What we collect
- Account — email, display name, password hash (via Firebase Auth).
- Usage — watchlist tickers, armed alerts, the company limit set on your account, last-active timestamps.
- Advertising — we show ads through Google AdSense, which sets its own cookies and may use them to choose which ads you see. We never send Google your email address, your watchlist or anything else from your account.
- Cookies — a session cookie for authentication, plus the Google advertising cookies described above.
- Resourceful — if you are signed in, your chats are saved to your account so you can come back to them, and are kept until you delete them or close your account; if you are signed out they stay in your browser. Separately, our server keeps a copy of each question, its answer, the announcements it cites and any thumbs-up or thumbs-down, with no name, email or account number attached, for 90 days, used only to find and fix answers that went wrong. We also keep a list of the questions asked, for 90 days, so the site owner can see what readers want to know; for signed-in readers that list includes your account email, and only the site owner can see it. Your chats are private to you: they are never shown to other readers and never used as a source of facts for anyone's answers. To count free questions for signed-out visitors we keep a scrambled code made from your internet address, which also expires after 90 days. When you accept the education-only notice we keep a record of that acceptance (the date, the notice version, and your account or the same kind of scrambled code), as evidence you agreed to it.
What we don't collect
- Trading positions, broker data, or any third-party financial accounts.
- Analytics products that identify individual users.
- We do not sell your data. Full stop.
How we use it
To run the Service — serving your watchlist, fetching catalysts, and sending the emails you have asked for.
Where it lives
Authentication and user data on Firebase (Google Cloud). Catalyst extractions and caches on our own servers (Cloud Run, Sydney by default). Resourceful runs on our own server in Google Cloud; to write each answer, your question and the relevant announcement extracts are sent to Anthropic, the maker of the Claude AI model, under its commercial terms, which do not allow it to train its models on them.
Your rights
- Access — request a copy via privacy@catalystahead.com.
- Deletion — email privacy@catalystahead.com from your account address and we purge everything within 30 days.
- Correction — email the same address to change your name or email; we action it by hand.
Third-party embeds
TradingView supplies the price charts. When you open a chart — by pressing a chart button on a leaderboard, or a chart tab in a company panel — your browser loads TradingView's widget script directly from them and opens a connection to their servers. At that point TradingView can see your IP address, your browser details and which symbol you asked for, under their own privacy policy rather than ours. Nothing is sent to them until you press it: no chart script loads on page view, so simply reading a page never contacts them.
Their charts are delayed 15 minutes. We do not pay them, they do not pay us, and we pass them nothing about your account.
Compliance
We comply with the Australian Privacy Principles under the Privacy Act 1988 (Cth). EU users are covered by GDPR-equivalent terms.