Privacy

What is collected

• Your account. When you sign in with Google we receive your name, email address and profile picture. We do not receive or store your Google password.
• Your brokerage data. Through SnapTrade, and only after you authorise it: the accounts you connect, their positions and balances, and their transaction history — the fills, transfers and dividends the broker reports.
• What we compute from it. Daily scores and their components, round trips matched first-in-first-out, daily and realised profit and loss, holding periods, and the patterns the engine draws from them.
• What you tell us. The reason you attach to an entry when you tag it, your declared investing style, your email preferences and your light or dark mode choice.
• Cards you mint. The figures printed on a card and the random slug it lives at.
• Billing. If you subscribe, a Stripe customer and subscription identifier, the plan, its status and its renewal date. Card numbers never reach us — Stripe holds those.

Supercruise never receives a brokerage password. The connection is made through SnapTrade and is read-only: it can see what you did and cannot place, cancel or modify an order.

What it is used for

To run the product you asked for: computing your score, drawing your screens, minting the cards you share, sending the emails you have turned on, and billing you if you subscribe. Nothing else.

Your data is not sold, and it is not shared with advertisers or data brokers. Aggregate comparisons against other people are not part of the product today; if that changes, this page changes with it and the comparison stays aggregate.

Who else sees it

A handful of services do specific jobs, and each sees only what that job needs:

• SnapTrade brokers the read-only connection to your broker.
• MongoDB Atlas stores everything above.
• Railway runs the application.
• Google handles sign-in.
• Stripe handles payments and holds your card details.
• Resend delivers email, and therefore sees your address and the text of what is sent.
• Anthropic writes the one daily sentence. It is sent a fact pack of computed numbers — the score, its four components, what moved them, your transaction and account counts — and no name, no email, no ticker and no dollar figure.
• OpenAI writes the one caption on each Wrapped card. Each card is sent only the figures printed on that card, so across a year that includes your first name on the cover card and the ticker symbols of your longest hold and your strongest name. It is never sent your email, your account numbers, your brokerage’s name, your holdings list or any dollar figure, and it is never sent the whole set at once — a card’s request carries that card’s figures and nothing else. Nothing it returns can change a number: every figure on a card is set by us and checked character for character against our own computation before the card is shown, and a card whose text disagreed is thrown away and written by us instead.
• Finnhub and the logo sources receive ticker symbols in order to return a quote or a company mark. They are not told whose symbols they are.

No analytics or advertising trackers run on this site, and no fonts are fetched from anyone else — every face is served from this domain. Image models drew the card artwork before launch, once, for everyone; nothing about you is sent to one.

Cards are public by their link

A card you mint lives at a URL containing 96 bits of randomness. Anyone with that link can see the card — that is what makes it shareable — but the link cannot be guessed and nothing else about your account is reachable from it. Deleting your account stops those links resolving.

How long it is kept

For as long as your account exists. Delete the account and the ledger, the scores, the derived history, the tags, the minted cards, the badge and the sign-in records go with it, in one action, with no waiting period. Backups held by our storage provider roll off on their own schedule.

Taking it back

Both of these are buttons rather than requests, on your profile:

• Export. Everything stored about you, as one JSON file, in the shape it is stored in.
• Delete. Erases the account and cancels a running subscription. It cannot be undone.

If you are in a jurisdiction with a statutory right of access, correction, portability or erasure — the UK and EU under GDPR, California under the CCPA, and others — those two buttons are how those rights are exercised here, and you can also write to hellodeaconbrantley@gmail.com.

Security

Traffic is encrypted in transit. Credentials for every service above are held as server-side environment variables and are never sent to the browser. No product can promise it cannot be breached; what this one can say is that it holds no brokerage password, no card number and no ability to move your money.

Children

Supercruise is not for anyone under 18, and accounts are not knowingly created for them.

Changes

If this policy changes, the date at the top changes. A change that materially affects what is collected or who sees it will be sent to the address on your account.

Contact

hellodeaconbrantley@gmail.com