply to API calls; Sintinel uses Anthropic's API in zero-data-retention mode where available. No user account data, trade history, or portfolio information is ever sent to AI providers.

Your data is stored in Supabase with row-level security (RLS) enabled — meaning only authenticated requests from your account can access your data. Database connections use TLS encryption in transit. Supabase encrypts data at rest using AES-256. The application is deployed on Vercel's infrastructure with automatic HTTPS/TLS. Environment variables (API keys) are encrypted at rest in Vercel's secure vault. We do not operate our own servers. All infrastructure is provided by Supabase (database), Vercel (application hosting), and the respective third-party APIs.

Your data is retained for as long as your account is active. Sentiment snapshots, raw signals, and trade history accumulate over time as part of the Service's core functionality — this historical data powers backtesting and model accuracy. Upon account deletion, we will delete your authentication record within 30 days. Your Supabase database data persists independently in your Supabase project; you are responsible for deleting it if desired. Free tier accounts inactive for 90+ consecutive days may have ingestion data (raw signals, sentiment snapshots) purged to manage storage. Account data and configuration are preserved.

Sintinel integrates with the following third-party services, each with their own privacy policies: › Supabase — Database, authentication, and row-level security. Data is stored in Supabase's infrastructure. › Vercel — Application hosting and deployment. › Alpaca Markets — Brokerage integration for market data and trade execution. › Finnhub — Financial market data and company fundamentals. › Anthropic (Claude) — AI-powered sentiment analysis. › Reddit — Public API for sentiment signal ingestion. We recommend reviewing each provider's privacy policy. We select providers with strong data protection practices, but are not responsible for their data handling.

Sintinel uses only essential cookies required for authentication session management (Supabase auth tokens). We do not use advertising cookies, tracking pixels, or third-party analytics scripts. We do not participate in cross-site tracking or retargeting networks.

Depending on your jurisdiction, you may have the right to: › Access your personal data and export it. › Correct inaccurate information. › Delete your account and associated data. › Object to certain processing activities. › Port your data to another service. To exercise any of these rights, contact us at privacy@sintinel.ai. We will respond within 30 days. For EU/EEA residents, our lawful basis for processing is contractual necessity (providing the Service you signed up for) and legitimate interest (improving the Service).

Supabase and Vercel infrastructure may process data in the United States. By using the Service, you consent to the transfer of your data to the United States. We rely on the service providers' compliance with applicable data transfer mechanisms.

Sintinel is not intended for use by individuals under 18. We do not knowingly collect personal information from minors. If we become aware that a minor has provided us with personal information, we will take steps to delete such information.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the Service or sending an email to your registered address. The "Last updated" date at the top of this page reflects the most recent revision.

For privacy-related questions or requests, contact us at: privacy@sintinel.ai Bregway LLC