Privacy Policy

1. Who we are

StrikeViews and the free Options Owl community ("we", "us", "the Service") are operated by ParallelAxiom LLC. ParallelAxiom LLC is the data controller for personal data described here. Contact the controller and our data-protection contact at privacy@strikeviews.com. This policy explains what personal data we collect through strikeviews.com, the Options Owl feed, and the StrikeViews mobile app, and the choices you have.

2. What we collect

We collect only what the Service needs to function:

• Account data: a nickname, an optional email address (if you choose email sign-in), and a device identifier used to keep you signed in. If you sign in with Google or Apple, we receive the identifier and email those providers share. Optional profile fields: bio, avatar color/monogram, display language, and your email-notification preference.
• Content you post: twits (posts), replies, likes, the tickers and users you follow, view counts on your posts, and in-app/optional-email notifications derived from them. Anything you post is public by design — it is a social feed. Trade structures you attach to a twit are stored as part of that post.
• Photos and media you upload: images/GIFs you attach to a twit (up to the posted size cap), stored to display them in the feed. Do not upload anything you want kept private.
• Authentication data: password hashes (never the plaintext password), password-reset tokens and their expiry, and session tokens, stored only to keep you signed in securely.
• Support and feedback data: the message plus any optional category/name/email you put in the Feedback form, and the email address you enter in password-reset, used only to respond.
• Mobile-app data sent to AI/market providers at your direction (§11–12): the StrikeViews app can send ticker symbols to market-data providers and, only after your explicit in-app consent per request, position/news context to the LLM provider you configured with your own key. This is device → provider directly; our servers never see it.
• What we do NOT collect: the app performs no advertising tracking, no third-party analytics, and no crash-report SDK collection. Voice dictation in the app uses the OS speech recognizer to transcribe into the draft on your device — we do not record, store, or receive your audio.

3. Anonymous visitor analytics

When you browse the public website we record an anonymous, privacy-preserving visit count. We do not store your IP address or any other identifier in a way that can be linked back to you. Each visit is represented only by a hashed key derived from a stable browser identifier and the request IP, so we can count unique visitors over 24-hour, 7-day, and 30-day windows for operational reporting. This data is aggregated and used solely to understand traffic; it is never sold.

4. How we use your data

• To provide and operate the feed, authentication, and moderation features.
• To keep you signed in and protect accounts from abuse.
• To enforce the Community Guidelines (including hiding or removing content and banning accounts, as described there).
• To produce anonymous, aggregated visitor statistics.
• To improve the product and respond to support requests.

5. Legal basis

We process personal data only with a valid legal basis under GDPR (where it applies):

• Contract (Art. 6(1)(b)): account data, content you post, authentication tokens, and support messages — necessary to provide the feed, sign-in, and moderation you request.
• Legitimate interests (Art. 6(1)(f)): securing the Service (abuse prevention, rate limiting), operating anonymous visitor analytics, and improving the product. We balance these interests against your rights and collect the minimum data needed.
• Consent (Art. 6(1)(a)): email notifications (opt-in), optional analytics cookies where used, and any device→provider AI/market request made after your explicit in-app consent. You may withdraw consent at any time (e.g. toggling email notifications off); withdrawal does not affect prior lawful processing.
• Legal obligation (Art. 6(1)(c)): retaining records where the law requires it (e.g. responding to lawful requests, tax/accounting records).

6. Data retention

We keep your account and content for as long as your account is active. When you delete your account (in the app, on the website, or via our account-deletion page), your profile and posts are hidden immediately and a 14-day reactivation window starts: signing back in restores everything, and your handle and email stay reserved so nobody else can take them. After 14 days without a sign-in the account is permanently removed — your likes, follows, notifications, sessions, credentials, and email are deleted (the address becomes reusable), while twits and replies you wrote stay readable under “Deleted user” so other people's threads survive. Password-reset tokens expire shortly after issue; server logs and encrypted backups rotate out within approximately 30–90 days. Anonymous visit counts are kept in aggregate and are not tied to you after collection. Where the law requires longer retention (e.g. to resolve disputes or comply with a legal request), we keep only what is required.

7. Your rights

Depending on your jurisdiction (including GDPR and CCPA/CPRA where they apply), you have the right to access, correct, export (data portability), or delete your personal data, and to object to or restrict certain processing, including processing based on legitimate interests and any direct marketing. Where processing is based on consent, you may withdraw it at any time. You can delete your account at any time from within the app (Options Owl Settings → Delete account), from the website settings Data tab, or by following our account-deletion page. To exercise any other right, email privacy@strikeviews.com — we respond within one month (GDPR) or the timeframe required by applicable law, and we will tell you if we need longer for a complex request.

8. Children

The Service is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a minor has provided us data, contact us and we will delete it.

9. International transfers

The Service may be hosted in the United States and accessed globally. If you are in the EEA or UK, your data may be transferred to the US under appropriate safeguards: Standard Contractual Clauses (2001/914/EU & 2021/914/EU) with the UK Addendum where applicable, plus supplementary technical measures (encryption in transit, hashed passwords, vault-kept API keys). You may request a copy of the relevant safeguards via privacy@strikeviews.com.

10. Contact

Questions about this policy or your data: privacy@strikeviews.com (ParallelAxiom LLC). We will respond within the timeframes required by applicable law.

11. Mobile app: what stays on your device

The StrikeViews mobile app is designed so your trading data stays yours:

• Stays on device: trades, watchlists, profiles, and alert/bracket settings are stored locally in an encrypted vault. Market-data and LLM API keys you supply (BYOK — Polygon, OpenRouter/OpenAI/Anthropic/custom) are kept in the OS secure storage (Android Keystore / iOS Keychain), never logged, and never sent to our servers.
• Leaves the device only when you ask: (a) signing in or posting to Options Owl sends account/content data to our servers (§2); (b) loading quotes/charts sends the requested ticker to the active market-data source; (c) the AI adviser sends the shown context to your configured LLM provider only after explicit in-app consent. AI output is labeled as AI-generated in the app.
• Journal sync (end-to-end encrypted, optional): your journal is encrypted on your device with your sync passphrase (PBKDF2 + AES-256-GCM) before upload. We store one opaque ciphertext blob per account plus metadata-only counters (version, size) — we cannot read your journal, and your passphrase is never sent to us. If you forget it, the website copy cannot be recovered (your device copy still opens with nothing to recover). “Delete my web copy” removes the blob entirely; your device journal is untouched. Verify us in DevTools: sync traffic carries only ciphertext. A worked test vector is published at /journal-sync-vector.json.
• Device permissions and why: Internet (load market data, sync your twits); notifications (price/position alerts you configure — local only); microphone (optional voice dictation transcribed on-device into your draft; no audio stored or transmitted by us); photos/media (only images you explicitly pick to attach to a twit).

12. Third parties we share data with

We do not sell your personal data and do not share it for advertising. Data leaves our systems only to operate the Service, with these processors:

• Hosting/storage: Cloudflare (Pages/Workers, D1 database, R2 media storage) — account, content, uploads, anonymous visit counts, and opaque journal-sync blobs (unreadable ciphertext, §11).
• Email (opt-in only): Resend — notification emails (views/responses on your twits) only if you enable email notifications, plus password-reset and feedback replies.
• Sign-in you choose: Google or Apple — OAuth identifier and email they share, only if you use that sign-in method.
• Market and news data (ticker queries): Cboe, Yahoo Finance, Polygon (your key), Finnhub, EODHD, AlphaVantage — the requested symbol only.
• AI adviser (your key + your consent): OpenRouter (default), OpenAI, Anthropic, or your custom OpenAI-compatible endpoint — only the context shown in the consent prompt.
• Backups you initiate: Dropbox — only if you explicitly save/restore an encrypted backup through StrikeAdmin. We cannot read the encrypted backup without your passphrase.

13. Security

• All traffic is encrypted in transit (HTTPS). Passwords are stored as hashes, never plaintext; API keys live in OS secure storage, never in logs.
• Account deletion hides your profile and posts at once, then permanently removes your account after 14 days (signing back in cancels it). Anonymous visit counts are aggregate and cannot be linked back to you. Encrypted backups may retain removed data until routine rotation.

14. Google Play Data Safety disclosure

This section mirrors the app's Play Console Data Safety form so the two can never drift apart. If they conflict, this policy governs and we will correct the form.

• Data collected via the app: name (nickname), email address (only if you use email sign-in or enable email notifications), user IDs (device/session identifiers, OAuth IDs), photos/videos (only images you attach to a twit), app activity (posts, replies, likes, follows, in-app interactions), journal-sync blob (optional: end-to-end encrypted ciphertext we cannot read, plus version/size counters; deletable anytime).
• Data NOT collected by us: precise or approximate location, financial-account data (trades/watchlists stay on your device unless you publish them as a twit), health, contacts, calendar, SMS/call logs, or audio recordings (microphone is transcription-only, §11). No advertising ID, no third-party analytics, no crash-report SDK.
• Data shared: as listed in §12 (hosting, opt-in email, OAuth if used, market/news ticker queries, LLM context after consent). Shared data is encrypted in transit; it is never sold and never used for advertising.
• Purposes: app functionality, account management, content you publish, security/moderation, and communications you opt into.
• User controls: you can access, correct, export, or delete your data at any time (§7); deleting your account removes your identity while your published twits stay under “Deleted user”. Email notifications are opt-in and reversible in Settings.

15. EU/UK GDPR: controller, DPO & complaints

• Controller: ParallelAxiom LLC. Privacy and data-protection contact (DPO equivalent): privacy@strikeviews.com.
• No EU representative: we do not currently designate an Art. 27 representative; EU/UK users should contact us directly at the address above.
• Complaints: if you believe our processing infringes data-protection law, you have the right to lodge a complaint with your local supervisory authority (e.g. via the EDPB member list in the EEA, or the ICO in the UK), in addition to contacting us first — we aim to resolve complaints within one month.
• Automated decision-making: we do not make decisions producing legal or similarly significant effects by solely automated means (Art. 22); moderation combines automated screening with human review, and appeals go to a human at moderation@strikeviews.com.