SmartStrikes LLC, an Oregon limited liability company ("SmartStrikes," "we," "us," or "our"), respects your privacy. This Privacy Policy explains what information we collect, how we use and share it, and the choices available to you when you use the SmartStrikes application, website, and related services (the "Service").
This Privacy Policy is incorporated into and forms part of our Terms of Service. By using the Service, you agree to the practices described here.
Summary: Your trading data and imported files stay on your own device. In the web app they are encrypted in your browser and can be unlocked only through your signed-in account together with your PIN. Our servers keep only what they need to run the Service: your account identifier and email, your subscription status and trial and agreement records, and, for the web app, your tastytrade connection and, unless you turn it off, a copy of your settings so they follow you between browsers, both in encrypted form. We do not decrypt the settings copy, though it is not end-to-end encrypted (Section 1.4). AI endpoints and their API keys are included in that copy only if you choose. If you use SmartAssist, the in-app help assistant, the questions you type are sent through our servers to Anthropic to be answered, with which screen you are on, but never your trading data or account details. If you ask for a symbol to be graded, we record the request under a one-way identifier. The app uses no analytics or advertising trackers; our public website counts visits with Cloudflare Web Analytics, which sets no cookies and does not track individuals. We do not sell your personal information. We cannot access your brokerage funds, and the Service never places orders.
1. Information We Collect
1.1Account Information. You sign in with your Google account. We receive your email address, name, the web address of your Google profile picture, and a unique account identifier from Google; we never receive your Google password. In the web app you also choose a PIN. We never receive the PIN itself: our servers keep only a one-way hash of a value derived from it, in encrypted storage, to check it and to limit incorrect attempts. In the desktop and mobile apps, your PIN is checked on your device.
1.2Brokerage Connection Data. You connect your own tastytrade account by providing the OAuth client secret and refresh token that tastytrade issues to you for API access. We never receive your tastytrade username or password. In the web app, these credentials are stored on our servers in encrypted form so the Service can obtain short-lived access tokens for your account; your browser never stores them. In the desktop and mobile apps, they are stored in encrypted form on your device and are not sent to our servers. In every case they are used solely to retrieve your own data, and you can remove them at any time (Section 6.2).
1.3Account and Transaction Data. Through your brokerage connection, and through any files you choose to import (including Fidelity CSV exports), we collect and process trading and account information such as: positions, open and closed orders, transaction and execution history, assignments and expirations, cost basis and tax-lot detail, premiums, dividends, fees, realized and unrealized profit and loss, account balances, and buying power. This information is collectively "Financial Data." Financial Data is processed and stored on your device, not on our servers. In the web app, some requests to tastytrade are relayed through our servers, which pass the data through to you without storing it, and what the app keeps is stored in encrypted form in your browser (Section 4). Files you import are read on your device and are not uploaded to us.
1.4Configuration and Settings. The Service stores the settings you configure, including CAGR thresholds, screening criteria, watchlists, allocation preferences, alerts, and display preferences, on your device along with your other data (in encrypted form in the web app). In the web app, so that your settings are the same in every browser you use, a copy of them is also stored on our servers unless you turn off Settings → Security & account → Sync settings across browsers. That copy is encrypted in your browser, with a key that can be unlocked only through your signed-in account together with your PIN, before it is sent. Our servers store that copy but never store its key, and we do not decrypt it. Because the key is derived from a secret our servers hold, this is not end-to-end encryption: someone with full control of our server secrets and storage could reconstruct it. We restrict access to those secrets accordingly. It never includes your Financial Data, your imported files, or settings for accounts you imported from files.
1.5Payment Information. Subscription purchases are processed by Stripe, Inc. and its affiliates, which handle your payment details under their own privacy policy. We never receive or store your payment card number. We keep a Stripe customer identifier and your subscription status, plan (Lite or Pro, monthly or yearly), any plan change you have scheduled, trial, and billing period, and Stripe may make other billing details, such as your card's brand and last four digits or your billing country, available to us. We record whether you have used a free trial, and keep that record so each account receives one trial. If we grant you complimentary access, we record your email address, a name, the plan and its term.
1.6Third-Party AI API Keys. If you choose to enable optional AI-assisted analysis features, you may supply your own API key for a third-party model provider. That key is stored in encrypted form on your device (in the web app, in your encrypted browser storage). It is not sent to our servers unless, in the web app, you turn on Sync AI endpoints under settings sync (Section 1.4); your AI endpoints and their keys are then included in the encrypted copy of your settings, which we do not decrypt (Section 1.4), so that they follow you between browsers. The key is used only to send requests you initiate directly from your device to that provider.
1.7Usage and Device Data. The Service does not include analytics, advertising, or crash-reporting tools, and we do not track how you use it. Our public website at smartstrikes.app (not the app) uses Cloudflare Web Analytics to count visits. It sets no cookies and builds no profile of you: it records the page viewed, the site that linked to it, page load times, and general browser, device and country information derived from the request, and we see only totals. Our hosting, sign-in, and security providers record limited technical information about requests to our servers, such as IP address, timestamps, browser or app version, and request metadata, which is used to operate and secure the Service.
1.8Communications. If you contact support, we collect the contents of your message and any information you choose to include.
1.9Information We Do Not Collect. We do not collect your Social Security number, government identification number, brokerage account password, or full payment card number. We cannot withdraw or deposit funds, and the Service never places orders. A tastytrade grant that includes the "trade" scope could in principle be used to place orders, so we ask you to grant "read" only, which is all the Service uses.
1.10SmartAssist Questions. SmartAssist, in the web app, answers questions about how the Service works. When you ask one, we receive and pass to our AI provider (Section 3.2): the text you type and the recent turns of that conversation; which screen of the app you are on; a few on/off facts about that screen, such as whether break-even bars are showing; how many live and imported accounts you have; and whether you have set up an AI endpoint. It never receives your Financial Data, symbols, positions, balances, account numbers, or imported files. Whatever you type is sent as written, so do not include personal or account details in your questions; the app checks each question first and will not send one that appears to contain an account number, API key or token, card number, or email address. We do not store or log the text of your questions. We keep a count of the questions you ask each day, to apply the daily limit. Your recent conversation is kept in your encrypted browser storage until you start a new chat or clear the site's data.
1.11Grade Requests. If you ask for a symbol to be graded, we record the symbol, the time, and a one-way identifier derived from your account (not the account itself), so that each person counts once per symbol and requests can be limited. We use these records only to decide which symbols to grade next.
1.12Alpaca API Key. If you use market data from Alpaca, you supply an Alpaca API key ID and secret. They are stored in encrypted form on your device (in the web app, in your encrypted browser storage). In the web app, while settings sync is on, they are also included in the encrypted copy of your settings, which we do not decrypt (Section 1.4), so that they follow you between browsers. Your device uses them only to request market data directly from Alpaca; those requests do not pass through our servers. We also record, with your settings, that you have acknowledged that option prices from that data are estimates.
1.13Agreement Records. When you agree to our Terms of Service and this Privacy Policy, we record the version and the time under your account identifier, and keep that record after your account is deleted as proof of agreement.
1.14Google Sign-In Data. Through Google sign-in we receive only your name, email address, profile picture and account identifier. We use them only to sign you in, run your account, contact you about it and, if you opt in, as Section 6.4 describes. We do not sell them, use them for advertising, or transfer them except to the providers in Section 3.2 or as law requires.
2. How We Use Information
2.1We use the information described above to: (a) create and maintain your account and authenticate you; (b) retrieve, process, and display your Financial Data, including calculating cost basis, tranche-level positions, CAGR, profit and loss, and other analytics; (c) generate screens, scores, grades, charts, and other Output; (d) process subscription payments and manage billing, trials, renewals, and cancellations; (e) answer your SmartAssist questions (Section 1.10), decide which symbols to grade next from grade requests (Section 1.11), and transmit requests to a third-party AI provider when you enable and initiate AI-assisted analysis; (f) provide customer support and respond to your inquiries; (g) monitor, secure, troubleshoot, and improve the Service, including diagnosing errors and preventing fraud and abuse; (h) send service-related communications such as billing notices, security alerts, and material changes to the Service or these policies; (i) send you emails about SmartStrikes' own features and offers, if you have agreed to receive them (Section 6.4); and (j) comply with legal obligations and enforce our Terms of Service.
2.2Legal Bases. Where required by law, we process personal information on the bases of performing our contract with you, our legitimate interests in operating and securing the Service, your consent where applicable, and compliance with legal obligations.
3. How We Share Information
3.1We do not sell your personal information, and we do not share your Financial Data with advertisers, data brokers, or marketers. We never sell, rent or share your email address for anyone else's marketing, and never send promotions for other companies' products.
3.2Service Providers. We share information with vendors who process it on our behalf and under contractual confidentiality and security obligations, limited to what is necessary to perform their function. These are: (a) Cloudflare, Inc., which hosts our website and web application, counts visits to our website (Section 1.7), and runs the servers that store your encrypted tastytrade connection, encrypted settings copy, SmartAssist question counts and grade requests, and relay requests to tastytrade and to Anthropic; (b) Google LLC, which provides sign-in (Firebase Authentication) and the database that serves stock grades and sector data, and whose servers also deliver parts of the web app's code and fonts, so your browser contacts Google when the app loads; (c) Stripe, Inc. and its affiliates, for payment processing; (d) Google Workspace, for email; and (e) Anthropic, PBC, which provides the AI model that answers SmartAssist questions (Section 1.10). Under Anthropic's commercial terms, it may not train its models on that content. Anthropic may keep this content for a limited period for safety monitoring.
3.3Your Brokerage. The Service communicates with tastytrade using the credentials you provide, in order to retrieve your own data. Live market data streams between the app and tastytrade's market-data provider. Your relationship with tastytrade is governed by your agreements with tastytrade and its privacy policy, not this one.
3.4Third-Party AI Providers (AI-Assisted Analysis). If you enable AI-assisted analysis and supply your own API key, the position or account information relevant to your request is sent directly from your device to the provider you have selected, using your key; it does not pass through our servers. This includes the account number or label, symbols, positions and figures for the accounts you select. That transmission is subject to that provider's terms and privacy policy, and their handling of your data is outside our control. You should review that provider's policies before enabling these features. If you do not enable these features, none of your Financial Data is transmitted to any AI provider. SmartAssist (Section 1.10) is separate: it uses our own provider and never receives your Financial Data.
3.5Legal and Safety. We may disclose information if required by law, subpoena, court order, or other legal process, or where we believe in good faith that disclosure is necessary to protect our rights, your safety or that of others, to investigate fraud, or to enforce our Terms of Service.
3.6Business Transfers. If SmartStrikes is involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a materially different privacy policy.
3.7Aggregated and De-Identified Data. We may create and use aggregated or de-identified information that does not identify you or your account for purposes such as general product development. We will not attempt to re-identify such data.
3.8Alpaca. If you use market data from Alpaca, your device sends requests directly to Alpaca with your own API key (Section 1.12). Alpaca receives your IP address and the symbols and data you request, under Alpaca's terms and privacy policy, not this one. We do not send Alpaca any of your Financial Data.
4. Data Security
4.1We implement commercially reasonable technical and organizational measures designed to protect your information, including encryption of data in transit; encryption of your tastytrade credentials and PIN verification record on our servers; and, in the web app, encryption of everything the app stores in your browser, with keys that can be unlocked only through your signed-in account together with your PIN; and encryption of the settings copy it syncs through our servers, with a key released only to your signed-in account together with your PIN, which is not end-to-end encryption (Section 1.4). Incorrect PIN attempts are limited, and another person using the same browser cannot read your data without your PIN. Access to our systems is restricted and requires authentication.
4.2You are responsible for the security of your Google account and your PIN, and for any activity under your account. We recommend a strong Google password with two-step verification, and a PIN that others cannot guess.
4.3No system is perfectly secure. We cannot guarantee absolute security, and you provide information at your own risk. If we become aware of a breach affecting your personal information, we will notify you as required by applicable law.
5. Data Retention
5.1On your device. Financial Data, imported files, settings, AI results, API keys, and your recent SmartAssist conversation stay on your device until you remove them. In the web app, signing out lets you remove this browser's copy, and clearing your browser's data for the site also removes it.
5.2On our servers. We retain your account identifier and email address, your encrypted tastytrade credentials (web app), your PIN verification record, your encrypted settings copy (web app, while settings sync is on), and your subscription records for as long as your account is active. Turning off settings sync, or resetting your PIN, deletes the settings copy from our servers immediately; turning off Sync AI endpoints removes your AI endpoints and their keys from it. We do not keep the text of SmartAssist questions; the daily count of your questions is deleted after two days. Grade requests are kept until the symbol is graded or set aside, then deleted.
5.3Disconnecting tastytrade in the Service deletes your stored tastytrade credentials from our servers immediately and stops any further retrieval of data from your brokerage account.
5.4Following account deletion, we will delete or de-identify the information we hold on our servers within a commercially reasonable period, except your agreement record (Section 1.13) and the record that a trial was used, and except where retention is required for legal, tax, accounting, fraud-prevention, or dispute-resolution purposes. Stripe retains its own payment records under its privacy policy.
6. Your Choices and Rights
6.1Access and Correction. You may access and update your account information and settings within the Service. In the web app, you may stop syncing your settings, which deletes the copy on our servers, in Settings → Security & account.
6.2Disconnecting Your Brokerage. You may revoke the Service's access to your brokerage account at any time: in the web app under Settings → Security & account → Disconnect Tastytrade, in the desktop and mobile apps with Clear stored credentials on the tastytrade login screen, or through your tastytrade account's API access settings.
6.3AI Features. AI-assisted analysis features are optional and off unless you enable them and supply your own API key. You may remove an AI endpoint and its key at any time in Settings → Analysis. In the web app, your AI endpoints and their keys are synced between browsers only if you turn on Sync AI endpoints in Settings → Security & account, and you may turn it off at any time. SmartAssist is used only when you open it and ask a question.
6.4Marketing Emails. We send marketing emails only if you opt in. Each one identifies SmartStrikes, includes our postal address and an unsubscribe link, and you can also write to support@smartstrikes.app; we act on requests within 10 business days. Opting out never stops receipts, trial and renewal notices, security notices, or notice of changes to our Terms or this Policy. If you signed up only for a launch notice, that is all you receive.
6.5Account Deletion. To delete your account, email support@smartstrikes.app from your account's address. Within 30 days we delete your sign-in account and the records described in this Policy that we hold for you, except those in Section 5.4. Cancel your subscription first; Stripe keeps its own transaction records. Data stored in your browser is removed when you sign out and choose to erase it, or when you clear the site's data.
6.6State Privacy Rights. Depending on your state of residence, you may have rights to confirm whether we process your personal information, access a copy of it, correct inaccuracies, request deletion, obtain a portable copy, and opt out of sale or targeted advertising. We do not sell personal information or use it for targeted advertising. To exercise any right, contact us at the address in Section 11. We will verify your request through your account email and respond within the period required by applicable law. You may appeal a denial by replying to our response, and where applicable you may contact your state attorney general.
6.7Users Outside the United States. The Service is offered only to residents of the United States (Terms of Service, Section 1.3) and is operated in the United States, where your information is processed. If you nonetheless use it from elsewhere, contact us to exercise any rights your local law gives you.
6.8No Discrimination. We will not deny service, charge different prices, or provide a different quality of service because you exercised a privacy right.
7. Cookies and Similar Technologies
7.1Our web application uses browser storage (such as IndexedDB and local storage) and cookies only as needed to keep you signed in, store your encrypted data, and remember your preferences.
7.2We do not use analytics or advertising cookies, or any third-party tracking. The visit counts on our website (Section 1.7) use no cookies and do not follow you across sites. Loading parts of the web app's code and fonts from Google's servers (Section 3.2) is not tracking: it delivers the app, and we do not use it to follow what you do.
7.3You may control cookies through your browser settings, though disabling essential cookies may prevent the Service from functioning.
8. Children's Privacy
8.1The Service is not directed to children and is intended only for users who have reached the age of majority where they live, and at least 18. We do not knowingly collect personal information from anyone under 18. If we learn we have collected such information, we will delete it. If you believe a minor has provided us information, contact us at the address in Section 11.
9. Third-Party Links and Services
9.1The Service may link to or interoperate with third-party websites and services, including your brokerage, payment processor, and any AI provider you select. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. Review their policies directly.
10. Changes to This Privacy Policy
10.1We may update this Privacy Policy from time to time. We will post the updated policy with a revised "Last Updated" date and, for material changes, ask you in the Service to accept the updated policy before you continue using it, giving at least 14 days' notice where a change affects how we use information we already hold.
10.2If you do not accept a change, you may stop using the Service and ask us to delete your account (Section 6.5).
11. Contact Us
11.1Questions, requests, or complaints regarding this Privacy Policy or your personal information may be directed to:
SmartStrikes LLC
14275 SW Mistletoe Dr.
Tigard, OR 97223
Email: support@smartstrikes.app