Privacy Policy

1. What we collect

• Account data: name, email, optional avatar via OAuth (Google, GitHub, Apple, Microsoft).
• Usage data: pages visited, queries you run, AI prompts you submit. Used to improve the product and detect abuse.
• Billing data: handled exclusively by Stripe. We never see or store full card numbers.
• Cookies: a session cookie for authentication and a preferences cookie for UI settings.

2. How we use it

• To operate, secure, and improve the Service.
• To personalise your dashboard, watchlists, and AI assistant context.
• To send transactional emails (receipts, password resets).
• To send weekly digests only if you opt in via Notification settings.

3. What we don't do

• We do not sell your personal data.
• We do not share your AI prompts or conversations with third parties for advertising.
• We do not run third-party analytics that profile users individually.

4. Third-party services we rely on

• Supabase — database, auth, file storage.
• Stripe — payments and subscription management.
• Vercel — application hosting.
• OpenAI / Anthropic — AI assistant inference. Your prompts are sent to these providers under their data-handling terms.
• Resend — transactional email delivery.

5. Your rights

You can export or delete your data at any time from Account settings. EU/UK users have additional rights under GDPR; contact us to exercise them.

6. Data retention

We keep account data for as long as your account is active, plus 30 days after deletion to support recovery requests. Anonymised aggregate metrics may be retained longer.

7. Security

All data is encrypted in transit (TLS 1.2+) and at rest. Access to production data is restricted to a small operations team.

8. Changes

Material changes will be announced via email at least 14 days before they take effect.

9. Contact

Privacy questions: privacy@pythia.research.

This page is a working stub. The definitive Privacy Policy will be issued by counsel before public launch. See the Terms of Service for usage rules.