LoadingLoadingLoadingAlphaYouLegal
Updated October 21, 2026
What we collect, who gets it, and your choices.
AlphaYou, Inc., a Delaware corporation, runs alphayou.net and the AlphaYou phone app. We are the company responsible for the personal information described on this page. This page also covers trading on AlphaYou (copy trading, manual trading and baskets); where it says “trading”, it means those features.
The one contact for every privacy question is info@alphayou.net. AlphaYou is for people 18 and older, and we do not knowingly collect information from anyone younger. If you think a younger person has given us theirs, email us and we will delete it.
What you give us:
If you trade or copy on AlphaYou:
What we record as you use AlphaYou:
We use information to operate the product, sign you in, manage access, process subscriptions, deliver alerts, run trading (set up your wallet-based account and copies, place and watch the trades you authorize, show your balances and activity, and tell you when a copy stops, a key expires or a withdrawal completes), keep AlphaYou secure, stop abuse, fix errors, monitor the health of our data sources, understand whether AlphaYou is useful, and meet legal duties.
The reason the law allows each use, in plain words:
AlphaYou runs from the United States and keeps its database there. If you use AlphaYou from another country, your information is sent to the United States. We do not sell your information. These companies help us run AlphaYou:
Always, to run the service:
Only if you choose it:
With your permission wherever the law asks for it: PostHog (product analytics), Google Analytics, Meta, X and Reddit (advertising measurement). See Analytics And Advertising below.
We may also disclose information if required by law, to protect rights and safety, to investigate abuse, or as part of a business transfer.
AlphaYou SEO Ads is an operator tool for keyword research and content planning. With the account owner’s consent, it reads Google Ads account identifiers and Keyword Planner search-demand metrics. Our separate Search Console connection reads verified site properties, search queries, page addresses, impressions, clicks and rankings. These connections are for authorized operators, separate from signing in to the AlphaYou product.
We use these reports to find relevant topics, improve content and measure organic acquisition. This workflow makes reporting requests; it does not create campaigns or change advertising budgets. Google’s Ads permission also allows account management, so its consent screen describes broader access than this workflow uses.
OAuth credentials are kept in the operating system keychain or access-restricted local configuration. Reports are saved in restricted working files. Authorized operators and the AI assistant provider they choose, such as OpenAI or Anthropic, may process report extracts for this research. Credentials are excluded from those extracts. Provider processing follows the operator’s settings and the provider’s policies.
We do not sell Google API data or use it for advertising targeting. AlphaYou’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Google API data must not be used to train generalized AI models; operators must use provider settings or agreements that prevent that use before sharing report extracts.
Access lasts until the owner revokes the grant or it expires. Reports stay until they are no longer needed for research or the owner requests deletion; there is no automatic deletion timer today. Revoke access through your Google Account’s third-party connections and email info@alphayou.net to request deletion of saved reports. Revoking access stops future reads but does not itself delete earlier exports.
AlphaYou, Inc. receives the stock tickers, research filters, public wallet addresses, market names and comparison selections needed to answer requests from our ChatGPT plugin and Claude connector. A public wallet address can identify a person. The connector does not request private keys, passwords, wallet signing access or private account records.
Trader requests pass validated parameters to our research service hosted on Railway, its research engine and Hyperliquid public information services. SEC evidence checks use SEC EDGAR. Returned research is sent to the assistant you use: ChatGPT (OpenAI) or Claude (Anthropic). That company handles the data under your settings and its own policies.
The connector adds no saved wallet searches, account linking, watchlists or alert subscriptions. Usage telemetry records the tool, its result status (data returned, nothing found, source unavailable or error), duration, environment and which assistant link was used (ChatGPT or Claude, taken from the connection address). For the smart money, fundamentals and SEC disclosure tools it also records the category and ticker; for every other tool, including all trader tools, it records nothing about what was asked or returned. It does not record full chats, actor searches, wallet addresses, emails or a persistent user identifier. A click on a trader link in a Claude answer is counted with the assistant and the page it opened, without the wallet address, IP address or device details. Hosting and error monitoring use Vercel, Railway and Sentry. Operational logs may contain request paths, public research identifiers and technical request information.
Connector usage records are deleted after 30 days. Research caches refresh on their configured schedules; refresh does not guarantee deletion. See Keeping And Deleting Data below, and email info@alphayou.net for access or deletion requests.
In the European Union, the European Economic Area, the United Kingdom, Switzerland and California, and wherever we cannot tell where you are, analytics (PostHog) and advertising measurement (Google Analytics, Meta, X and Reddit) are off until you turn them on from Privacy choices in the site footer. Until you do, nothing is sent to these companies and no advertising cookie or pixel is loaded.
Everywhere else they are on by default, and you can turn them off from Privacy choices at any time. When on, AlphaYou may send page visits and conversion events to measure campaigns. For Meta, X and Reddit server measurement, this can include trial activity and confirmed purchase value. Email addresses used for matching are normalized and hashed before transmission. Hashing is not anonymity, so the same privacy choice applies to browser and server measurement.
AlphaYou honors an enabled Global Privacy Control as a request to keep this measurement off. Once information has reached Meta, X, Reddit or Google we cannot take it back; each has its own tools for deleting it.
Two things run whatever you choose, because they keep AlphaYou working and secure: error reports to Sentry, and our own page, sign-up and visit-source counts in our own database. The counts use a random browser ID (the cookie ay_analytics_id) and, once you are signed in, a scrambled form of your email address. Advertising platforms receive none of it unless the choice above allows it.
Stripe handles card payments, so your full card number never reaches us. We keep only what we need to manage access: Stripe customer and subscription IDs, plan, status, renewal dates and invoices. Some older subscriptions were bought through Whop, which handles those payments. If you subscribe inside the phone app, Apple or Google takes the payment and RevenueCat records the subscription for us. We keep payment records as long as tax and accounting law requires.
When you call the AlphaYou API we record the key, the endpoint, the day, how many requests the call cost, and whether it was turned away. We also record the caller’s IP address and the account behind a free key, using its email address in a normalized form that treats aliases such as name+2@gmail.com as one inbox. We also record, as a short code, which companies and funds each key asked about each day, only to detect bulk copying. We never use what you look up to make, rank or time our research, and we never sell or share it. We use this to enforce limits, detect abuse, support you, and fix faults. Daily usage and address records are kept about 35 days, short-term limit counters a few days, and abuse flags for as long as needed to review them. The API terms explain the limits.
Watchlists, saved tickers, dismissals, alerts, and product interactions may be used to order and filter what you see and to improve the research system. They never change the data, score or verdict shown for any security. Do not add information you consider highly sensitive unless the product explicitly supports that use.
Where we delete automatically, these are the real periods:
Everything else tied to your account (email, watchlists, alerts, Ask conversations, email history) stays until you ask us to delete it. We do not delete inactive accounts on a timer today.
When you ask, we delete or anonymize it within 30 days. Some records stay after that: payment and tax records, proof of your privacy choices (kept as a one-way code instead of your email), and blocks put in place for abuse or sanctions. Copies in backups disappear as the backups expire. Signal receipts and public historical records may remain available because past accountability is part of the product.
You can ask for a copy of your information, a correction or deletion by emailing info@alphayou.net. We reply within 30 days. A person handles each request, may ask you to confirm the account is yours, and emails you when it is done. You can also start a deletion from the account deletion page.
Card details stay with Stripe. The trade-only key for a copy is stored encrypted. Email sign-in links expire after 15 minutes, and API keys are stored only as a one-way hash, so we cannot read a key back. No system is perfectly safe. If a breach affects you, we will tell you as the law requires. When this page changes, we update the date at the top.