Privacy

Privacy Policy

Last updated 2026-05-28. This policy explains what data TSTI collects, what we do with it, who we share it with, and the rights you have over it.

1. Who we are

TSTI (Trading Style Type Indicator) is operated by AIAH LLC, a California limited liability company with its principal place of business in Sacramento, California. We are the data controller for personal data processed through tsti.trade.

Privacy contact: [email protected].

2. What we collect

2.1 Account data

• Email address.
• Display name (you set it; we don't require a legal name).
• Password — stored only as a salted hash. We never see your plaintext password.
• If you sign in with Google or Meta: their OAuth identifier and the email address they return.
• Account creation and last-login timestamps.

2.2 Quiz data

• Your answers to the quiz questions and the assigned archetype.
• Your computed bias-dimension scores and surfaced “leaks.”
• Anonymous quiz sessions are stored without identity. If you later sign up, the session from your browser's local storage is linked to your account so you don't lose the result.

2.3 Brokerage data (only if you connect a broker)

We connect to your brokerage through SnapTrade (Passiv Technologies Inc.) using read-only OAuth. We never see your broker credentials. From SnapTrade we receive:

• The name and type of each brokerage account you choose to connect.
• Trade activities for the last 24 months: symbol, side (buy/sell/short), quantity, price, fees, and timestamps.
• Account-level balance metadata (when SnapTrade provides it).

We do not store account numbers, login credentials, full balances, tax identifiers, beneficiary information, or order routing details.

2.4 Coaching messages

If you start a coaching conversation, we store the messages you send and the model's responses so you can reload the conversation later. The third-party model (currently Google Gemini) receives only a redacted summary of your bias profile and recent activity — never your raw credentials or balances.

2.5 Payment data (only if you subscribe)

Payment processing is handled by Stripe. We receive from Stripe: customer identifier, subscription state, price/plan identifier, and renewal dates. We do not receive or store your card number or CVC — those go directly to Stripe.

2.6 Usage and device data

• Your IP address (used briefly for security, rate limiting, and rough country lookup).
• Browser user-agent string.
• Product analytics events (page views, button clicks, quiz progress) via PostHog. These are associated with your user ID after sign-in.
• We do not use third-party advertising cookies, ad-network pixels, or social-media re-targeting trackers.

2.7 Local storage on your device

We use your browser's local storage for:

• The Better Auth bearer token (your session) so you stay signed in.
• A pending anonymous quiz-session id, so we can attach the result to your account if you sign up later. Expires after 3 days.
• Your theme preference (light or dark) and similar UI state.

3. How we use the data

• To operate the service. Compute your archetype, render your dashboard, run analytics on your trades, persist your conversations, send you transactional email (account verification, password reset).
• To secure the service. Detect abuse, rate-limit, investigate suspicious activity.
• To bill you. If you subscribe, send identifiers to Stripe to manage your subscription.
• To improve the product. Aggregated and anonymized data is used to calibrate scoring, audit fairness, and refine the typology. Aggregates never identify you.
• To comply with the law. Respond to lawful requests from authorities, enforce our terms.

We do not: sell your personal data, share it with brokerages or financial-services advertisers, train external AI models on your data, or use it for ad-targeting.

4. Who we share data with

We share only the minimum data each service needs to function. None of these are recipients to whom we “sell” data under California or similar definitions.

• SnapTrade (Passiv Technologies Inc.) — brokerage data connection. They hold the OAuth tokens to your brokers and return trade activity to us.
• Stripe Inc. — payment processing. Receives your email, customer identifier, and payment-method details (which you provide to Stripe directly).
• Google LLC (Gemini / Vertex AI) — generates coach responses. Receives the redacted prompt context described in 2.4. Per Google's API policy, prompts and responses are not used to train their general models.
• Google LLC (OAuth) and Meta Platforms Inc. (OAuth) — only if you choose to sign in with them.
• Resend — sends transactional email (account, password reset). Receives only your email address and message content.
• PostHog Inc. — product analytics. Receives events, user identifiers, and basic device metadata.
• Vercel Inc. — hosts the website. Sees request logs (IP, URL, user agent) for the duration needed to serve and secure traffic.
• Hetzner Online GmbH — hosts our application server. Sees request logs for security and reliability.
• Neon Inc. — managed Postgres provider that stores our database.
• Cloudflare Inc. — DNS and edge-network protection.

We may also disclose data to legal authorities when required by law, or to protect our rights or safety. If we're ever acquired or merged, your data may transfer to the successor entity under the same protections described here; we'll notify you beforehand.

5. International transfers

Our infrastructure and several of our processors are based in the United States. If you use TSTI from outside the U.S., your data will be transferred to and processed in the U.S. Where required, we rely on the Standard Contractual Clauses (SCCs) and equivalent mechanisms with our processors.

6. How long we keep data

• Account data: until you delete your account, then immediately purged. Backups roll off within 30 days.
• Quiz sessions: linked sessions persist with your account; anonymous sessions are deleted after 90 days of inactivity.
• Trade data: retained while your brokerage is connected. Deleted from our database within 24 hours of disconnect; SnapTrade is also notified to forget you.
• Coaching messages: retained while your account exists.
• Billing records: retained for 7 years to satisfy tax and accounting requirements, even after account deletion. Stripe is the system of record.
• Server and analytics logs: 90 days maximum.

7. Your rights

You can exercise these rights at any time from your settings page or by email.

• Access and portability. Download a JSON export of everything we hold on you from settings.
• Correction. Update your name or email from settings; for other corrections, email [email protected].
• Deletion. Delete your account from settings. Deletion is permanent and propagates to SnapTrade and our processors.
• Withdrawal of consent. Disconnect a brokerage, opt out of coaching, or unsubscribe from non-transactional email at any time.
• Objection and restriction. If you are an EU/UK/Swiss resident you may object to processing or request restriction; email us.
• Complaint. EU/UK/Swiss residents have the right to lodge a complaint with a supervisory authority.

California residents: You have the right to know, delete, correct, and opt out of the sale or sharing of your personal data under the CCPA/CPRA. We do not sell or share your personal data as defined under California law. To exercise these rights, contact [email protected]. We don't discriminate against users who exercise their rights.

8. Security

We use industry-standard practices: HTTPS everywhere, hashed passwords, encrypted secrets, scoped access tokens, audit logging on sensitive operations, and least-privilege access for our team. No system is unbreakable; if we ever discover a breach affecting you, we'll notify you and the appropriate authorities within the timeframes required by law.

9. Children

TSTI is for adults 18 and older. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided data to us, email [email protected] and we will delete it.

10. Do-Not-Track

Some browsers send a “Do Not Track” signal. There is no industry standard for how to respond to it; we honor the related Global Privacy Control (GPC) signal where we can detect it by treating you as opted out of analytics personalization.

11. Changes to this policy

We may update this policy. The “Last updated” date at the top reflects the most recent change. Material changes (new data uses, new processors, new categories of data) will be announced by email or in-product notice at least 14 days before they take effect.

12. Contact

Privacy questions, requests, and complaints: [email protected].

Mailing address: AIAH LLC, Sacramento, California (full street address available on written request).