Privacy Policy

Terminal is operated by Neo Native (the "Service", "we", "us"). We are the data controller for the personal data described in this policy.

We collect three categories of data: (1) what you tell us — your email, password, nickname, avatar, interests, and any messages you post; (2) what your use of the Service generates — sentiment votes, watchlist symbols, portfolio and journal entries, and basic usage logs; and (3) what your device and browser send — IP address, user-agent, and necessary cookies. We do not collect payment-card numbers directly; Stripe handles those.

Account data

• Name — the first and last name you give at registration. Other members see your display name, not this.
• Email address — required for login, password recovery, and important account notifications.
• Password — stored as a salted hash; we never see the plaintext.
• Display name — chosen at registration; shown on your public profile and in chat. Avatar — optional.
• Acceptance of the Terms — the version you accepted and when, recorded when you confirm you are 18 or older and accept the Terms at your first sign-in. Nothing else is stored with it.
• Trading interests — the categories you pick during onboarding (e.g. Stocks, Crypto, Day Trading). Used to tailor the daily briefing and discoverability.

Usage & product data

• Sentiment votes — which option you picked on a community poll, when you voted, and a snapshot of the crowd's split at vote time (used to compute your Edge score).
• Watchlist & alerts — tickers you save and price-alert rules you create.
• Items saved to your account — your portfolio (positions, quantities, purchase prices, cash movements), your watchlists, dashboard layout (which widgets, in which order and size, and the symbol on each Favorite Chart tile), the drawings you place on charts, your screener presets and the articles you save to read later. They are kept on our servers as well as in your browser, so they return when you sign in again or use another device, and they are deleted with your account.
• Chat messages & group memberships — what you post in public or invitation-only chat rooms, and which rooms you belong to.
• Follow graph — who you follow and who follows you.

Trading journal & broker connections

• Trades — what you enter by hand or import into the journal: instrument, size, prices, times, and any note you attach.
• Saved broker connections — only if you choose to keep one: the read-only API key and secret you provide. They are sealed with AES-256-GCM before they reach our database and are never sent back to your browser, which shows only the last four characters. A nightly job uses them to import your trades. Deleting the connection deletes them, and so does deleting your account.
• Published holdings — only if you turn publishing on: the positions shown on your public profile.

Technical data

• IP address — to enforce rate limits and detect abuse.
• Browser & device info — user-agent string, screen size, language. Used for responsive design and crash diagnostics.
• Push subscriptions — if you turn notifications on: the address your browser or phone gives us for that device and the keys needed to deliver a message to it. Turning notifications off removes it.
• Session cookies — see Cookies Policy.
• Things kept in your browser — the app also keeps copies of your items and a few settings in your browser. The Cookies Policy lists them all. Publishing your holdings on your profile is a separate choice you make on the portfolio page.
• Server logs — request paths and status codes, retained for security and debugging.

Payment data

We use Stripe to process payments. We never receive or store your full card number. Stripe gives us a customer ID, the last four digits of the card, the billing country, and your subscription status — which we use to grant the right plan tier on your account.

Partner programme

Only if you apply to the affiliate programme: your payout method and the details we need to pay you (for example a bank or Wise reference), the pitch and the social links you write in the application, your referral code, and the commissions you earn. When an admin runs a payout, your name, email and a payment reference go into the bank file they upload.

What we do NOT collect

• Your broker password, or the ability to trade on your behalf: a saved connection uses a read-only API key that you create and can revoke at your broker, and Terminal never places an order.
• Health, biometric, or precise geolocation data.
• Government identification numbers.
• Behavioral tracking from sites outside of Terminal.

We use the data above for the purposes listed here, and no others:

• Run the Service. Authenticate you, serve your briefing, render charts, keep your portfolio and journal, deliver chat messages, tally sentiment votes.
• Personalize. Tailor the daily briefing and newsfeed to your interest categories, surface the symbols you watch.
• Bill you. If you subscribe to a paid plan, send the relevant data to Stripe to charge your payment method.
• Keep things working. Detect abuse, throttle bots, debug crashes, study aggregate usage to decide what to build next.
• Talk to you. Send account notifications (password resets, billing receipts), and — only if you opt in — product updates or marketing emails.
• Show ads on the free plan. Load Google AdSense on the pages that carry ads, for free accounts only (see section 4). We don't send Google your account data.
• Comply with the law. Respond to subpoenas, court orders, and statutory requests where we are required to.

We rely on a small set of named "subprocessors" — vendors who process data on our behalf to deliver the Service. Each is listed below with what they receive and what they do with it. Their own privacy policies apply to that processing.

Advertising on the free plan

On the free plan, the Markets, News, Dashboard and Watchlist pages show ads served by Google AdSense. Starter and Pro accounts and the Pro trial never load it, the iOS app never loads it, and there are no ads in chat, your portfolio, settings, billing, your profile or these legal pages. Google chooses and serves the ads and uses the data it receives — your IP address, browser details, the page you are on, and its own cookies — under Google's privacy policy; see also How Google uses information from sites or apps that use our services. We don't send Google your account data.

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet. In the EEA, the UK and Switzerland, Google's own consent message — a Google-certified consent platform using the IAB Transparency & Consent Framework — asks you first; if you refuse, Google may still show non-personalised or limited ads. You can opt out of personalised advertising at Ads Settings or at www.aboutads.info. The cookies involved are listed in our Cookies Policy.

Services your browser contacts directly

Some screens show content that your browser fetches straight from another provider. Those providers receive your IP address and ordinary browser details, as any website you load something from does; none of them receives your account data.

• DuckDuckGo and CoinCap — the company and coin logos shown next to tickers.
• Google — the small news-source icons on the World Map.
• Esri — the satellite imagery of the World Map.
• Finnhub and Binance — the live price streams behind moving quotes.
• YouTube — Live TV streams, in YouTube's privacy-enhanced player, when you open a channel.
• The News Terminal — the separate service shown on the Live TV page, loaded from its own address.
• QR Server (api.qrserver.com) — draws the QR code of a partner's referral link in the affiliate dashboard.

We use a small number of cookies: one for your login session; three for affiliate attribution, only if you arrive through a partner's referral link; and two for product analytics — PostHog's own, and one that tells our server about your choice — only if you accept them. Until you do, PostHog is not even started. You can change that choice at any time in Settings. We set no advertising cookies or tracking pixels of our own; on the free plan, Google AdSense can set its advertising cookies, under the choice you make in Google's consent message (section 4). See the full breakdown in our Cookies Policy.

We keep your data only as long as we have a reason to:

• Account data — for as long as your account is open. When you delete your account, we erase identifying fields within 30 days and retain only anonymized aggregates needed for historical reporting (e.g. total votes cast on a poll).
• Chat messages — kept while the room exists. When you leave a room or delete a message it disappears from live views; we retain backup copies for up to 30 days.
• Server logs — kept by our hosting provider for as long as its plan retains them. We keep no separate copy.
• Billing records — kept for the period required by applicable tax and accounting law (typically 7 years).
• Backups — taken by our database provider and encrypted at rest. How long each one is kept is set by that provider's plan, not by us.

Depending on where you live, you may have some or all of the following rights. We honor them globally — not just where law requires us to:

• Access — request a copy of the personal data we hold about you.
• Correct — update inaccurate or incomplete data, directly from settings or by emailing us.
• Delete — close your account and have your personal data erased (with the retention exceptions noted in §6).
• Export — ask us by email and we send you a machine-readable copy of your account data within 30 days. There is no self-service export yet; when there is, it will be in settings next to account deletion.
• Object — tell us to stop using your data for a particular purpose (e.g. marketing emails).
• Withdraw consent — where processing is based on consent, withdraw it without affecting prior processing.
• Lodge a complaint — with your local supervisory authority (for EU users, your national Data Protection Authority).

To exercise any of these rights, email privacy@neonativeterminal.com. We'll verify your identity and respond within 30 days.

Our subprocessors operate globally. Your data may be transferred to and processed in countries outside your country of residence, including the United States. Where required, we rely on the European Commission's Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms to ensure your data carries the protections of your home jurisdiction.

We follow industry-standard security practices: encrypted connections (TLS), encrypted storage at rest, salted password hashing, principle-of-least-privilege access controls, regular dependency scanning, and rate-limited authentication endpoints.

No system is perfect. If you spot a vulnerability, please disclose it responsibly to security@neonativeterminal.com — we'll credit responsible reporters in our security page.

Terminal is not intended for users under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently done so, contact privacy@neonativeterminal.com and we'll delete it.

When this policy changes, we update the "Last updated" date at the top. Material changes — for example, a new subprocessor with broader data access — are also announced by email at least 14 days in advance, so you have time to review and, if you disagree, close your account.

For anything privacy-related — questions, complaints, or to exercise any of the rights in §7 — email privacy@neonativeterminal.com.