Privacy Policy

This Privacy Policy explains how StockGamePlan ("we", "us", "our") collects, uses, discloses and protects personal information when you use the StockGamePlan website at stockgameplan.com and its related services (the "Service"). We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we aim to meet equivalent standards, such as the GDPR, for users elsewhere.

1. Information we collect

Category	Examples	Source
Account	Email address, account id, email-verification status, login timestamps	You, via our authentication provider
Profile and preferences	Display name, time zone, language, theme, favourite tickers, calendar filters	You; some preferences are stored only in your browser
Subscription and billing	Plan, billing period, subscription status, renewal date, Stripe customer and subscription ids	Stripe
Payment card details	We never receive or store full card numbers. They are collected and processed by Stripe.	Stripe
Usage and technical	IP address, browser type, pages and features requested, timestamps, error logs	Automatically, through server logs
Analytics (optional)	Pages and app sections viewed, referring site, approximate location, device and browser information, linked to a random cookie id	Google Analytics, only if you accept analytics cookies (see section 6)
Community features	Market-sentiment poll votes linked to your account or an anonymous browser id	You
Communications	Messages you send us and our replies	You

You can browse public pages without an account. You may use a pseudonymous display name, but an email address is needed to create an account.

2. How we use information

• to provide the Service, sign you in and keep your account secure;
• to manage subscriptions, process payments through Stripe, decide which features you can use and send billing receipts and notices;
• to remember your settings across devices;
• to keep the Service working, troubleshoot, prevent abuse and fraud, and enforce our Terms;
• to send service messages, such as security notices and changes to terms or pricing. We only send marketing emails if you opt in, and every marketing email includes an unsubscribe link;
• to comply with law, including tax and record-keeping obligations.

Where the GDPR applies, our legal bases are performance of a contract, legitimate interests (security, service improvement), legal obligation and, for optional marketing and analytics, consent.

3. Who we share it with

We do not sell or rent personal information. We share it only with service providers that help us run the Service, under contracts that require them to protect it:

• Supabase: authentication and database hosting;
• Stripe: payments, subscriptions, invoices and the customer billing portal (see Stripe's privacy policy);
• Hosting and network providers: the cloud servers and network services that run the Service and deliver it to you;
• Google: website analytics (Google Analytics 4), only if you accept analytics cookies (see section 6);
• content delivery networks (for example jsDelivr and the Plotly CDN) that serve open-source scripts to your browser and may see your IP address.

We may also disclose information if required by law, to protect rights and safety, or as part of a merger or sale of the Service (subject to this Policy). Market-data providers receive no personal information about you. For the X mentions card, our server queries X's API for aggregate counts of public posts that mention a ticker (for example $NVDA); only the ticker is sent, never information about you, and we store only the daily counts.

4. Overseas disclosure

Our providers may store or process information outside Australia, including in the United States and the European Union. We take reasonable steps, such as contractual safeguards and choosing reputable providers, so that your information is handled consistently with the APPs.

5. Cookies and local storage

We use a small number of strictly necessary cookies and browser storage items and, only if you accept them, Google Analytics cookies. We do not use advertising or cross-site tracking. See the Cookie Policy for the full list.

6. Analytics (Google Analytics)

With your consent, we use Google Analytics 4, a web analytics service from Google, to understand how the Service is used (for example, which pages and features are visited) so we can improve it. Google Analytics is not loaded until you click Accept in the cookie banner. If you click Decline or ignore the banner, no analytics script runs and no analytics cookies are set.

What is collected: pages and app sections viewed, referring site, approximate location (country or city, derived from your IP address; Google Analytics 4 does not store IP addresses), device, browser and screen information and timestamps, linked to a random identifier stored in the _ga cookies. We do not send your name, email address, account id or other identifying information to Google, and Google signals and ad personalisation are turned off. Analytics data is kept for at most 14 months.

Google may process this data in the United States and other countries. See Google's Privacy Policy and how Google uses data from sites that use its services.

Your choice and how to withdraw it: your choice is saved in your browser (sgp_consent). You can change it at any time with Cookie settings in the footer of every page. If you withdraw consent, Google Analytics stops loading and its cookies are deleted from your browser. Where the GDPR applies, our legal basis for analytics is your consent.

7. Retention

We keep account and preference data while your account is open. Billing records are kept for as long as tax law requires (generally 5–7 years). Server logs are kept for a limited period for security and troubleshooting. When you delete your account, we delete or de-identify your personal information within a reasonable time, except where we must keep it by law.

8. Security

We use encrypted connections (HTTPS), HttpOnly session cookies, verified sign-in tokens, access controls and reputable infrastructure providers. No system is perfectly secure. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

9. Your choices and rights

• You can see and update your profile in Settings, and manage billing details in the Stripe customer portal.
• You can ask us for access to, or correction of, the personal information we hold about you, or ask us to delete your account. Email [email protected]. We will respond within 30 days.
• Where the GDPR or similar laws apply, you may also object to or restrict processing, ask for portability and withdraw consent.
• You can accept or decline analytics cookies, and withdraw your consent at any time, with Cookie settings in the footer of every page (see section 6).
• You can clear browser storage at any time; this resets local preferences.

10. Children

The Service is intended for adults (18+) and is not directed at children. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

11. Complaints

If you have a privacy concern, contact us first at [email protected]. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or to your local data-protection authority.

12. Changes

We may update this Policy. The "Last updated" date shows the latest version. If a change is material, we will notify you by email or in the Service.

13. Contact

Please send privacy questions, requests and complaints to our privacy officer at [email protected].