Summary
- We collect your email, your alert settings and the delivery channels you connect, plus limited security logs.
- We never ask about your finances, holdings or brokerage accounts, and we never ask for your phone number.
- PolrWolf never receives brokerage credentials or brokerage data, including when you connect an AI agent to both PolrWolf and a broker.
- We use only strictly necessary cookies: one keeps you signed in. No analytics or advertising cookies, pixels or session replay.
- We don’t sell or share personal information for advertising, and we honor Global Privacy Control.
- You can delete your account, and the data tied to it, at any time from settings.
This policy applies to polrwolf.com, PolrWolf alerts and the PolrWolf Telegram bot (the “Service”), operated by PolrWolf (“we,” “us”).
What we collect
Account information
Your email address and whether it’s verified. If you sign in with Google, we receive your Google account’s email address, name and a unique account identifier; we don’t receive your Google password or access to other Google data. We also store an optional display name, your time zone (for quiet hours), the version and time you accepted the Terms, and when you created your account and last signed in.
Alert settings
The assets and voices you follow, your Signal strictness and minimum agreement, heads-up and Contrarian mode choices, quiet hours, daily cap and email preferences. These are filters on public information; they say nothing about your money.
Delivery channels you connect
- Web push: the push subscription your browser creates (an endpoint address and encryption keys), your browser’s user-agent string, and delivery status.
- Telegram: your Telegram chat ID, your Telegram username if you have one, and when you linked it.
- Email: delivery status, bounces, complaints and unsubscribe status.
Alert history
A record of the alerts we sent or skipped for you: channel, content, status and time, so you can review them and so we can respect your daily cap.
Security and operational data
IP addresses and request details (such as time, requested page or endpoint, and user agent) in server logs, used to run, secure and debug the Service and to rate-limit abuse. When you request a sign-in link, we record the request time and IP address; sign-in links and codes themselves are stored only as one-way hashes and expire after 15 minutes.
AI agents you connect
If you connect an AI agent to the agent feed, we store the app’s name and client ID, the access you approved, when it was connected and last used, and its access tokens as one-way hashes. For every request to the agent feed, signed in or anonymous, we keep an audit record, described below.
Messages you send us
If you report a mistake or contact support, we keep your message and, if you give it, your email address, to respond and track the correction.
What we don’t collect
No financial information, holdings, income, investment goals, brokerage credentials, brokerage account numbers, positions, balances or orders, including through AI agents you connect. No phone numbers, contacts or precise location. No advertising identifiers. We don’t use analytics cookies, advertising pixels, session replay or third-party chat widgets.
Cookies and local storage
We use a single, strictly necessary session cookie (named __Host-pw_sid) to keep you signed in. It contains
a random identifier, is sent only over HTTPS, can’t be read by page scripts, and expires after 30 days without use or
when you sign out. If you choose “Continue with Google,” a second strictly necessary cookie holds a random security
value for up to 10 minutes while you sign in, to protect the sign-in against forgery. No third-party cookies are set on
our pages, and we don’t use cookies for analytics or advertising.
Your browser’s local storage may hold display preferences you choose on the site, such as the colorblind-safe color setting. These stay on your device and aren’t sent to us.
How we use information
- To provide the Service: sign you in, save your settings, and send the alerts, digests and sign-in emails you ask for.
- To keep it safe and reliable: prevent abuse and fraud, enforce rate limits, fix problems, and measure delivery success in aggregate.
- To respond to you: support requests, corrections, removal and privacy requests.
- To meet legal obligations and enforce our Terms.
We don’t sell personal information, use it for targeted advertising, or build profiles about your finances. Your filters are applied to the same public data everyone sees; we make no decisions about you that have legal or similarly significant effects.
Service providers
We use a small number of providers who process data on our behalf under contract, only to run the Service:
- Google Cloud: hosting for our servers.
- Supabase: database hosting.
- Google: “Continue with Google” sign-in, if you use it.
- Resend: email delivery for sign-in emails, alerts and digests.
- Telegram: message delivery, if you connect Telegram.
- Your browser’s push service (for example Apple, Google, Mozilla or Microsoft): push delivery, if you turn it on. Push content is encrypted end to end between our servers and your browser.
The AI model that labels public posts (currently xAI’s Grok) receives only public posts and never your personal information. Market-data providers receive no personal information.
When we share
Beyond the providers above, we share personal information only if you ask us to, if required by law or valid legal process, to protect the rights, safety or property of PolrWolf, our users or others, or as part of a merger, acquisition or transfer of the Service, in which case we’ll tell you before your information becomes subject to a different policy.
Retention and deletion
We keep account information, settings, connected channels and alert history while your account exists. When you delete your account in settings, we permanently delete your account and the data tied to it, including settings, push subscriptions, Telegram link and alert history. Two things may remain: if you unsubscribed or an email to you bounced, we keep your email address on a suppression list so we never email you again; and data in encrypted database backups is overwritten on the backup provider’s normal cycle. Deleting your account also revokes every AI agent you connected. Agent-feed audit records are kept for 5 years, with IP addresses removed after 30 days (see AI agents and the agent feed). Security logs are kept for a limited period and then deleted. Sign-in links expire after 15 minutes.
Your choices and rights
You can change your settings, turn off any channel, unsubscribe from email with one click, and delete your account at any time. You can also email support@polrwolf.com to ask for a copy of your data, to correct it, or to delete it.
Depending on where you live (including California, Colorado, Connecticut, Virginia and other states with privacy laws), you may have the right to know and access the personal information we hold about you, to correct it, to delete it, to get a portable copy, and to opt out of the sale or sharing of personal information, targeted advertising and certain profiling. We don’t sell or share personal information and don’t use it for targeted advertising or such profiling. We don’t use sensitive personal information to infer characteristics about you.
To make a request, email us from the address on your account. We’ll verify it’s you by confirming through that address, and respond within 45 days. You can use an authorized agent with your signed permission. If we deny a request, you can appeal by replying to our decision; if you’re still not satisfied, you can contact your state attorney general. We will never treat you differently for exercising your privacy rights.
Global Privacy Control and Do Not Track
We honor Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as a request to opt out of the sale or sharing of your personal information for that browser and, if you’re signed in, for your account. Because we don’t sell or share personal information, our practices are already the same either way.
Do Not Track: PolrWolf doesn’t track you across third-party websites over time, and doesn’t allow third parties to collect personal information about your online activity on our site. We therefore handle every visit the same way, whether or not your browser sends a Do Not Track signal.
AI agents and the agent feed
PolrWolf offers a read-only feed that AI agents can access. It serves only information that’s already public on polrwolf.com. PolrWolf never requests, receives or stores brokerage credentials, tokens, account numbers, positions, balances or orders, and the feed rejects any request that tries to send financial details (we log only the name of the rejected field, never its value).
Audit log. For each agent-feed request we record the time, your account (or “anonymous”), the agent’s client ID, the tool used, the filters requested, which publications were returned, a fingerprint (hash) of the output, the version of the notice sent with it, the names of any rejected fields, and the IP address. We keep this to show that everyone with the same filters received the same output and that no one received anything before it was published. IP addresses are deleted after 30 days; the rest of each record is kept for 5 years.
Your AI provider and your broker. Your conversations with your agent stay with your AI provider (such as Anthropic, OpenAI, xAI or Cursor), and your brokerage connection stays between you, that provider and your broker, under their own policies. PolrWolf receives only the feed requests your agent sends.
Your controls. See and revoke connected agents in settings at any time; revoking takes effect immediately.
Web push
Push alerts are sent only after you turn them on and your browser asks for permission. We store your browser’s push subscription to deliver them. You can turn push off in settings or revoke the permission in your browser at any time; we delete subscriptions that the push service reports as expired.
Telegram bot
The PolrWolf bot can message you only after you start it from the one-time link in your settings. When you link it, we store your Telegram chat ID, your username if you have one, and the time you linked. The bot processes the commands you send it (such as /start, /pause, /resume, /help and /stop) to manage your alerts; it doesn’t read your other chats, contacts or groups. Send /stop or unlink Telegram in settings to stop messages; unlinking or deleting your account removes the link. Telegram’s own privacy policy applies to your use of Telegram.
Sign-in emails are sent when you request them. Alert and digest emails are sent only if you turn them on, and every one has a one-click unsubscribe link that takes effect immediately. We use delivery events from our email provider (such as bounces and spam complaints) only to keep our suppression list accurate.
YouTube API Services
PolrWolf uses YouTube API Services to read public video titles and descriptions from tracked channels. We don’t access your YouTube or Google account through these services. See the YouTube Terms of Service and the Google Privacy Policy.
Security
All traffic uses HTTPS. Session identifiers are random, sign-in links and API tokens are stored only as hashes, and access to production systems is limited. No system is perfectly secure; if a breach affects your personal information, we’ll notify you as the law requires.
Children
The Service is only for adults 18 and older. We don’t knowingly collect personal information from anyone under 18; if we learn we have, we delete it.
Where data is processed
The Service is offered only in the United States, and our servers are hosted in the United States. Some providers, such as Telegram, may process data in other countries under their own policies when you choose to use them.
Changes
We’ll update the effective date above when this policy changes. For material changes, we’ll notify you by email or on the site before they take effect.
Contact
Privacy questions and requests: support@polrwolf.com.