What we collect
- Account — email, display name, password hash (via Firebase Auth).
- Usage — watchlist tickers, armed alerts, plan tier, last-active timestamps.
- Billing — handled by Stripe; we never see your card details.
- Cookies — a session cookie for authentication; no third-party ad trackers.
What we don't collect
- Trading positions, broker data, or any third-party financial accounts.
- Analytics products that identify individual users.
- We do not sell your data. Full stop.
How we use it
To run the Service — serving your watchlist, fetching catalysts, sending notifications you've enabled, billing your subscription.
Where it lives
Authentication and user data on Firebase (Google Cloud), region selectable on Enterprise plans. Catalyst extractions and caches on our own servers (Cloud Run, Sydney by default).
Your rights
- Access — request a copy via privacy@catalystahead.com.
- Deletion — Settings → Danger → Delete account purges within 30 days.
- Correction — update profile details from Settings any time.
Compliance
We comply with the Australian Privacy Principles under the Privacy Act 1988 (Cth). EU users are covered by GDPR-equivalent terms.