Privacy Policy

STKMRKT (“stkmrkt,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains what we collect when you visit stkmrkt.com or use our services (the “Services”), how we use it, who we share it with, and the choices you have.

By using the Services you agree to this Policy and our Terms of Service.

1. Information We Collect

We collect the following, depending on how you use the Services:

• Account information — name, email address and a password (stored only as a salted hash) when you register, or the name, email address and Google account identifier we receive if you choose “Sign in with Google.”
• Simulator and personal-tool data — paper-trading accounts, virtual trades and holdings, watchlists, trade notes, risk settings and AI-review requests you make. These are virtual records; we never collect brokerage logins or real trading credentials.
• Newsletter and communications — your email address and topic preferences if you subscribe, and the contents of messages you send us.
• Preferences — your light/dark theme choice and, if you allow it, recent stock searches.
• Usage and device data — IP address, browser and device type, pages viewed, referring page and approximate location derived from IP. Collected automatically through server logs and, if you consent, Google Analytics.
• Security data — sign-in attempts and captcha results (Cloudflare Turnstile) used to prevent abuse.

We do not knowingly collect payment card details. No paid plans exist today; if that changes, payments will be handled by a third-party payment processor and this Policy will be updated first.

2. How We Use Your Information

• To create and secure your account, and to provide and operate the Services, including the simulator.
• To personalise your experience, such as remembering your theme and recent searches.
• To send service emails (verification, password reset, important notices) and, if you subscribe, our newsletter.
• To understand aggregated usage so we can fix problems and improve the product.
• To detect, prevent and investigate abuse, fraud and security incidents.
• To comply with legal obligations and enforce our Terms.

3. Legal Bases (EEA, UK and similar regions)

Where data-protection law such as the GDPR applies, we rely on:

• Contract — to provide the account and features you ask for.
• Consent — for optional cookies and storage (analytics, preferences), and for marketing emails. You can withdraw consent at any time.
• Legitimate interests — to secure the Services, prevent abuse and improve them, balanced against your rights.
• Legal obligation — where the law requires us to keep or disclose information.

4. AI Features and Third-Party Processing

Some features use AI models. Stock research and market-content features work from public market data and news and do not send your personal information to AI providers.

If you use the simulator’s AI portfolio review, the holdings, cash balance and settings for the account you choose are included in a prompt that is sent to the AI provider you select (for example Anthropic, Groq, OpenAI or Google). If you supply your own API key, it is used only to make that request. Please do not include information in AI requests that you do not want those providers to process; their own privacy policies also apply.

Content published by stkmrkt (daily plans, stock picks, Diamond Finder, earnings analysis) is generated with AI and reviewed by us; it is not created from your personal data.

5. Who We Share Information With

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only as follows:

• Service providers acting on our behalf: Cloudflare (hosting, security, captcha, file storage), our database host, Resend (transactional and newsletter email), and Google (Google Analytics and Tag Manager if you consent; Google Sign-In if you use it).
• AI providers, only for features you explicitly use, as described above.
• Embedded content: when you play an embedded YouTube video, YouTube (Google) may set its own cookies.
• Legal and safety: authorities or other parties where required by law, to protect rights and safety, or to investigate abuse.
• Business transfers: a successor, if stkmrkt is involved in a merger, acquisition or sale of assets, subject to this Policy.

6. Cookies and Similar Technologies

We use cookies and browser storage in four groups. You choose which optional groups to allow in the cookie popup shown on your first visit, and you can change your choice at any time with Cookie Settings in the site footer.

• Strictly necessary (always on) — login session, your theme choice and a record of your cookie choices.
• Preferences (optional) — recent stock searches.
• Analytics (optional) — Google Analytics cookies (_ga, _ga_*) that count visitors and page views. Until you allow analytics, we signal “denied” to Google through Google Consent Mode, and Google Analytics sets no analytics cookies.
• Advertising and marketing — not used. We do not run ads or marketing pixels. This option exists so that any such feature added in future stays off until you allow it.

Withdrawing consent removes the related cookies and stored data from your browser. You can also block or delete cookies in your browser settings, though some features (such as staying signed in) will not work without the necessary ones.

7. How Long We Keep Information

We keep account and simulator data while your account is active. Login sessions expire after 7 to 30 days, and email verification and password-reset tokens expire automatically. Analytics data is kept according to our Google Analytics retention setting. Server and security logs are kept only as long as needed for security and troubleshooting. We may keep limited records longer where the law requires or to resolve disputes.

When you delete your account, we delete your profile and sign-in records. Paper-trading records associated with your account may remain in our systems until removed; you can ask us to remove them at any time at the address below.

8. Data Security

We use reasonable technical and organisational measures, including encrypted connections, hashed passwords and access controls. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and tell us right away if you suspect unauthorised access.

9. Your Rights and Choices

Depending on where you live, you may have the right to access, correct, delete, export (portability) or restrict the processing of your personal information, to object to certain processing, to withdraw consent, and to complain to your data-protection authority. California residents have the rights to know, delete, correct and opt out of sale or sharing under the CCPA/CPRA; as noted above, we do not sell or share personal information.

To use these rights, email hello@stkmrkt.com from the address on your account. You can also update your details and delete your account in your Account settings, change cookie choices in Cookie Settings, and unsubscribe from the newsletter using the link in any newsletter email. We will respond within the time required by applicable law (generally 30 to 45 days) and may need to verify your identity first. We will not discriminate against you for exercising your rights.

10. International Transfers

We and our service providers are based in or process data in the United States and other countries. If you are in the EEA, UK or another region with transfer rules, your information may be transferred to countries with different data-protection laws; where required we rely on appropriate safeguards such as standard contractual clauses.

11. Children

The Services are intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.

12. Changes to This Policy

We may update this Policy from time to time. We will post the revised version here with a new effective date, and for material changes we will give additional notice, such as a notice on the site or an email to account holders, before they take effect where the law requires it.