LEGAL

Privacy Policy

Dashboard

Effective date: 1 Oct 2026

This Privacy Policy explains how Jonathan Adrian (“I”, “me”, or “my”) handles personal information when you use US Stock Scanner (“Service”).

I am responsible for the personal information processed through my Service. For privacy questions or requests, contact johnad93722@gmail.com.

1. Information I collect

Account information

When you register or use an account, I collect your email address and maintain a password hash, account identifier, role, status, plan, registration date, email verification status, last login time, and the date you accepted my Terms.

Passwords are stored as hashes rather than readable passwords.

Authentication and security information

I process session identifiers, verification and password-reset tokens, IP addresses, and security-related activity to manage authentication and prevent abuse. Stored session and email-token records use hashed token values.

IP addresses or derived identifiers may be used to limit login attempts, verification emails, and other requests.

Watchlists and usage records

I store the stock symbols you add to your personal watchlist and the dates they were added.

I also record certain feature usage, such as AI analysis, narrative research, backtesting, and strategy simulations, to apply account limits and manage service capacity.

Technical information

When you access the Service, my application, hosting, and security infrastructure may process technical information such as IP addresses, request paths, timestamps, response status, and diagnostic records.

Communications

If you contact me, I process your contact details and the information you include in your message. Please avoid sending unnecessary sensitive information.

2. How I use information

I use personal information to:

  • Create and administer accounts.
  • Verify email addresses and manage login sessions.
  • Deliver account verification and password-reset messages.
  • Save and manage personal watchlists.
  • Provide research tools and apply usage limits.
  • Detect abuse, investigate errors, and protect the Service.
  • Respond to enquiries and privacy requests.
  • Meet applicable legal obligations.

Required account and security information is necessary to provide account-based features. If you do not provide it, those features may be unavailable. Adding stocks to a watchlist and contacting support are optional.

3. Legal grounds for processing

I collect, use, and disclose personal data with your consent, including deemed consent where applicable under Singapore’s Personal Data Protection Act 2012, or where otherwise permitted or required by law.

This includes processing reasonably necessary to provide the account and research features you request. Where separate consent is required, I will obtain it before processing.

You may withdraw consent by contacting johnad93722@gmail.com. I will explain any consequences for your use of the Service and stop the relevant processing unless continued processing is permitted or required by law.

4. Cookies and browser storage

I use a cookie named session to keep you signed in. It contains a session identifier and is configured to prevent access by page scripts. In production, it is configured for transmission over HTTPS.

The session expires after 30 days.

Security services such as Cloudflare Turnstile may also process browser and device information.

You can manage cookies through your browser settings. Blocking the session cookie prevents account-based features from working.

I do not use analytics, advertising, or other tracking cookies or browser storage.

5. Service providers and other disclosures

I disclose information where necessary to providers that support the Service, subject to appropriate contractual and legal requirements.

Depending on the deployed configuration, these include:

  • Brevo: receives your email address and message content to deliver account-related emails.
  • Cloudflare Turnstile: processes verification responses, IP addresses, and browser or device information to help distinguish legitimate users from automated abuse.
  • AI providers: when external AI processing is enabled, providers such as OpenAI receive stock symbols, prompts, market information, and research evidence needed to generate reports. Alternatively, AI processing may use an operator-managed Ollama deployment.
  • Hosting and infrastructure providers: support application hosting, databases, security, logs, and backups. My application and database are hosted by Oracle Cloud in Singapore.
  • Market data providers: receive requests for stock symbols and market information needed to support research features.

The current research workflow does not require including your email address, password, or full personal watchlist in AI prompts.

I may also disclose information when legally required, to protect rights or security, or in connection with a business transfer, subject to applicable safeguards and notice requirements.

I do not sell personal data or disclose it to third parties for targeted advertising. I disclose information to service providers where necessary to operate the Service, as described in this Policy.

6. Private watchlists and research reports

Personal watchlists are associated with individual accounts and are not intended to be publicly visible.

Stock research reports are stored separately from personal watchlists. Administrators can publish selected reports for other users or public visitors. A report generated following your request should not be treated as a private personal document.

Access to market data and report details varies according to account permissions and data licensing restrictions.

7. International processing

Some providers may process information outside your country of residence. Applicable privacy protections may differ between countries.

My main application and database are hosted in Singapore. My email, security, and other service providers may process personal data in their hosting countries. When personal data is transferred outside Singapore, I take steps to ensure protection comparable to that required under Singapore’s PDPA.

8. How long I keep information

I retain personal information for the purposes described in this Policy and for applicable legal, security, and dispute-resolution needs.

My retention periods are:

  • Account information and watchlists: While the account remains open; deleted from active systems within 30 days after closure.
  • Feature usage records: While the account remains open; deleted together with the account.
  • Routine application and access logs: 30 days.
  • Security logs: 90 days.
  • Session and verification records: Sessions last 30 days, and expired sessions are removed at the next login. Verification links expire after 24 hours and password-reset links after 60 minutes. Unverified accounts that never log in are deleted after 7 days.
  • Support communications: 12 months after the enquiry is resolved.
  • Backups: Rolling 30 days, then automatically expire.

Token expiry does not necessarily mean immediate deletion of its database record. Backup copies may remain until the applicable backup cycle ends and are protected while retained.

9. Security

I use measures designed to protect personal information, including password hashing, hashed authentication records, restricted administrative access, session controls, and abuse prevention.

No system can guarantee absolute security. Keep your password confidential and contact me promptly if you suspect unauthorised account access.

10. Your rights and choices

Depending on applicable law, you may have rights to access, correct, delete, or receive a copy of your personal information; restrict or object to certain processing; and withdraw consent where processing relies on consent.

You can remove stocks from your watchlist through the Service. For account closure or other privacy requests, email johnad93722@gmail.com.

I may need to verify your identity before acting on a request. Some information may need to be retained for lawful reasons, which I will explain where applicable.

For privacy enquiries or complaints, contact me at johnad93722@gmail.com.

You may also raise a concern with Singapore’s Personal Data Protection Commission (PDPC) through its data protection complaints page.

11. Children

The Service is intended for adults aged 18 and over. I do not knowingly collect personal information from children under 18.

If you believe a child has provided personal information, contact me so I can investigate and take appropriate action.

12. Changes and contact

I may update this Policy to reflect changes to the Service or my practices. I will update the effective date and notify you of material changes where required. I will obtain separate consent where applicable law requires it.

For privacy enquiries, contact:

Jonathan Adrian
johnad93722@gmail.com