Privacy Policy
Last updated: September 27, 2026
This Privacy Policy explains how TipSheet ("TipSheet", "we", "us"), collects, uses, shares and protects personal data when you use the TipSheet website at https://tipsheet.trade, the TipSheet dashboard and apps for iPhone, iPad, Apple Watch, Android and Wear OS, and their widgets, Live Activities and notifications (the "Service"). It also explains your rights and how to use them.
TipSheet is currently available only to residents of the United States.
The short version
- We collect what we need to run your account and the features you use — and nothing for advertising.
- We do not sell or share personal information, we do not use it for targeted advertising, and we do not use third-party analytics, advertising or crash-reporting tools.
- Your data is stored in the United States on Google Cloud.
- Ask Claude sends your prompts to Anthropic only when you use it, only with your consent, and only under your own Anthropic API key.
- You can download your data or delete your account in the app at any time. Deleted accounts are purged within 30 days.
1. Who is responsible #
The controller of your personal data is TipSheet, United States (postal address available on request at legal@tipsheet.trade). Contact: privacy@tipsheet.trade.
2. What we collect, why, and for how long #
The table below lists every category of personal data we process. "Contract" means the processing is necessary to provide the Service you asked for; "Legitimate interests" means our interests in running a secure, reliable service, balanced against your rights; "Consent" means you opted in and can withdraw at any time; "Legal obligation" means the law requires it.
| Category | Examples | Source | Purpose | Lawful basis (GDPR/UK GDPR) | Retention |
|---|---|---|---|---|---|
| Account identity | Username, email address, display name, note to the owner with your application | You | Create and approve your account, sign-in, contact you about your account | Contract | Life of account; purged within 30 days after deletion |
| Credentials and security | Password hash (scrypt; we never store your password), two-factor (TOTP) secret, email-verification status, one-time verification, 2FA and recovery codes | You; generated by us | Authenticate you and protect your account | Contract; Legitimate interests (security) | Life of account (codes expire within minutes); purged within 30 days after deletion |
| Sign in with Apple / Google | Apple or Google account identifier, email (or Apple private relay email), and, for Apple, an encrypted refresh token used only to revoke access when you delete your account | Apple or Google, when you choose to use them | Social sign-in; revoking Apple sign-in on deletion | Contract | Life of account; revoked and purged on deletion |
| Account status and legal records | Approval status, role, plan fields, date and version of Terms accepted, age confirmation, country of residence, Community Guidelines acceptance, AI-consent timestamp | You; generated by us | Eligibility (18+, country), recording acceptance and consent, entitlement to features | Contract; Legal obligation; Legitimate interests (proof of acceptance) | Life of account; minimal record of acceptance/consent kept up to 3 years after deletion where needed to defend legal claims |
| Sessions and devices | Session records with device label (for example "iPhone app"), random device ID, first-seen and last-seen times | Your device; generated by us | Keep you signed in, show you your signed-in devices, detect suspicious sign-ins | Contract; Legitimate interests (security) | Until you sign out or the session expires (14 days web, 90 days app); device ID cookie up to 400 days; purged on deletion |
| Portfolio | Holdings, cash, and profile answers (time horizon, risk level, goals) | You | Show your portfolio, prices and P&L; filter alerts to tickers you hold | Contract | Life of account; purged within 30 days after deletion |
| Trade journal | Trades you log (ticker, side, size, prices, dates, notes), up to 2,000 entries | You | Your personal journal and statistics | Contract | Life of account; purged within 30 days after deletion |
| Ask Claude conversations | Your prompts and the AI's replies (up to 40 conversations of 80 messages), chosen chat model | You; Anthropic's replies | Provide chat history; safety review of reported responses | Contract; Consent (sending to Anthropic) | Your history: until you delete it or your account. Owner safety archive: 12 months, and purged for you when your account is purged |
| Anthropic API key | Your key, stored encrypted, and its last four characters | You | Make Ask Claude requests on your behalf | Contract; Consent | Until you remove it or delete your account |
| Lounge posts | Messages you post, your display name, time; reports and blocks you make | You | Operate the members' chat room, moderation and safety | Contract; Legitimate interests (moderation, safety, legal compliance) | Shown for 3 days; stored up to 90 days for moderation, then deleted. Owner moderation archive: 12 months. Deleted or anonymised as "Deleted member" when your account is purged |
| Reports and moderation | Reports you file or that concern you (message, reason, outcome), AI-response reports | You; other users | Enforce the Community Guidelines and improve AI guardrails | Legitimate interests (safety); Legal obligation | 12 months after resolution, unless needed longer for a legal claim |
| Notifications | Push tokens for up to 10 devices (Apple Push Notification service / Firebase Cloud Messaging), alert preferences, watched and muted tickers, in-app inbox (up to 150 items) | Your device; you | Send the alerts you chose | Contract | Push tokens deleted when invalid, on sign-out, or on deletion; inbox keeps the latest 150 items |
| Live Activities / live cards | Live Activity or live-card update tokens | Your device | Update Live Activities and live cards | Contract | Dropped 8 hours after the last change |
| Widgets and watch | Widget/watch token, widget preferences | Generated by us; you | Let widgets and watch apps load your data without a full sign-in | Contract | Until you revoke it or delete your account |
| Preferences | UI preferences (theme, tabs, layout), saved broker links | You | Remember your settings | Contract | Life of account |
| Communications | Emails you send us, our replies, verification and security emails we send | You; us | Support, security notices, responding to requests | Contract; Legitimate interests | 2 years after the last message, unless needed longer for a legal claim |
| Security and server logs | IP address, user agent, requested URL, time, response status (Google Cloud Run platform logs); in-memory rate-limit counters by IP address and username | Your device, automatically | Security, abuse and fraud prevention, debugging | Legitimate interests (security) | Cloud Run default retention (currently about 30 days); rate-limit counters about 15 minutes, in memory only |
| Purchases (when subscriptions are enabled) | Plan, store transaction identifiers, renewal and expiry dates. We never receive your card details — Apple or Google processes payment | Apple / Google | Grant your subscription, handle restores and support | Contract; Legal obligation (tax and accounting) | Life of account, then as long as tax and accounting law requires (generally 7 years) |
| Deletion tombstone | A one-way hash of your username and the deletion date | Generated by us | Prevent abuse of re-registration and honour deletion | Legitimate interests | Up to 3 years |
We do not ask for, and ask you not to provide, sensitive data such as health, religious or political information, government ID numbers or bank account numbers. Please do not post such information in the Lounge or in chat.
Where we get data from. Almost all data comes directly from you or your device. We receive limited data from Apple or Google if you use their sign-in, and from app stores for purchases. We do not buy data about you or combine it with data brokers' data.
Automated decisions. We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing. Account approval is made by a person. The Lounge filter automatically blocks posts that match prohibited patterns; you can contact support@tipsheet.trade to have a person review a blocked post.
3. AI features and Anthropic #
Ask Claude (including share-sheet and widget "ask" features) uses Anthropic's Claude models. It works only with your own Anthropic API key and only after you give consent on a one-time screen, which you can withdraw in Settings.
- What is sent: your prompt, the recent messages in that conversation, a system prompt written by us, and context you ask for, such as ticker data and TipSheet's public calls. Your holdings, cash and trade journal are sent only if the portfolio-context feature is switched on for the Service and you have given AI consent.
- Who receives it: Anthropic, PBC (United States), under your API key. Anthropic processes it under its own commercial terms and privacy policy, which govern your relationship with Anthropic. Under Anthropic's commercial terms as of this date, API inputs and outputs are not used to train its models by default.
- What is not sent: your password, 2FA secret, email address, other users' data, and (unless enabled as described above) your portfolio and trades.
- AI-generated calls: TipSheet's own market calls and summaries are generated from public market data and news by models configured with the operator's own trading rules, playbook and lessons from past graded calls; they do not use your personal data.
See our AI Disclosure.
4. Who we share data with #
We do not sell personal information or share it for cross-context behavioural advertising. We disclose it only to:
| Recipient | What | Why |
|---|---|---|
| Google Cloud (Cloud Run, Firestore), United States | All account data and logs | Hosting and database (processor) |
| Firebase Cloud Messaging (Google) | Push tokens and notification content | Android and web push delivery (processor) |
| Apple Push Notification service (Apple) | Push and Live Activity tokens and notification content | iOS, iPadOS and watchOS push delivery |
| Apple (Sign in with Apple) and Google (Google Sign-In) | Sign-in tokens and identifiers | Social sign-in and revocation, if you use them |
| Resend or Google (Gmail SMTP) | Your email address and the verification, 2FA or recovery code | Sending security emails only (processor) |
| Anthropic, PBC | As described in Section 3 | Ask Claude, only on your request, under your key |
| Apple App Store / Google Play | Purchase records | Billing, when subscriptions are enabled |
| Other members | Your display name and Lounge posts | The Lounge is visible to approved members |
| Authorities, courts, advisers | Data required by law | Legal obligation, protecting rights and safety, and our professional advisers under confidentiality |
| A successor business | Data needed to continue the Service | A merger, acquisition, financing or sale of assets, subject to this Policy |
Other connections your device makes. Our web pages load fonts from Google Fonts, which means your browser sends your IP address to Google when a page loads. Company logos may be loaded from logo services. These providers receive your IP address and browser details under their own policies. Links to news publishers and brokers take you to their own sites.
Market data sources (for example, Yahoo Finance, Twelve Data and a Truth Social RSS mirror) receive requests from our servers, not from you, and receive no personal data about you.
5. Where your data is stored #
Your data is stored and processed in the United States.
6. Retention #
We keep personal data only as long as needed for the purposes in Section 2. Key rules:
| Data | Retention |
|---|---|
| Active account data | While your account exists |
| Lounge posts | Shown 3 days; stored up to 90 days, then deleted |
| Owner archives (chat safety archive, Lounge moderation archive) | 12 months, and purged for you when your account is purged |
| Live Activity tokens | 8 hours after the last change |
| Server and security logs | About 30 days (Cloud Run default) |
| Rate-limit counters | About 15 minutes, in memory |
| After you delete your account | Deactivated immediately; all personal data purged within 30 days; backups roll off within 35 days |
| Billing and tax records | As long as the law requires |
| Deletion tombstone | Username hash and date, up to 3 years |
The 30-day window after deletion lets you (or us, if an account was deleted in error) restore the account. After it ends, restoration is not possible.
7. Security #
We use measures appropriate to the risk, including:
- passwords stored only as salted scrypt hashes;
- Anthropic API keys encrypted at rest with a server-held key, and shown back to you only as the last four characters;
- TLS encryption for all traffic between your device and our servers;
- optional two-factor authentication, email verification, rate limiting, and a list of your signed-in devices that you can revoke;
- access to production data restricted to the operator, with multi-factor authentication on our cloud accounts;
- Google Cloud's encryption of data at rest.
No system is perfectly secure, and we cannot guarantee the security of your data. Please use a strong, unique password and turn on two-factor authentication. If we become aware of a personal data breach that affects you, we will notify you and the authorities as the law requires.
8. Your rights #
Everyone, wherever they live, can:
- download a copy of their data in JSON (Settings → Help → Legal & Privacy → Download my data);
- correct their profile, portfolio and journal in the app;
- delete their account and data (Settings → Delete account, or https://tipsheet.trade/delete-account);
- withdraw AI consent and remove their Anthropic key (Settings);
- turn off notifications (Settings and device settings);
- ask us about their data at privacy@tipsheet.trade.
Additional rights depend on where you live. We honour the rights below regardless of whether a law technically applies to us.
United States (including Texas, California, Virginia, Colorado, Connecticut and other states) #
Depending on your state, you may have the right to: know and access the personal data we hold; correct it; delete it; obtain a portable copy; and opt out of the sale of personal data, targeted advertising and profiling in furtherance of decisions with legal or similarly significant effects. We do not sell personal data, do not engage in targeted advertising, and do not profile in that way, so there is nothing to opt out of, but you may still send us an opt-out request. We do not process sensitive data for purposes that require consent under state law, and we will not sell sensitive data. We will not discriminate against you for exercising your rights.
Texas residents: you have the rights above under the Texas Data Privacy and Security Act. Appeals: if we decline to act on your request, you may appeal by emailing privacy@tipsheet.trade with the subject "Privacy appeal" within a reasonable time. We will respond to your appeal within 60 days, explaining our decision in writing. If your appeal is denied, you can contact the Texas Attorney General (texasattorneygeneral.gov) or your own state's attorney general. The same appeal process applies to residents of all states.
California residents: in the preceding 12 months we collected the categories of personal information described in Section 2 (identifiers, customer records, commercial information about purchases, internet activity in our logs, and inferences only as needed for security), for the purposes described there, and disclosed them only to the service providers and recipients listed in Section 4. We have not sold or shared personal information. We do not have actual knowledge of selling or sharing data of consumers under 16.
You may use an authorised agent; we may ask the agent for proof of authority and verify your identity directly with you.
9. How to exercise your rights #
- In the app or on the web: Settings → Help → Legal & Privacy → Download my data; Settings → Delete account; https://tipsheet.trade/delete-account.
- By email: privacy@tipsheet.trade, from the email address on your account, stating your username and the request.
We verify requests by confirming you are signed in or control the account email. We respond within 30 days (45 days where U.S. state law allows), and may extend this where the law permits (by up to 45 days in U.S. states) if a request is complex, telling you why. Requests are free unless they are manifestly unfounded or excessive.
10. Cookies and local storage #
We use only first-party cookies that are strictly necessary for the Service, so we do not show a cookie consent banner:
| Name | Purpose | Duration |
|---|---|---|
| sf_s | Keeps you signed in (session) | 14 days (web) / 90 days (app) |
| sf_dev | Random device identifier for your device list and security | 400 days |
| sf_g | Remembers that you passed the site access gate | 30 days |
| ts_next | Remembers a link to open after you sign in | 15 minutes |
We use your browser's localStorage only for interface preferences (such as theme and open tabs). We do not use advertising or analytics cookies, pixels or SDKs. See our Cookie & Local Storage Notice.
11. Children and age assurance #
The Service is only for adults aged 18 or over. We ask you to confirm your age when you accept the Terms. On Apple devices we use Apple's Declared Age Range API, and on Android Google Play's Age Signals API, where available, and deny access to users indicated to be under 18. We do not knowingly collect data from anyone under 18. If we learn that we have, we will close the account and delete its data promptly, without the 30-day restore window. If you believe a minor is using TipSheet, contact privacy@tipsheet.trade.
12. Notifications and emails #
We send push notifications only for the alerts you turn on, and emails only for account and security purposes (verification, two-factor codes, recovery, important changes to our terms or this Policy). We do not send marketing email; if we ever do, we will ask for your consent first where the law requires, and every message will include an unsubscribe link.
13. Changes to this Policy #
We will post any changes on this page and update the date and version at the top. If a change is material, we will notify you in the app or by email before it takes effect and, where required, ask for your consent.
14. Contact #
Privacy questions and requests: privacy@tipsheet.trade General support: support@tipsheet.trade Post: TipSheet, United States (postal address available on request at legal@tipsheet.trade)