Privacy Policy

Account information. Your name and email address to create and manage your account. Optional: your TOTP secret if you enable two-factor authentication. We store passwords only as bcrypt hashes and TOTP secrets encrypted at rest.

Your phone number. Asked for when you create an account on our website, so we can reach you about your account. The Volaren iPhone app does not ask for it. It is stored unverified: we do not send a confirmation code at signup, so the number on your account is the one you typed and has not been checked. We verify a number at the point we first send to it, not before.

Your LinkedIn URL. Optional, and only if you choose to give it. It helps us understand who our users are. Nothing in the product depends on it.

Usage and billing metering. Your credit balance and a record of the work you spend credits on, so the usage meter and your invoices are accurate and so a retried request cannot be charged twice.

Stock analyses and research data. Analyses you run on publicly traded companies (DCF models, memos, comps, valuations), your watchlists, custom thesis notes, price alerts, and any written annotations you save. These are scoped to your account and are not shared with other users.

Portfolio data. Positions you manually add (ticker, shares, cost basis, thesis). If you connect a brokerage account, we also store the positions synced from that account (see "Brokerage connection data" below).

Brokerage connection data. If you connect a brokerage account via our SnapTrade or Finatic integration, we store that provider's user identifier (and, for SnapTrade, an encrypted API secret) that allows us to fetch your positions on your behalf. We also store the institution name, account type, balance, and holdings returned by the provider. We never receive, see, or store your brokerage login credentials, passwords, or MFA codes. For most brokers that authentication happens directly between you and your broker through the provider's OAuth flow; some brokers (for example, Robinhood) take your login on Finatic's own page rather than through OAuth, and Volaren still never receives it. If you connect with trading permission, the orders you confirm in the Service are sent to your broker through that connection.

Payment information. Processed by Stripe on our website, and by Apple for subscriptions bought in the iPhone app. We never see or store card numbers, CVCs, or billing addresses. We receive only a Stripe customer ID and subscription status, and for App Store purchases, Apple's transaction ID.

Usage metadata. Counts of analyses run per week (for plan limits), timestamps of authentication events, IP addresses associated with login attempts (for security).

Advertising measurement. We load measurement tags from Google Ads and OpenAI so we can tell which of our advertisements bring people to the site and lead to a sign-up. These are third-party advertising vendors: they set their own cookies and can recognise your browser on their own services. They never load for visitors in the European Union, the European Economic Area, the United Kingdom, Switzerland, Brazil, South Korea or Quebec, or when your browser sends a Global Privacy Control signal. Opting out on the cookie policy page stops them and deletes their cookies. We send them no name, email address or other account detail; what they receive is the fact that a sign-up happened and the advertising click it can be matched to.

Referral program data and cookies. To make referral credit work, we can set two first-party cookies in your browser: a random visitor identifier (kept for one year) and, if you arrived through a referral link, the referral code (kept for 30 days, first link wins). We do not set them in the European Union, the European Economic Area, the United Kingdom, Switzerland, Brazil, South Korea or Quebec, when your browser sends a Global Privacy Control signal, or after you opt out; then neither is set and nothing about your visit is recorded. When they are set and someone follows a referral link we also record the code, the landing page, the referring page, the browser's user-agent string, and a salted, truncated hash of the IP address (we do not store the raw address for this purpose), with a timestamp. If you then create an account, we record the referral relationship, which account referred yours, so credits can be granted and self-referral and duplicate-account abuse can be detected. Whatever you chose, signing up from a referral link still credits the person who sent it: the code is read from the link itself. These cookies are first-party only: they are never shared with advertisers or any third party, and they are not used to track you across other websites. The full list of everything we store in your browser, essential and optional, is on our Cookie Policy page, where you can also change your choice.

Activity and conversations. We keep the questions and requests you send on Volaren, the answers you get, and what you do next (such as rating an answer, asking again, or placing a trade). Our team and an automated review read them to check whether each answer gave you what you wanted and to fix the ones that did not. A strong answer may be kept, with personal details left out, as an example that helps answer similar questions. Deleting a conversation removes its words from this record, and deleting your account removes all of it.

Feedback submissions. Product feedback you submit through the credit-earning feedback form is stored with your account identity and is read by our team when we review it. It is used to improve the product and to decide the credit grant, and for nothing else.

Security audit log. Every authentication event, admin action, and billing change is written to an immutable audit log with actor, IP, and timestamp. This is a core security control; see our Security page.

• To provide and improve the Volaren service
• To improve our answers, using your activity and conversations on Volaren
• To manage your account and subscription
• To enforce usage limits and fair-use controls
• To communicate with you about your account (e.g., password resets, security notices, access approval)
• To sync and display your brokerage positions, if you have connected an account
• To operate the referral and feedback credit programs (attribution, credit grants, and fraud prevention)
• To measure which of our advertisements bring people to Volaren, unless you have opted out
• To detect and prevent abuse, fraud, and security incidents
• To meet legal and accounting obligations (billing records, audit retention)

We do not sell or rent your data, and we never hand any third party your name, email address, brokerage holdings, or anything you write on Volaren. We use your activity and conversations to improve our answers, and never to train anyone else's AI. Unless you have opted out, the advertising vendors named below can recognise your browser on our site for measurement, which California law calls "sharing"; that is the only sharing for a marketing purpose that happens, and you can opt out at any time.

To deliver the service, we rely on a small number of carefully vetted subprocessors. Each handles a specific, scoped function:

• Railway, application hosting and primary database.
• Vercel, frontend hosting.
• Stripe, all payment processing.
• Twilio SendGrid, transactional email delivery.
• Anthropic, AI model inference. Data sent is covered by their enterprise no-training agreement.
• OpenAI, AI model inference for some features (text, web search summaries, audio). API data is not used to train their models.
• Google Ads, advertising measurement. Not loaded in the EU, EEA, UK, Switzerland, Brazil, South Korea or Quebec, with Global Privacy Control, or after you opt out; receives that a sign-up occurred and the advertising click it matches, never your name or email address.
• OpenAI, advertising measurement on advertising we run with them. Not loaded in the EU, EEA, UK, Switzerland, Brazil, South Korea or Quebec, with Global Privacy Control, or after you opt out. (Model inference is listed above; this entry is the advertising pixel only.)
• lettervisit (with Maverick Intelligence and Vector), counting visits from AI assistants (for AI agents and crawlers, from our server: their user agent, address and the page read) and identifying the companies and people who visit volaren.ai, for our own outreach. Not loaded in the EU, EEA, UK, Switzerland, Brazil, South Korea or Quebec, with Global Privacy Control, or after you opt out.
• SnapTrade and Finatic, brokerage connections (holdings and the orders you confirm).
• Apple, In-App Purchase for subscriptions bought in the iPhone app.
• Expo, push notifications to the iPhone app.
• Sentry, error tracking (PII scrubbed before transmission).
• Vercel Web Analytics, cookieless page-view counts (a daily-rotating hash, nothing stored in your browser).
• Google Fonts, typefaces served from Google's CDN (your browser sends its IP address to fetch them; no cookie is set).
• UptimeRobot, uptime monitoring (sees only public URLs).

Current list is also available on our Security page.

• TLS 1.3 encryption for all network traffic
• Database volumes encrypted at rest by our infrastructure provider
• Application-level encryption (Fernet) on sensitive fields: MFA secrets and brokerage API secrets; password reset tokens are stored only as hashes
• Passwords stored as bcrypt hashes with per-password salts
• Logs scrubbed of secrets before reaching our logging provider
• Per-account data isolation: all queries are scoped to your user ID; no data is shared across accounts
• Automatic lockout after repeated failed login attempts; two-factor auth available
• Weekly automated vulnerability scans; annual manual security review

Full control inventory: volaren.ai/security.

• Account data, kept until you delete your account.
• Stock analyses, portfolio positions, watchlists, alerts, and notes, kept until you delete them, or until your account is closed.
• Brokerage positions, retained as long as your brokerage account is connected. Positions marked as closed (sold) are retained for historical context until you disconnect the account.
• Security audit log, 365 days (may be retained longer where required by law).
• Login attempt history, 30 days.
• Expired password reset tokens, purged within 7 days of expiry.
• Billing records, retained for 7 years as required by US tax law.

Depending on where you live, you have various rights over your personal data:

• Access, download a structured archive of all the data we hold about you. Self-serve at /settings.
• Deletion, permanently erase your account and associated data. Self-serve at /settings.
• Correction, edit profile fields from /settings. For fields you can't edit directly, email support@volaren.ai.
• Portability, the export format (JSON in a ZIP) is interoperable and machine-readable.
• Brokerage disconnection, you can disconnect your brokerage account at any time from your portfolio or settings page. This removes the stored credentials and position data immediately.
• Objection / restriction, contact support@volaren.ai to restrict specific uses of your data.
• Opt out of sale or sharing, including by sending a Global Privacy Control signal: Do Not Sell or Share My Personal Information.
• Complaint, you may lodge a complaint with your local supervisory authority (e.g. an EU Data Protection Authority).

We respond to verified requests within 30 days. We may ask you to re-authenticate before taking irreversible actions.

Our primary infrastructure is in the United States. If you access Volaren from outside the US, your data will be transferred to and processed in the US. We rely on Standard Contractual Clauses and equivalent mechanisms with our subprocessors where required by law.

Volaren is a product for adults. We do not knowingly collect information from anyone under 18. If you believe we have collected information from someone under 18, contact support@volaren.ai and we will delete it.

We may update this policy to reflect new features, legal requirements, or operational changes. Material changes are announced by email to registered users at least 30 days before they take effect. The "last updated" date at the top of this page always reflects the current version.

Privacy, data, and general inquiries: support@volaren.ai
Security issues: support@volaren.ai (see also our vulnerability disclosure policy)

Data controller: Volaren Inc., a Delaware corporation. Written requests, including from EU/UK residents, may be sent to the contact email above.