Privacy Policy

Who we are

"We", "us", "our", and "Oxeye Technologies" refer to Oxeye Technologies LLC, a California limited liability company, which is the data controller for personal information processed by our website and products. You can contact us at sridhar@oxeye.tech. "Services" means the website at oxeye.tech, the Oxeye iOS application, the Oxeye connector for ChatGPT and Claude, and any other product published by Oxeye Technologies LLC. "Oxeye" (without "Technologies") refers specifically to the iOS application.

What we collect

Account information

You can sign in to the Oxeye iOS app with Sign in with Apple, Sign in with Google, or an email address and password. Sign-in is handled on our behalf by Firebase Authentication (Google LLC), which stores your account identifier, your sign-in method, your email address (or Apple's private relay address if you chose to hide your email), your name if your Apple or Google account shares it, and the date the account was created. If you sign in with email and password, the app sends your password directly to Firebase Authentication, which stores it only in hashed form; Oxeye's own servers never receive or store it. We use the account creation date to work out your 7-day free-access period.

Subscription information

Subscriptions are bought and billed through Apple. Our subscription-management provider receives your Oxeye account identifier and your App Store purchase, renewal and expiry records so the app can tell whether your subscription is active. If you installed the app from an Apple Search Ads campaign, it also receives Apple's AdServices attribution token, which identifies the campaign rather than you and does not use the advertising identifier. We never receive your payment card details.

Data saved with your account

So that your watchlist follows you to another phone and we can tell you when something changes, our servers store the following, linked to your Oxeye account identifier:

• Your watchlist: the tickers you add yourself, when you added them, and when you removed them (removals are kept for 30 days).
• For each stock you add, the forecast Oxeye showed that day (its rating, likely range, middle, forecast move and target date, all Oxeye's own numbers) and how it ended: hit, miss or not scored.
• Your notification settings and, for each phone where you turn notifications on, a notification token and the app version. We use the token only to send the notifications you chose.
• Your Monday brief for each of the last 8 weeks: the Oxeye Signal changes, ended forecasts and earnings dates for the stocks on your watchlist that week, built from the items above and Oxeye's stock data. Older briefs are deleted.
• Whether you finished or skipped the welcome steps, and how many stocks you picked there.
• The first and the most recent day you opened the app, and on how many days.

Holdings imported from a connected brokerage (their tickers, quantities, market values, costs and purchase dates) are not saved with your account. They stay on your phone.

Data kept only on your device

The following are stored only in the app's local storage on your iPhone. We do not back them up, and they do not sync between your devices.

• Holdings imported from a connected brokerage: their tickers, quantity, market value, average cost and earliest purchase date, and the price and forecast shown when each was added.
• Your reminder schedule: the 90-day reminders, the reminders the day before a watchlist stock reports earnings, and the one reminder before your full access ends. Reminders are local notifications scheduled on your device; we do not receive them.
• Forecasts tracked on your device for "AI Called It" (those started before your account saved them, and those for imported holdings), their results, and which results you have already seen.
• How many times you have opened the app and when it last asked you to rate it in the App Store, so it asks at most once every 120 days.

To show prices, forecasts and portfolio metrics for these stocks, the app sends the relevant ticker symbols (and, for portfolio metrics, their weights) to our servers, which compute the result and do not store it. Separately, viewing a stock's forecast creates an app usage event with its ticker, which we do store.

Brokerage connection (optional)

You can choose to connect a brokerage account. The connection is made through our brokerage-connection provider. You sign in to your brokerage inside that provider's connection portal; Oxeye never sees or stores your brokerage username or password. If you connect:

• We register you with the provider using your Oxeye account identifier and store the access secret it returns on our servers (Google Cloud Firestore), keyed to that identifier. Disconnecting the brokerage in the app deletes your user at the provider and this secret.
• Through the provider, our servers retrieve your linked account list, your stock and ETF holdings (quantity, market value and average cost), your past buy trades (used to show when you first bought each holding) and, when you preview an order, your brokerage's estimate of its value, commission and the cash remaining afterwards. Our servers pass this to the app and do not store it; imported holdings are then kept on your device as described above.
• If you place orders from the app, we store on our servers: a record of your one-time trading risk acknowledgment (its version, the time, and the email address on your account); each order preview you request (account, ticker, buy or sell, order type, number of shares or dollar amount, limit price and time); and an audit log of each order you place, including your brokerage's order identifier and response. These records are kept while your account exists, including after you disconnect the brokerage, so there is an audit trail of orders placed through the app.

Orders are sent to your own brokerage through the provider and executed by your brokerage under its terms. Oxeye Technologies LLC is not a broker-dealer and does not hold your money or securities.

Oxeye in ChatGPT and Claude (optional)

If you subscribe, you can connect Oxeye to ChatGPT (OpenAI) or Claude (Anthropic) so they can answer questions with Oxeye's data. The connector only reads: it cannot trade, change your watchlist or change your account. If you connect:

• You sign in on oxeye.tech/connect with the same Oxeye account and the same sign-in methods as the app, handled by Firebase Authentication as described above. Our servers then check with our subscription-management provider that your subscription is active, and check again at least once an hour while the connection is used.
• For each connection we store on our servers your Oxeye account identifier, the name the AI app gave itself (for example "Claude"), when the connection was made, and a renewal key, kept only in scrambled (hashed) form. The AI app also registers itself with the web addresses we may send you back to; that record does not identify you. Short-lived records made while you sign in are deleted automatically a few days after they expire, at most.
• When ChatGPT or Claude asks, our servers send it the Oxeye data it asked for. This can include data saved with your account (your watchlist, the forecasts tracked on it and their results, and your Monday brief) and the tickers it asks about. Once sent, that data is handled by OpenAI or Anthropic under their own privacy policies, which we do not control.
• We do not receive your conversations with ChatGPT or Claude. We see only each request the AI app makes to Oxeye. For each request we log which kind of data was asked for, whether it worked and how long it took, without your account identifier, alongside the standard request logs described under "Technical data".

A connection stops working when your subscription ends, 60 days after it was last used, or when you delete your account, and its stored record is then deleted. Disconnecting Oxeye in ChatGPT or Claude also ends the connection when the AI app tells us about it; if it doesn't, the record is deleted after 60 days without use.

Install attribution (AppsFlyer)

The app uses AppsFlyer to measure which campaigns lead to installs and subscriptions. It is configured for Apple's SKAdNetwork only: the app never shows Apple's App Tracking Transparency prompt and never accesses your device's advertising identifier (IDFA). AppsFlyer receives your Oxeye account identifier, standard device information (such as device model, operating-system version, IP address and the app-vendor identifier; AppsFlyer can use the IP address to estimate an approximate location such as your country or city), and these in-app events: account sign-up and sign-in (with the method used), subscription purchases (product and price), adding a stock to your watchlist (with its ticker), your first forecast view (with its ticker), and your first brokerage connection.

App usage events

To learn which features people use and whether they come back, the app sends our servers a short record when you do certain things in it. Each record carries your Oxeye account identifier (taken from your sign-in token), the time, the app version and the platform. The records are: opening the app; signing up or signing in (with the method used); viewing a stock's forecast (with its ticker); adding a stock to your watchlist (with its ticker and the screen you added it from); opening the share sheet for a card (which card, and the ticker for stock and "AI Called It" cards); seeing the subscription screen; buying a subscription (the product, and whether it was an Apple test purchase); opening an "AI Called It" card (with its ticker); opening a link to a stock's page on oxeye.tech in the app (with its ticker, and a short tag for where the link came from, such as a share card); the welcome steps you saw, finished or skipped; your answer on our notifications card and on Apple's notification prompt; opening a notification (its kind, and the ticker when it names one); turning a notification setting on or off; tapping a stock in the Changes list (with its ticker); seeing the full-access banner (how many days were left); and connecting a brokerage for the first time (the provider's name). They never include your name, email address, holdings, device identifiers or the advertising identifier, and we do not share them with AppsFlyer or anyone else. We store them in Google BigQuery. When you delete your account, our server keeps one record that an account was deleted and how many days old it was, with only the date and without your account identifier.

Technical data

When the app or the website makes a request to our servers we automatically receive standard technical information: IP address, user agent, the requested address (which can include a ticker symbol) and a timestamp. Google Cloud keeps these request logs for 30 days. The app attaches a Firebase sign-in token to its requests so our servers can identify your account for features that need it, such as your saved watchlist, notifications, the brokerage connection and account deletion. The app includes Firebase App Check, but our servers do not currently enforce it. The oxeye.tech website does not use cookies or analytics scripts.

What we do not collect

• We do not collect your conversations with ChatGPT or Claude, your brokerage username or password, your payment card details, your contacts, your precise location, or your advertising identifier (IDFA).
• Oxeye Technologies LLC does not sell personal data, does not show ads in the app, and does not use your data to track you across other companies' apps and websites.

How we use it

Oxeye Technologies LLC uses the information above only to:

• Provide the Services: sign you in, check your subscription and free-access period, show forecasts and portfolio metrics you request, and run the optional brokerage connection and order placement.
• Send the notifications you turn on: when a stock you follow gets a new Oxeye Signal, and when a forecast tracked on your account ends.
• Measure which campaigns lead to installs and subscriptions, and how many subscriptions start, renew and end (AppsFlyer and our subscription-management provider).
• Understand how the app is used, for example how many new accounts view a forecast, add a stock or come back after a day, a week and a month, so we can improve it (our own app usage events).
• Maintain the Services (e.g., debugging, preventing abuse) and keep an audit trail of orders placed through the app.
• Communicate with you about our products when you have emailed us or agreed to be contacted.
• Comply with our legal obligations and enforce our Terms of Service.

Legal bases (for users in the EEA and UK)

Where GDPR or UK GDPR applies, Oxeye Technologies LLC relies on the following legal bases: performance of a contract (to deliver the Services you request, including the brokerage connection you choose to make); our legitimate interests in operating, securing and measuring our products (balanced against your rights); compliance with legal obligations; and your consent, where we ask for it. You can withdraw consent at any time.

Service providers

We rely on the following providers to run the Services. Each processes data only as needed to deliver its function:

• Google Cloud Platform — hosts our backend (Cloud Run), databases (Firestore, BigQuery), storage (Cloud Storage) and request logs (Cloud Logging), in US regions. Your brokerage records and the data saved with your account are stored in Firestore, and app usage events in BigQuery.
• Firebase (part of Google) — Authentication (sign-in), App Check (installed, not currently enforced), and Hosting for the oxeye.tech website.
• Expo (650 Industries, Inc.) and Apple Push Notification service — deliver the notifications you turn on. They receive your phone's notification token and the text of each notification (stock tickers, Oxeye Signals and results), not your name or email address. When the app asks Expo for its notification token (when you turn notifications on, and then about once a day when you open the app), Expo also receives the device token Apple issued for the app and an installation number Expo creates for this copy of the app.
• Google Vertex AI (Gemini) — writes the per-stock AI outlooks and one sentence a week about the whole market for the Monday brief. Prompts contain only public market data and Oxeye's own numbers; we do not include any personal information.
• Subscription-management provider — subscription status and purchase records.
• AppsFlyer — install and subscription attribution, in SKAdNetwork-only mode without the advertising identifier.
• Brokerage-connection provider — brokerage connection, holdings retrieval and order routing, only if you connect a brokerage.
• Market-data provider — market prices, company fundamentals and economic indicators. It receives ticker symbols only, never information about you.
• Apple and Google — Sign in with Apple and Sign in with Google; Apple also distributes the app and processes in-app purchases.

Data retention

We keep your sign-in account and your brokerage records (the brokerage-connection access secret, your risk acknowledgment, order previews and the order audit log) while your account exists. When you delete your account in the app we delete them, and we do not keep separate backups of them; if you want us to confirm that nothing remains, email us and we will check and remove anything left. Request logs are kept for 30 days. The data saved with your account is kept while your account exists. A phone's notification token is deleted when you sign out on that phone, when you turn off notifications for Oxeye, when your full access ends without a subscription, when Apple reports that it is no longer valid, or after 180 days in which the app has not checked in from that phone. App usage events are kept for up to 14 months and then deleted automatically. When you delete your account in the app, we delete the usage events linked to it within 2 days; Google Cloud's recovery storage can hold deleted data for up to 14 more days before it is permanently erased. Our subscription-management provider and AppsFlyer keep their own records under their own retention policies and are not updated automatically when you delete your account; email us and we will ask them to delete the records linked to your account identifier. We may keep information longer where the law requires it, to enforce agreements, or to investigate fraud.

Account deletion

You can delete your Oxeye account at any time with the "Delete Account" option in the Oxeye iOS app (on the Profile screen), or by emailing sridhar@oxeye.tech from the email address on your account. Deleting your account in the app:

• disconnects any connected brokerage and deletes your user at the brokerage-connection provider;
• deletes your brokerage records from our servers (access secret, risk acknowledgment, order previews and order audit log);
• deletes the app usage events linked to your account within 2 days (we keep only an anonymous record that an account was deleted);
• deletes the data saved with your account: your watchlist, the forecasts tracked on your account and their results, your notification settings and your phones' notification tokens;
• deletes your ChatGPT and Claude connections, so they stop working;
• deletes your Firebase sign-in account; and
• clears the app's local data (watchlist, reminders and tracked predictions) from that device.

Deletion is permanent. Deleting your account in the app does not remove the records our subscription-management provider and AppsFlyer hold; email us and we will ask them to delete theirs. Deleting your account does not cancel an App Store subscription; you can cancel it in your Apple Account settings.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or port the personal information Oxeye Technologies LLC holds about you, to object to or restrict certain processing, and to withdraw consent. California residents have rights under the CCPA/CPRA (including the right to know, right to delete, and right to opt out of the sale or sharing of personal information — though we do not sell or share personal information for cross-context behavioral advertising). To exercise any of these rights, email us. We will not discriminate against you for exercising a right.

Children

The Services are not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have, email us and we will delete it.

Security

All traffic between the app, the website, and our backend is encrypted with TLS, and Google Cloud encrypts stored data at rest. Access to production data is limited to the minimum number of personnel (currently: one) required for operation. No system is perfectly secure — if you discover a vulnerability, please report it to the email above and allow us a reasonable window to remediate before public disclosure.

International transfers

Oxeye Technologies LLC is based in the United States and processes data in the United States. If you access the Services from outside the US, you consent to this transfer and to the processing being governed by US law, subject to any non-waivable rights under your local law.

Changes to this policy

We'll update this page when our practices change and revise the "last updated" date at the top. Material changes will be announced inside the Oxeye app or by email where we have one on file.

Contact

For privacy questions, data-access requests, or to exercise any right above, write to Oxeye Technologies LLC at sridhar@oxeye.tech.