Privacy policy

The short version

We collect what the service needs: an email address, a name and a password hash if you create an account, the alerts you set and the browsers you allow to show them, an email address if you subscribe to the newsletter, whatever you choose to put in a contact form, short-lived technical logs, and page counts. Your watchlist and display settings stay in your browser and never reach us. We run no advertising trackers and no third-party analytics, and we do not sell personal data.

Who is responsible

The controller of the personal data described here is Not yet known: operating entity to be confirmed.

What we collect

Depending on how you use the site, we process:

• Account data: your email address, the name you give, a salted password hash, whether your email address is verified, when the account was created and when you last signed in, and an avatar image if you upload one.
• Reviews you post about a firm: your rating, title and text, shown with your name once a moderator publishes them.
• Alerts you set: what each one watches (a firm, an instrument, a level, or a change), how it reaches you (a notification, an email, or both), quiet hours with your time zone, whether it is paused, when it last fired, and each alert we sent in the last 90 days with its figure and time.
• Notification devices: for each browser you allow to show alerts, the address its push service gave it (which identifies that browser to the push service), the two keys our alerts are encrypted with for it, a name such as Chrome on Android, and when it was added, last reached and last refused an alert.
• Newsletter data: the email address you subscribe with, the form you used, and delivery status.
• Contact form submissions: the enquiry type you pick, your name, your email address, an optional company or website, and your message. Publisher enquiries may also include which widgets interest you, where you would use them and a visitor-count band, all chosen from fixed lists.
• Page counts: which of our pages an event happened on and which button was used, from a fixed list of event names, with the name of the site that sent you (never the full address), campaign tags in the link and a device type. To count distinct visitors per day, our server turns your IP address and browser details into a daily visitor code, using a random key that changes every day at midnight UTC and is never stored. Your IP address and browser details are not stored with page counts, and codes from different days cannot be linked to each other. Page counts are kept for 90 days, set no cookie, store nothing in your browser, and are not sent when your browser sends Global Privacy Control or Do Not Track.
• Technical logs: IP address, user agent and request timestamps, kept briefly for security and abuse prevention.

What stays on your device

Your watchlist, the unit you read figures in, your lot size, the last instrument you viewed, whether live updates are paused, the light or dark appearance, the challenge plans you save, and the few counts the site uses to decide when to suggest installing it are kept in your browser's storage and are never sent to us. On www.propspread.com the site also keeps copies of its files and of the pages you open in your browser, so they open quickly and without a connection; your account and alerts pages are never kept. Clearing your browser's storage for this site removes all of it. The cookie policy lists each item.

Why we process it

We use this data to operate your account, send the alerts you set and the emails you asked for, answer your messages, secure the service, count how its pages are used, and comply with legal obligations. The legal bases are performance of our agreement with you, your consent where you gave it (the newsletter), and our legitimate interests in keeping the service secure and in counting how it is used.

Sharing and processors

Personal data is shared only with infrastructure providers that host the service and deliver email, under data processing agreements, and with authorities where the law requires it. The current processor list is available on request until it is published here.

An alert shown as a notification travels, encrypted so that only your browser can read it, through the push service your browser's maker runs (Google for Chrome, Apple for Safari, Mozilla for Firefox, Microsoft for Edge on Windows), which delivers it to your device. That service sees when a notification is sent to the browser, not what it says.

Retention and your rights

Account data is kept while the account exists and removed on deletion; database backups can hold it for up to 30 days more (see the account deletion page). Alerts are kept while the account exists; each alert we sent is deleted after 90 days. A notification device is removed when you turn notifications off on it, remove it or sign out on it, when its push service says it no longer exists, and after 90 days in which it neither received an alert nor opened the site signed in to the account. Newsletter addresses are kept until you unsubscribe. Page counts are deleted after 90 days. You can ask us for access to, correction of, export of, or deletion of your personal data at any time.

Requests and questions go to Not yet known: legal contact to be confirmed. If you are in a jurisdiction with a data protection authority, you also have the right to complain to it.