Privacy Policy
We run a research terminal, not an ad business. We collect the minimum needed to operate the product, we don't sell any of it, and we don't track you across the web.
Who we are
Unfair Signals ("we", "us") operates this website (unfairsignals.com) and the Unfair Signals research terminal (terminal.unfairsignals.com). This policy covers both. Questions about it can be raised through the contact path on this site.
What we collect
Invite requests. If you request an invite, we collect the details you submit (such as your name and email address) so we can respond.
Account information. Access to the terminal is invite-only. When an account is created we store your email address. If you sign in with Google, Google shares your basic profile with us — email address and name — and nothing more; we request no additional Google scopes and never see your Google password. If you use a password, it is stored only as a salted hash by our authentication provider.
Things you create in the product. Watchlists, portfolios and positions you enter, settings, notification preferences, and support requests. Positions you enter are for your own tracking; we never hold or move money or securities for you.
Technical data. Standard server logs (IP address, user agent, timestamps) generated by our hosting providers for security and reliability, and privacy-preserving, cookie-less analytics on this marketing site (Cloudflare Web Analytics). The terminal sets cookies solely to keep you signed in and remember interface preferences — no advertising or cross-site tracking cookies anywhere.
What we use it for
To operate the service: authenticating you, enforcing our invite allowlist, rendering your own data back to you, sending product notifications you've enabled, responding to invite and support requests, and keeping the platform secure. That's it. We do not sell or rent personal information, we do not share it with advertisers, and we do not use it to train third-party AI models.
Who processes it
We use a small set of infrastructure providers, each processing data only to run the service: Supabase (database and authentication, hosted in the United States), Cloudflare (hosting, content delivery, analytics, and storage of invite requests), Google (sign-in, only if you choose it), and transactional email delivery for invite notifications. Market-data and filings providers supply securities data to us; they receive no personal information about you.
Retention and deletion
Account data is kept while your account is active. You can ask us to delete your account and associated personal data through the contact path on this site, and we will do so except where a record must be kept for security or legal reasons. Server logs rotate on our providers' standard schedules.
Your choices
You can use password sign-in instead of Google (or vice versa), disable notification kinds in the product, and request a copy or deletion of your data. If you are in a jurisdiction that grants specific privacy rights (such as the EU/EEA, UK, or California), you may exercise those rights through the same contact path and we will honor them.
Security
Traffic is encrypted in transit, data is encrypted at rest by our providers, database access is enforced per-account with row-level security, and administrative access is limited. No system is perfectly secure; if we learn of a breach affecting your personal data we will notify you promptly.
Children
The service is for adults. It is not directed at anyone under 18, and we do not knowingly collect personal information from children.
Changes
If this policy changes, the version published here is the one in effect, with its effective date updated. Material changes will be called out in the product's release notes.
See also our Terms of Service and Disclosures.