Privacy Policy

Account information: your sign-in email. With Sign in with Apple, we receive the email Apple shares (which may be a Hide My Email relay address) and an app-specific user identifier. We retain a hashed identity binding and authorization credentials in private storage to verify identity and revoke authorization when you delete your account. We do not receive your Apple Account password.

Google sign-in: in builds where this feature is enabled, we verify the user identifier and verified email in the Google identity token and keep a keyed-hash identity binding in private storage for authentication and account association. We do not receive your Google password or gain access to your Gmail messages or contacts through this sign-in.

Watchlist & preferences: your watchlist is stored on our servers and linked to your email account (for cross-device sync and push alerts), with a copy kept in your browser's local storage; your language preference is stored in a cookie named lang.

Push & notifications: if you enable mobile push, we store your push subscription — the web-push endpoint and encryption key material, or your iOS device token (APNs token) — along with the title, body and destination link of notifications already sent (kept about 48 hours, to avoid duplicate pushes and to support tap-through).

Verification codes: for email sign-in we store a hash of the code (never the code itself) and the attempt count; it expires after 10 minutes.

Payment information: new subscriptions are processed by the Apple App Store; existing web subscriptions are processed by Stripe. We do not receive or store full card numbers. We receive subscription status, billing periods, transaction identifiers and related information needed to maintain access. Sign in with Apple identity information is handled separately from App Store payment information.

Historical activity records: some older account records may contain a last-used timestamp. This field is not currently updated continuously and does not provide a complete record of your visits.

Technical logs: our host, Vercel, records standard server and access logs (such as IP, timestamp, request path, and user agent) for operations, troubleshooting, and abuse prevention.

To provide and maintain the Service (e.g., sync your watchlist, send news alerts); to process subscriptions and billing; to communicate with you about the Service; to ensure security, troubleshoot, and prevent abuse; and to meet legal obligations where required.

We do not sell your personal information.

Stripe — existing web subscriptions, billing management and refunds only. We do not sell new subscriptions on the website.

Apple App Store — iOS in-app purchases and subscription management; we query and receive your subscription status through the App Store Server API.

RevenueCat — for builds and accounts where RevenueCat is enabled, it processes purchase verification, restoration, subscription status and purchase analytics. We send a non-email user identifier that we can associate with your Newstock account; RevenueCat receives store purchase records and transaction information. This identifier is not anonymous. The current integration does not set email or name attributes in RevenueCat or send full card numbers to it. Availability depends on the app version and service configuration.

Google Play — Android subscriptions in builds where Play purchases are enabled, including isolated tests. We send Google a keyed hash tied to the account generation to associate a purchase, not your sign-in email. Purchase tokens and account associations are kept in private storage to query Google, verify access and acknowledge purchases. Google Play purchases are not yet enabled in the public release.

Vercel — application hosting, logs and data storage (including Blob storage; account, watchlist and push data are kept in an access-restricted private store).

OpenAI — news headline translation, news impact-chain, hypothetical-scenario and portfolio analysis. Requests include news and public market data. Portfolio analysis also includes your selected ticker symbols, weights and related analysis. When you run a hypothetical scenario, your question is sent to this provider. We do not automatically attach your account email or sign-in credentials, but any personal information you type into a question is sent with it. Do not enter confidential information.

News voice assistant — with your consent, questions and recent conversation on the page are sent to OpenAI for news research and responses. Audio playback sends response text and our fixed synthetic reference voice to Resemble AI synthesis and ElevenLabs audio-isolation services hosted by fal; we do not automatically attach your email or sign-in credentials. The microphone is off by default and requires a first-use confirmation and explicit activation. This device remembers your voice preference so confirmation is not repeated; you can reset it in chat settings. Ordinary recordings last up to 60 seconds; Finish sends audio through Newstock’s server to OpenAI for transcription, then you review the text before asking. Hands-free mode automatically transcribes and sends after a speech pause and reads replies aloud. Supported devices can separately enable foreground Hey Kylie detection: standby audio is processed only on the device and is not uploaded; question recording starts after waking. Turning the mode off or moving to the background stops listening. Wake standby lasts up to five minutes. Newstock uses question audio temporarily for processing and does not save it to files or a database. OpenAI processing and retention follow its policies. This page does not retain long-term conversations; provider logs and retention follow their own policies. Do not enter confidential information or operate the screen while driving.

Resend — delivery of sign-in codes and account-related email (it processes your email address).

Apple Push Notification service (APNs) and browser push services (e.g. Google FCM, Mozilla, Apple) — delivery of the push notifications you subscribe to.

Market, news and public data sources — including Yahoo Finance, Google News, Nasdaq, SEC EDGAR, FINRA, the Federal Reserve, the Bureau of Labor Statistics (BLS), the FDA, Polymarket, OKX, and StockNewsAPI or Alpaca where enabled in our service configuration. Requests may include ticker symbols you follow and search text. Stock searches send your search text to Yahoo Finance; news searches send it to Google when the Google News fallback is enabled. We do not automatically attach your account email or sign-in credentials, but personal information you type may be sent with your search text. Do not enter confidential information in search fields.

These third parties process data only as needed to provide their services to us and are governed by their own privacy policies.

We use necessary login/session cookies and a language preference cookie. Optional Google Analytics loads on public website pages only after you agree in Analytics preferences. It measures public page visits, video plays and store-link clicks using cookies and device/browser information. We do not send login emails, watchlists or chat content. Advertising storage, personalization and Google signals remain disabled. Your choice is stored locally for up to 180 days; you can withdraw through Analytics preferences. Native app analytics is not enabled by this website integration.

We retain your account and subscription information for as long as your account exists.

You can delete your account from the Account page. We remove and re-check records within the account-cleanup scope, including your account, watchlist, saved portfolios, linked analysis caches and signup diagnostics, push subscriptions, and notification records. We report partial failures. Subscription security markers and some verification-code and anti-replay records are retained separately, outside that scope. These security markers can be linked to matching identifiers and are not anonymous. See /data-deletion for details. Provider logs and transaction records required by law are retained separately.

Subscriptions started through the App Store are managed by Apple: deleting your account does not cancel them — cancel in your Apple account's subscription settings. Subscriptions started on the web are canceled when you delete your account. Watchlist data stored locally in your browser can be cleared by you at any time.

Google Play purchase tokens and account associations are removed during account cleanup. Keyed-hash anti-reassignment markers and purchase-replacement links are retained separately, currently without automatic expiration; they are not anonymous. Deleting your account does not cancel a Google Play subscription. Cancel renewal separately using the Google Account that made the purchase. See /data-deletion for details.

RevenueCat customer records: for customers linked to production-service accounts, in-app deletion requests removal of the cloud customer record and confirms its absence before reporting completion. Provider processing can take time; incomplete requests prompt a retry or contact with support@newstock.ai. Earlier isolated-test records can still be referred to support for verified cleanup. Deleting purchase records does not cancel store subscriptions; security markers that prevent old purchases from being reassigned are retained separately.

You have the right to access, correct, or delete your personal information, and to request an export of your data. Email support@newstock.ai to make a request, and we will handle it within a reasonable time. Depending on where you live, you may have additional rights under local law (such as GDPR or CCPA).

The Service is not directed to children under 13, and we do not knowingly collect their personal information. If you believe we have inadvertently collected such information, please contact us to have it removed.

We may update this policy from time to time. Material changes will be announced through the Service or by email, and we will update the effective date at the top.

For any privacy question or request, contact support@newstock.ai.