Privacy Policy

1. Who is responsible for your data

The data controller is MarketStoryBook. For anything in this policy, including access, correction, and erasure requests, write to us through our contact form.

2. What we collect and why

Account data — your email address, password (stored only as a secure hash) or Google, Apple or Microsoft sign-in identifier, and the dates your account was created and last used. Purpose: to run your account. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).

Terms acceptance record — the version of these documents you accepted, when you accepted it, and the page you accepted it from. Purpose: to show that consent was given. Legal basis: our legal obligation and legitimate interest in keeping proof of agreement (Art. 6(1)(c) and (f)).

Follows and email preference — the stories and companies you follow and your chosen Alerts email frequency. Purpose: to send you the updates you asked for. Legal basis: contract, and consent for the emails themselves, which you can withdraw by choosing “No email” or unfollowing.

Story suggestions and feedback — the text you send us and the email address to reply to. Purpose: to review the idea and respond. Legal basis: contract and legitimate interest.

Country — derived from the network your request arrives on, stored as a country name only. Purpose: to understand where readers are. Legal basis: legitimate interest. We do not store your IP address.

Usage measurement — pages viewed and actions such as opening a story or following it, with a session identifier and, when you are signed in, your account id. Purpose: to see which parts of the site are useful. Legal basis: your consent, given in the cookie banner and withdrawable at any time from the footer or your profile page. Measurement stays off until you accept.

3. Cookies and similar storage

Strictly necessary storage keeps you signed in and remembers your cookie and feedback choices on your device. It needs no consent.

Measurement storage is set only after you accept in the banner, and is used by PostHog as described below. You can withdraw consent at any time; the site keeps working exactly as before.

4. Who else processes your data

Hosting and application platform: Lovable, and its infrastructure providers, which run the site and its database.

Product analytics: PostHog, EU region, used only with your consent.

AI model providers: used to generate story text, cases and signals. We send them public company and market information only — never your account data, your follows, or anything else about you, and your data is never used to train models.

Email delivery: our transactional email provider, used to send Alerts digests and account notices.

Market data providers: Marketstack and Yahoo Finance. We send them ticker symbols only, never anything about you.

All of these act as processors on our instructions under data processing agreements. Where data is transferred outside the EU/EEA, it is covered by the European Commission's standard contractual clauses.

5. How long we keep it

Account data, follows, and email preferences: until you delete your account.

Story suggestions and feedback: until you delete your account, or up to 24 months for anonymous feedback sent without an account.

Usage measurement: up to 24 months.

Terms acceptance records: deleted with your account. If we are legally required to retain proof of agreement for longer in a particular case, we keep only the version, the date, and a non-identifying reference.

6. Your rights

You have the right to access your data, correct it, have it erased, restrict or object to processing, withdraw consent, and receive a machine-readable copy to take elsewhere.

Two of these you can exercise yourself, immediately, on your profile page: download a full copy of your data as a file, and delete your account permanently. For anything else, write to us through our contact form and we will answer within one month.

You can also complain to your national data protection authority — in Denmark, Datatilsynet.

7. Security and changes

Data is stored on access-controlled infrastructure, protected in transit by TLS, and separated per user by database-level access rules so one account cannot read another's data.

We may update this policy. The current version and its date are shown at the top of this page.