Privacy Policy
Effective: (v2026-09-01)
1. Overview
This Privacy Policy explains what information InsiderAlpha collects, how we use it, and the choices you have. It applies to all visitors and registered users of the Service.
2. Information we collect
Account data: your email address, the sign-in identifier issued by our identity provider, tier and billing status, and any profile fields you provide. We do not store your password.
Payment data: processed by Stripe. We store only non-sensitive identifiers (customer ID, subscription ID, card brand and last four). Full card details never touch our servers.
Usage data: pages viewed, features used, device and browser metadata, and timestamps. Used to operate, secure, and improve the Service.
Optional integrations: mobile push device tokens for notifications, and a direct DeGiro brokerage connection when you opt in.
3. How we use information
To provide, maintain, and secure the Service. To process subscriptions and issue receipts. To send transactional and, where you have opted in, product emails. To improve features, including aggregate analytics on which views are most useful. And to comply with legal obligations and respond to lawful requests.
4. Data sharing, sale, and your choices
We may share aggregated or de-identified information, meaning information that does not identify you individually, with partners for market research and analytics purposes. As our data-partnership program develops, we may also share or sell personal information with named categories of partners, disclosed in this policy before any such sharing begins for the categories of data involved. We do not currently have any active data-sharing or data-sale partnership. A registry of any future partners and what they receive is maintained internally and referenced here once one exists.
You can opt out of the sale or sharing of your personal information at any time by emailing contact@insideralpha.ai from the address on your account. An in-product control in Account Settings, under Privacy and data, will accompany any data-sharing program we launch. We never share direct identifiers (your name, email, or IP address) with any partner: any external sharing of identifiable information uses a one-way, non-reversible identifier in their place.
5. Service providers
We share limited data with vendors who process it on our behalf under contractual confidentiality obligations: Auth0 (sign-in and account credentials), Stripe (payments), Mailgun (transactional email), PostHog (product analytics), Google (Google Analytics and Google Tag Manager, for audience measurement and advertising), Metricool (audience measurement, alongside the social media accounts we publish from), Meta (the Meta Pixel, for advertising measurement on Facebook and Instagram), and the infrastructure providers hosting our application and database. These are service providers processing data on our instructions, distinct from the data-partnership sharing described in section 4.
PostHog processes data in the European Union. Google and Meta are United States providers and may process data outside the European Economic Area, under the transfer safeguards described in section 10. Meta acts as an independent controller for some of what it receives through the pixel, which means it also uses that data for its own purposes under its own privacy policy, and not only on our instructions.
6. Cookies and tracking
We use first-party cookies for authentication. These are necessary for sign-in to work, and are set when you sign in.
We also use first-party product analytics, through PostHog (see section 5), with the data collected via our own servers, and Google Analytics through Google Tag Manager. We record which pages are opened and which features are used. By default we set a small identifier in your browser so that your visits connect across sessions, which is what lets us tell one returning reader from two new ones. You can decline that below, at any time: declining removes the identifier and keeps the measurement anonymous, with each visit standing alone. We honour your browser's Do Not Track and Global Privacy Control settings, and you can opt out of analytics entirely further down.
We also count visits with Metricool (see section 5), so that the reach of what we post on social media can be read next to the visits it produced. Metricool stores nothing on your device: no cookie and no identifier. Each page you open sends Metricool the page address, the address you arrived from and your browser window size, together with the details every web request carries: your IP address, your browser and operating system, and your language preference. It records nothing else, and we send it nothing about what you do on the page. If you decline the identifier above, or set Do Not Track or Global Privacy Control, or opt out below, we stop sending to Metricool altogether rather than merely sending less.
Our product analytics also records session replays: a reconstruction of the pages you saw and where you clicked, so we can find where the Service is confusing or broken. Text you type, and the fields and figures we mark as sensitive, are masked before the recording leaves your browser. Replays are retained for 30 days. Declining or opting out below stops them along with everything else.
We use advertising measurement. We run the Meta Pixel (see section 5) so that we can tell which of our advertisements bring people here, and so that our advertisements can be shown on Facebook and Instagram to people who have visited. It sets two cookies in your browser, named _fbp and _fbc, which identify your browser to Meta for up to 90 days. Through it, Meta receives the pages you open, which companies, insiders and articles you look at, and whether you begin signing up, start a trial or subscribe. It also registers this site with the interest-based advertising features some browsers now build in. Google's equivalent advertising signals are switched on for the same purpose and follow the same choice.
The pixel also uses what Meta calls automatic advanced matching, and this is the part of this policy most worth reading carefully. Where information you have already given us appears on a page the pixel runs on, it reads that information, scrambles it in your browser, and sends the scrambled form to Meta so your visit can be matched to your Facebook or Instagram account. Three kinds of information are enabled: your email address, your first and last name, and your country. In practice this means the email address you type into our newsletter, app waitlist or contact forms, and the name you give on the contact form. Meta also derives your approximate country from your IP address, as it does for any request your browser makes to it.
Scrambling is not the same as anonymising. The value is unreadable in transit, but its whole purpose is that Meta can still match it to a person, so it remains information about you.
Two limits hold here, and we implement them rather than promise them. The pixel does not run at all on your settings page, your trades, the broker connection page, the sign-in page, or any page whose web address contains a security code such as a password reset or email confirmation link. So the details held in your account, your brokerage credentials and those codes are never exposed to it. And we do not send Meta anything about your holdings, your trades, or the contents of your portfolio.
This is the one part of this policy that changed most recently, and it is the part most worth your attention. If you decline below, or set Do Not Track or Global Privacy Control, or opt out entirely, we do not load Meta's pixel at all, and the two cookies it set are removed. That is a stricter response than we give for our own product analytics, where declining changes what is stored rather than stopping measurement.
Checking your setting…
When you are signed in, we associate your use of product features with your account on our servers so we can operate and improve the Service; we do not put your name or email address into analytics, and nothing about that association is stored in your browser.
You can also opt out of analytics entirely below: opting out stops the collection on this browser, removes anything analytics stored, and is remembered until you turn it back on. If you previously declined analytics when we asked with an earlier banner, that choice is kept as an opt-out.
Google's sign-in script also loads on our pages so that the Continue with Google prompt can work. It is part of signing in rather than measurement, so it is not covered by the analytics choice above.
Apart from the Meta Pixel and the Google services named above, we run no other third-party advertising or tracking scripts.
7. Data retention
Account data is retained while your account is active and for a reasonable period thereafter to comply with legal, accounting, and reporting requirements. You may request deletion of your account at any time (see section 9).
8. Security
We use industry-standard safeguards including TLS in transit, encrypted backups, and least-privilege access controls. Sign-in credentials are held by our identity provider and never reach our servers. No system is perfectly secure; please use a strong, unique password.
9. Your rights
Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing, including the sale or sharing of your personal information (see section 4).
You can export a full copy of your data at any time from Account Settings, Privacy and data. To request deletion of your account and associated data, email contact@insideralpha.ai from the address on your account.
10. International transfers
Our infrastructure may process data outside your country of residence. We rely on appropriate safeguards, such as standard contractual clauses, where required by applicable law.
11. Children
The Service is not directed to children under 18 and we do not knowingly collect data from them.
12. Changes
We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email.
13. Contact
Privacy questions? Email contact@insideralpha.ai.