Privacy Policy
Last updated: August 11, 2026
1. What we collect
① What you give us: signup email, invite code, chart comments you post (text and bull/bear stance), briefing-subscription status, reports you file. ② What's generated: access logs (IP, pages, user-agent; kept 90 days for stats and abuse prevention), AI usage records (tokens & cost per call, for billing), language preference (cookie). We never collect names, IDs, holdings, or wallet addresses — and there are no passwords.
2. Cookies
Login session nofomo_session (30 days, httpOnly+Secure), invite status nofomo_invite (1 year), language wm_lang (1 year); for analytics: anonymous id wm_aid (1 year, httpOnly, a random value with no personal info), invite attribution wm_invch (one-time, 10 minutes, an irreversible hash only), and opt-out wm_optout (1 year, present only if you turn analytics off). Theme and chart layouts live in your browser's localStorage and are never uploaded. No third-party ad cookies, no cross-site tracking.
3. Who sees your data
Comments you post are publicly visible to all visitors under a masked nickname (e.g. first letters of your email) — don't put personal info in them. Emails go through Resend (email address only); AI reads call LLMs via OpenRouter (public market data only — never your personal info); the site is served via Cloudflare (which handles connection metadata under its own policy). Prices come from public market APIs like Binance; charts render in-house with no third-party chart service. We never sell or share your data beyond that.
4. Where it lives & for how long
Servers are offshore; the database is stored locally. Access logs auto-delete after 90 days; login codes expire in 5 minutes, and expired codes/sessions are cleaned during later login activity; sessions cannot be used after 30 days. Comments, usage records, and subscription status stay for the life of your account. The database is backed up daily with integrity checks; the last 14 copies are kept.
5. How we protect it
HTTPS everywhere (HSTS) plus a Content Security Policy; session cookies are httpOnly+Secure; login codes come from a cryptographic RNG, expire in 5 minutes, and are rate-limited against brute force; account/business writes require a login, server secret, or verified callback, while public AI generation has spending circuit breakers and rate limits; backups are verified before storing. No system is perfectly secure — responsible disclosure by email is welcome.
6. Your rights
Log out or stop using anytime. Email [email protected] to delete your account and all associated data — including comments, sessions, subscriptions, and usage records (processed within 7 days, except where law requires retention).
7. Minors
This site is for adults only — no service for users under 18.
8. Updates & contact
This policy may change; major updates will be announced on-site. The Chinese version governs. Contact: [email protected].
9. First-party analytics & opt-out
To improve the product we run our own (never third-party) analytics: page views (stored as template paths like /why/[id], never specific content IDs), signup/login funnel, referral-link clicks, plus coarse language/device type/country. Events never contain your email, full IP, or full referrer URLs (host only); signed-in users are represented by an irreversible hash instead of an account ID. Raw events are deleted after 180 days, keeping only aggregates that can't be traced back to you. If your browser sends GPC (Global Privacy Control) we stop automatically; you can also opt out anytime with the switch below — nothing else changes. Deleting your account also deletes or unlinks your analytics subject.