Privacy Policy

1. Information we collect

Account information

When you create an account, we collect your email address, an authentication user identifier, email-confirmation state, and security-related account records. Passwords are submitted to our authentication provider and are not stored in the application database in readable form.

Terms acceptance

We record the account identifier, versions of the Terms of Use and Privacy Policy accepted at registration, acceptance time, registration source, and a limited browser user-agent string. This creates an audit record of the agreement you accepted.

Service activity

We process the ticker and exact expiration you select, account access tier, complimentary-analysis usage, saved analysis identifiers and results, and operational events needed to deliver the requested workflow. The Service does not ask you to submit brokerage credentials, portfolio holdings, order instructions, or payment-card numbers.

Payment and subscription information

Stripe processes checkout and payment details. We receive identifiers and status information needed to manage access, such as Stripe customer, product, price, subscription, billing-period, cancellation, and webhook-event records. We do not receive or store the full payment-card number.

Device, log, and analytics information

When you use the Service, servers and service providers may process IP address, browser and device type, operating system, requested URL, timestamps, referrer, cookie or local-storage identifiers, response status, security events, and interactions with product screens. Google Analytics runs only on the production hostname and measures page views and selected product-funnel events.

AI analysis and observability

To produce and monitor a strategy comparison, we may process the selected ticker and expiration, prepared market facts, strategy definitions, generated output, validation results, model usage, latency, cost, and a randomly generated browser session identifier. We do not intentionally include account passwords, payment-card data, or authentication tokens in AI prompts or observability records.

2. How we use information

We use information to:

• create, confirm, secure, and recover accounts;
• provide market context and requested strategy analyses;
• enforce complimentary and paid access rules;
• process subscriptions and reflect cancellation or payment status;
• cache and replay eligible saved results without unnecessary model calls;
• measure product reliability, performance, usage, and conversion;
• detect fraud, abuse, security incidents, and prohibited activity;
• debug, audit, improve, and develop the Service;
• communicate about accounts, security, billing, and material policy changes; and
• comply with law, enforce agreements, and protect users, 10 Delta, and others.

We do not use account credentials or payment details to train a public AI model. Market facts and generated comparisons may be retained for product operation, caching, validation, and observability as described above.

3. How we disclose information

We disclose information only as reasonably necessary for the purposes described in this Policy:

• Supabase provides authentication and hosted database infrastructure.
• Stripe provides checkout, recurring billing, and the customer billing portal.
• OpenAI processes the bounded strategy-comparison request.
• Langfuse provides AI observability, validation, usage, and cost tracing.
• Google Analytics measures production page views and product-funnel events.
• Infrastructure, security, email, market-data, and charting providers support the operation of the Service.

Providers process information under their own contracts and privacy terms. We may also disclose information when required by law; to respond to valid legal process; to investigate fraud, abuse, or security threats; to protect rights and safety; or in connection with a merger, financing, reorganization, sale of assets, or similar business transaction.

We do not sell personal information for money. We do not disclose personal information for third-party direct marketing. Some privacy laws define analytics or advertising-related disclosures more broadly; available browser controls and legal rights are described below.

4. Cookies, local storage, and Google Analytics

The Service uses first-party, HttpOnly cookies to maintain authenticated sessions. JavaScript cannot read those authentication tokens. Production cookies use security attributes intended to reduce unauthorized access.

The browser stores a random session identifier used to associate stages of one AI-analysis experience. On options.10delta.io, Google Analytics may set or read identifiers and collect page and interaction events. Analytics events may include selected ticker, expiration, and a broad access state, but are not designed to include email, passwords, authentication tokens, AI prompts, full AI responses, or option-surface payloads.

You can restrict cookies or clear local storage through browser settings. Blocking authentication cookies may prevent login. Browser controls, extensions, or network settings may limit analytics, although availability and behavior vary by browser.

5. Retention

We retain information for as long as reasonably necessary to provide and secure the Service, maintain accurate billing and legal records, enforce agreements, resolve disputes, and meet legal obligations. Retention depends on the type of record and why it is needed.

Account and access records generally remain while an account is active. Subscription, transaction, webhook, Terms-acceptance, security, and dispute records may be retained after account closure when necessary for legal, audit, fraud-prevention, or accounting purposes. Saved analysis and observability records may be retained to provide replay, investigate reliability, control cost, and validate product behavior. Service providers may maintain backups or records under their own retention schedules.

6. Security

We use administrative, technical, and organizational measures designed to protect information, including server-controlled access, first-party HttpOnly authentication cookies, restricted database permissions, row-level security, signed billing webhooks, secret management, and output validation. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. International processing

The Service and its providers may process information in the United States and other countries. Those locations may have privacy laws different from the laws where you live. Where required, providers and 10 Delta use appropriate contractual or legal mechanisms for international processing.

8. Children

The Service is not directed to children or anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us so we can review and delete it where appropriate.

9. Your choices

You may update account credentials through the available account and recovery tools, cancel a paid subscription through the Stripe Customer Portal, and control cookies or local storage through your browser. You may request account deletion or ask a privacy question by emailing [email protected].

Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, or objection; to withdraw consent where processing relies on consent; or to appeal a privacy-request decision. These rights may be limited by identity verification, legal exceptions, and records we must retain. We will not discriminate against you for exercising an applicable privacy right.

To protect accounts, we may need to verify a request using the account email or other reasonable information. Authorized agents may be required to provide proof of authority.

10. Changes to this Policy

We may update this Policy as the Service, providers, or legal requirements change. The “Last updated” date identifies the current version. We will provide reasonable notice of a material change and request a new acknowledgment when appropriate.

11. Contact

Privacy questions and requests may be sent to [email protected].