Polyasso ("we", "us") takes your privacy seriously. This policy explains what data we collect, why we collect it, and how it is used and protected. By using the Service, you agree to this policy.
We collect only what we need to run the Service. We do not sell your data. We do not run ads.
| Data | Why we collect it | Stored where |
|---|---|---|
| Email address | Account creation, login, transactional emails (verification, billing alerts) | PostgreSQL on Render |
| Hashed password | Authentication. Passwords are hashed with Werkzeug/bcrypt — never stored in plaintext. | PostgreSQL on Render |
| Subscription tier & billing dates | Enforcing plan limits and renewal tracking | PostgreSQL on Render |
| Stripe customer & subscription IDs | Payment processing and billing portal access | PostgreSQL (IDs only) + Stripe |
| Analysis runs & picks | Displaying your history, P&L tracking, PDF export | PostgreSQL on Render |
| Referral code & referred-by | Crediting referral rewards | PostgreSQL on Render |
We do not collect payment card details. All payment processing is handled directly by Stripe and governed by Stripe's Privacy Policy.
We do not use your data for advertising, profiling, or sale to third parties.
Running the Service requires the following third-party processors, each with their own privacy policies:
We do not use cookies for advertising or third-party tracking. The app uses JWT tokens (stored in your browser's localStorage) for authentication only. We do not use Google Analytics or any analytics platform that shares your data with third parties.
Your account data, analysis history, and picks are retained for as long as your account is active. If you delete your account, your data is removed from our database within 30 days. Stripe retains billing records independently per their own retention policies.
Depending on your location, you may have rights under GDPR (EU/UK) or CCPA (California) including:
To exercise any of these rights, email picks@polyasso.com. We will respond within 30 days.
We use industry-standard security practices: HTTPS for all data in transit, bcrypt password hashing, JWT-based authentication with expiry, and environment variable management for all secrets. Our infrastructure runs on Render's managed cloud environment.
No system is perfectly secure. If you believe you've found a security vulnerability, please disclose it responsibly to picks@polyasso.com.
The Service is not directed at children under 18. We do not knowingly collect data from minors. If we become aware that a minor has created an account, we will delete it promptly.
We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users. Continued use of the Service after changes constitutes acceptance of the revised policy.
Privacy questions or data requests: picks@polyasso.com