Privacy Policy. How we collect, use, and protect your data.

01 Introduction

Convexity is a financial intelligence terminal that provides real-time market data, AI-powered analysis, and portfolio tracking tools. The Service is operated by Convexity LLC, a North Carolina limited liability company.

This policy explains what information we collect when you use Convexity, how we use it, who we share it with, and what rights you have. We believe in plain language over legal jargon; if something is unclear, email us and we will explain it.

02 Information We Collect

Account information: When you create an account, we collect your username and email address. If you sign in with Google, we receive your Google profile ID. Passwords are hashed using Argon2id and are never stored in plain text.

Financial data via Plaid: If you connect a bank or brokerage account through Plaid, we can access your account balances and investment holdings. This data is fetched on demand and is not stored long-term in our database.

Portfolio and trading data: Any portfolios, transactions, watchlists, or trade journal entries you create within Convexity are stored in our database for as long as your account is active.

Usage data: We collect your IP address and browser information from server logs for security and debugging purposes. We do not use advertising cookies, tracking pixels, or cross-site tracking.

Product analytics: We use Mixpanel to see which features get used. It receives page views, feature events, your account id, email address, display name, username and plan tier, and standard device metadata (browser, operating system, referrer). It also records session replays that are masked before upload: every text node is redacted and images and video are blocked, so a recording shows layout, navigation, and where you clicked, never your balances, your positions, or anything you type. Mixpanel keeps its identifiers in your browser's local storage rather than in cookies, and honors your browser's Do Not Track setting.

Support conversations: If you open the support chat, Intercom receives what you write, any email address you give us, your IP address, and basic browser metadata, and sets a cookie so a conversation stays attached to you as you move between pages. The chat is optional and nothing is sent to Intercom unless you open it.

AI interaction data: When you use our AI-powered analysis features, your queries and relevant financial context are sent to our AI providers. These queries are anonymized: they do not include your username, email, or account identifiers.

03 How We Use Your Information

• Provide the service: Display your portfolios, execute queries, show market data, and power the core terminal experience.
• AI-powered analysis: Process your questions through AI models to generate financial analysis and insights.
• Security: Detect abuse, prevent unauthorized access, and protect your account.
• Improve the product: Understand usage patterns in aggregate to build better features. We do not build individual user profiles for marketing.
• Communicate with you: Send account-related notifications such as security alerts or service updates.

04 Information Sharing

We do not sell your data. We share information only with the service providers necessary to operate Convexity:

Market data providers (Financial Modeling Prep, CoinGecko) send us data; we do not send them any user information. Let's Encrypt issues our TLS certificates and receives only our domain names. These three appear on our security page vendor list, which covers every outside service we rely on, but they are not listed above because we share no information about you with them.

05 Data Security

We take the following measures to protect your data:

• Password hashing: All passwords are hashed with Argon2id, a memory-hard algorithm designed to resist brute-force attacks.
• Multi-factor authentication: TOTP (authenticator app) and WebAuthn (hardware key) are available for your account.
• Encryption in transit: All connections to Convexity use TLS encryption.
• Vendor security: All vendor accounts are secured with MFA and managed through a password manager.
• Access control: Server access is restricted to SSH key authentication. There is no shared access.

No system is perfectly secure. If we discover a breach that affects your data, we will notify you promptly with details about what happened and what you should do.

06 Data Retention

We keep your data only as long as necessary:

• Account data (username, email): retained while your account is active, plus 30 days after deletion to allow account recovery.
• Financial records (portfolios, transactions, trade journals): retained while your account is active, plus 90 days after deletion for regulatory compliance.
• Plaid connections: tokens are deleted immediately when you disconnect an account.
• Server logs: retained for 90 days, then automatically deleted.
• AI query logs: retained for 90 days for cost tracking and abuse prevention, then deleted.
• Market data cache: refreshed every 24 hours. This does not contain personal information.

When you delete your account, your data is permanently removed from our database after the retention periods above. It is deleted from backups within 30 days as backups rotate.

07 Your Rights

Regardless of where you live, you have the following rights over your data:

• Access: Request a copy of all personal data we hold about you.
• Correction: Update or correct inaccurate information.
• Deletion: Request that we delete your account and all associated data.
• Data portability: Request your data in a machine-readable format.
• Opt out: We do not sell your data, so there is nothing to opt out of. If this changes, we will provide a mechanism.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

08 For Users in the European Union

If you are located in the EU or EEA, you have additional rights under the General Data Protection Regulation (GDPR):

• Lawful basis: We process your data based on consent (account creation), contract performance (delivering the service), legitimate interest (security monitoring, AI analysis), and legal obligation (financial record-keeping).
• Right to restrict processing: You can ask us to limit how we use your data while a complaint is being resolved.
• Right to object: You can object to processing based on legitimate interest. We will stop unless we have compelling grounds.
• Data transfers: Your data is stored on servers in the United States. We rely on Standard Contractual Clauses with our vendors to ensure adequate protection for cross-border transfers.
• Supervisory authority: You have the right to lodge a complaint with your local data protection authority.

09 For California Residents

Under the California Consumer Privacy Act (CCPA), California residents have the right to:

• Know what personal information we collect and how we use it (this policy).
• Request deletion of personal information.
• Opt out of the sale of personal information; we do not sell your personal information.
• Non-discrimination: we will not treat you differently for exercising your privacy rights.

10 Children's Privacy

Convexity is a financial intelligence terminal designed for adults. We do not knowingly collect personal information from anyone under 18 years of age. If you believe we have collected data from a minor, please contact us immediately and we will delete it.

11 Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and notify registered users by email. Your continued use of Convexity after changes are posted constitutes acceptance of the updated policy.

12 Contact

If you have questions about this privacy policy, want to exercise your data rights, or have concerns about how we handle your information:

Convexity LLC
Attn: Garrett
Email: [email protected]