Privacy Policy

TickerFlare stores the minimum it needs to run a signed-in account, your paper-trade history, and (if you opt in) SMS alerts. We don't sell your data, we don't use third-party advertising trackers, and we delete everything tied to your account when you ask us to.

• OAuth profile data. When you sign in with GitHub or Google, we receive your name, email address, and profile picture URL from the OAuth provider. We store the email and a stable user ID; the rest is used at render time and not persisted.
• Mobile phone number (only if you opt in). If you enable SMS Buy alerts, we store the phone number you provide and a timestamped record of your consent. See the SMS section below.
• Your in-app activity. Paper trades you record (entry/exit price, share count, notes), tickers on your watchlist, and your notification preferences. These are scoped to your user ID.
• Session cookies.A signed JWT issued by Auth.js so we know who's signed in. No third-party analytics cookies.
• Server logs. Standard HTTP request logs (IP, path, status, timestamp) for operational purposes. Retained 30 days.

• Payment information (no paid tier yet).
• Brokerage credentials or real-money trade data.
• Behavioural tracking, browser fingerprinting, or third-party advertising identifiers.
• Anything from your watchlist or trade ledger that isn't directly required to render the page.

To run the service: authenticate you, render your dashboard, save the trades you record, surface the patterns firing on tickers you care about, and — if you opt in — text you when a stock turns Buy. That's it.

TickerFlare (operated by Creative Journey) offers an optional SMS alert program that texts you when a stock enters a "Buy" state on your TickerFlare digest.

• What we collect. If you opt in, we collect the mobile phone number you provide and a record of your consent (date and time).
• How we use it. Your phone number is used solely to send you the transactional stock alerts you requested. We do not use it for marketing or promotional messaging.
• Consent. You opt in by entering your mobile number and checking the consent box in your account settings. Message frequency varies based on market activity. Message and data rates may apply.
• Opt-out and help. You can stop messages at any time by replying STOP, or by turning off SMS alerts in your account settings. Reply HELP for assistance.
• Data retention. We keep your number and consent record only while SMS alerts are enabled on your account. Removing your number or deleting your account erases it.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as our SMS provider (Twilio), is permitted solely to carry out the alert service. All other use, sharing, or sale of mobile opt-in data and consent is prohibited.

No third parties for marketing. We use service providers solely to operate the product:

• Twilio — to deliver the SMS alerts you opted into. Your number is shared with Twilio only to send those messages.
• Polygon.io and SEC EDGAR— to source market and news data. That's outbound data we fetch, not anything we send about you.

We may disclose data if compelled by a legitimate legal request, but we have not received any such request and we'll tell you if we do (unless legally gagged).

For as long as your account is active. When you delete your account, we remove your user row and everything cascading from it (watchlist, paper trades, phone/consent record, session records) within 30 days. Anonymous backups may persist for an additional 30 days for disaster-recovery purposes.

You can view, export, or delete your data at any time from your account page. If you're an EU/UK resident, you also have the GDPR rights of access, rectification, erasure, restriction, portability, and objection — all of which we honor by default in the account-settings interface.

TickerFlare is not directed at users under 18. If we discover an account belongs to a minor, we'll delete it.

Data sits in a Postgres database with TLS-encrypted connections. Passwords are not stored (sign-in is OAuth-only). Session tokens are signed JWTs with short expiry. We follow standard web-application security practices but no system is impenetrable; if a breach occurs that materially affects you, we'll notify you promptly.

If we change this policy, the "Last updated" date changes and material changes get an in-app notice on your next sign-in. Continued use after the change constitutes acceptance.

Privacy questions or requests: privacy@creativejourney.com, or use the contact link from your account page.