Privacy Policy

Who processes your data

The database owner and operator of this service is y-apps, operator of StockMail (https://stockmail.digital).

For any question about your data, or to exercise the rights described below, write to [email protected].

What we collect

• Account data: your email address and a bcrypt hash of your password. We never store the password itself.
• Watchlist: the ticker symbols you choose to track, and the order you put them in.
• Alert rules: the symbols, thresholds and repeat settings of alerts you create.
• Delivery preferences: your daily-brief subscription flag, your chosen days and time, and your timezone.
• Billing data: if you subscribe, your PayPal subscription identifier plus its status and renewal date. Card and PayPal account details are handled by PayPal and never reach our servers.
• Email send timestamps: when a verification or password-reset email was sent to you, used to enforce anti-abuse cooldowns.

Providing your email address is required: without it the service cannot deliver anything. Everything else is voluntary and you can change or remove it at any time.

Briefings are sent only to your own account address. There is no field that lets you send a briefing to someone else, so we do not hold data about people who have not signed up themselves.

What we don't collect

We don't collect brokerage credentials, balances, positions, or any personally identifying financial data. StockMail never asks you to link a broker. Your IP address is used transiently in memory for rate limiting and is not written to our database.

Why we use it

• To authenticate you and keep you signed in.
• To build and send the daily brief and the alerts you asked for.
• To bill and manage your subscription, where you have one.
• To answer support requests you send us.
• To protect the service against abuse (rate limits, email cooldowns).

We do not sell, rent or share personal data for marketing, and we do not profile you.

Consent and legal basis

You provide your data when you create an account, and you confirm your address by clicking the verification link we email you. That confirmation, plus your continued use of the service, is the consent on which we process the data listed above; processing billing data is additionally necessary to perform the contract you enter when you subscribe.

You can withdraw consent at any time by deleting your account. Deletion is immediate and removes the data, as described under "Retention".

Who else sees it

We use these categories of service provider. Each receives only what its job needs:

• Hosting: the application and its database run on a single virtual server at DigitalOcean, in its Amsterdam (AMS3) datacentre.
• Network and DNS: Cloudflare sits in front of the site as a reverse proxy, and therefore sees request metadata such as your IP address.
• Email delivery: outbound briefings and account emails are handed to an SMTP provider, which receives your email address and the message content.
• Payments: PayPal processes subscription payments and receives the data needed to bill you.
• Market data: public quotes are fetched from third-party market-data endpoints. Only the ticker symbol is sent, never anything about you.
• AI summaries: ticker symbols and public market data are passed to an AI model to generate the movement and rating notes. Your email address and account data are never included in that request.

Retention

We keep your account data for as long as your account exists. There is no fixed expiry, because the service is a subscription you control.

• Sign-in sessions expire 30 days after they are created; expired sessions are deleted automatically every hour.
• Accounts that never confirm their email address are deleted automatically once the verification link expires.
• Email send timestamps are kept for the life of the account and are deleted with it.
• When you delete your account, the account row and everything attached to it (sessions, watchlist, alert rules, preferences, schedule, verification and reset tokens, and email timestamps) are removed immediately in the same operation.
• Server logs (request lines and error traces) live in the hosting container's log stream and are lost when the container is replaced on the next deployment. They are not stored in the database and are not indexed or analysed.
• The database is not separately backed up and we take no snapshots of it, so deleted data is not recoverable from a backup copy. Deletion is final.

Your rights

You can inspect, correct, export and delete your data yourself, from Settings → Account:

• Access and export: "Download my data" returns everything held about your account as a JSON file.
• Correction: your watchlist, schedule and preferences are editable at any time; write to us to correct anything you cannot edit.
• Deletion: "Delete my account" removes the account and its data immediately, after confirming your password.

If you would rather we did it, or you want to complain about how your data was handled, write to [email protected].

Security

In general terms: passwords are stored as bcrypt hashes and never in readable form; the site is served over HTTPS only; session cookies are HTTP-only so page scripts cannot read them; the API applies per-IP rate limits, and authentication endpoints are limited more tightly than the rest; access to the server is restricted to key-based administrative login. No system is perfectly secure, and we do not claim otherwise.

Cookies and local storage

• sm_session: a strictly necessary cookie that keeps you signed in. It holds a random session token, lasts 30 days, and is HTTP-only. Without it you cannot stay signed in, so it is set without asking.
• sm_a11y: stored in your browser's local storage, not sent to us. It remembers your accessibility choices (text size, contrast, motion, link underlines, font).
• sm_cookie_consent: stored in your browser's local storage. It records whether you accepted or declined analytics cookies, so we stop asking.

Analytics cookies are not set unless you accept them. If analytics is enabled on the site you will see a consent bar first, and nothing is loaded until you choose. You can change your mind at any time via the "cookie settings" link on this page.

We do not use advertising, remarketing or social-media tracking pixels.

Cookie settings

Children

The service is not aimed at children and we do not knowingly collect data from them. We do not ask for your age, so we cannot detect it; if you believe a child's data has been given to us, write to us and we will delete it.

Changes to this policy

If we change this policy materially, we will announce it by email at least 14 days before it takes effect, and update the date at the top of this page. Minor clarifications may be made without notice, but the date always changes.