Privacy Policy

The short version

1. What we collect

You give us

Email address

WhenSign-up, sign-in, a waitlist

WhyTo create your account, sign you in, send you your results, send account holders occasional news and offers, and, for a waitlist, send one email when it opens

Specifications and job history

WhenEvery screen you run

WhyTo run the screen and show you your results

What you type into the research desk, and its answers

WhenWhen you use it

WhyTo turn your idea into a specification and answer your questions about it. While you are signed in, each conversation is saved to your account so the same conversation opens on any device you sign in on (with its draft specification and the screens started from it; what you type but do not send is not saved, and a draft started in that browser before you signed in joins your saved conversation), and each question and its answer are kept with your account so the desk can take your earlier questions into account (see How long we keep it)

A funded account’s starting balance and rules

WhenOnly if you order the funded-account report

WhyTo compute that report, and nothing else

The email you gave at checkout, and your Sierra Chart account name for a study delivered to that account

WhenOnly if you buy a paid Sierra Chart study

WhyTo send you the download link for a study delivered as a download; to enable a study on your Sierra Chart account, tell you when it is enabled, and remove it if the purchase is refunded

Your browser’s push address

WhenOnly if you turn on notifications on your account’s Notifications page

WhyTo tell that browser a screen has finished; the notification carries no content

A password, two-factor codes or a passkey

WhenOnly if you choose to add one

WhyTo sign you in; we keep only what is needed to check them, never the password or the passkey’s secret (see Security)

Problems you report from your account

WhenWhen you use Report a problem

WhyTo answer you: we keep the category, your message and the replies, the page or screen it is about, and your browser’s description

A reason and comment for cancelling

WhenOnly if you give them when you cancel

WhyPassed to Stripe with the cancellation, to understand why people leave; the reason you pick (not the comment) is also kept in the security log

The page you joined a waitlist from, and any note you add

WhenOnly if you join one

WhyTo send you one email when it opens

Support messages

WhenWhen you write to us

WhyTo answer you

Publication consent

WhenIf you say yes on a report

WhyTo publish the idea in our research notes, as the Terms describe

Your payment provider gives us

Your email, your subscription and its status, your invoices, and your card’s brand, last four digits and expiry date, which your account’s Billing page shows. Stripe also holds the billing address and any tax ID you give at checkout. We never receive or store your full card number.

We collect automatically

IP address, browser and device type, pages viewed, referring page and timestamps. We read the country your connection comes from, as our host reports it, only to decide whether to ask before using analytics; we do not store it. Usage is measured with Google Analytics, and only with your consent where the law asks for it (see Cookies). Google Analytics does not log or store IP addresses; it derives an approximate location from them. It counts page views and a few steps in the product, such as starting a screen, and reports them to us in aggregate. The addresses of private pages (a report, a shared verdict, a sign-in link) are sent masked, so Google never receives the id or token in them, nor a report's title. When you sign in, fail to sign in, or change how your account signs in, we also record it in a security log (see Security).

We do not collect

Your net worth, income, broker, positions, trading results, or any other financial circumstance, with one exception. If you order the funded-account report, you give us that account’s starting balance and its rules (the drawdown threshold, loss limits, payout terms and fees). We use them only to compute that report, and they are kept with it. We do not ask for anything else and you should not send it. If you send it in a support email we will delete it.

2. Why we use it

• To provide the service: run your screens, show your reports, keep your credit balance.
• To bill you and prevent payment fraud.
• To send email about your account: sign-in codes and links, security notices (a new password, a sign-in from a new device), and account notices (a screen queued, credits running low, a cancellation or resumption, a problem report received, a payment that needs attention, a deletion confirmed). You cannot turn these off while you have an account, because they are the service. Your screens’ results also come by email unless you turn them off.
• To send account holders occasional news and offers about Waypoint Quant by email. Every account receives them unless it says no. Where we ask for your address before the research desk or the free screen, verified by a six-digit code we send, a box beside it, ticked unless you untick it, lets you say no at once, and we keep a record of the box and when you confirmed the address. Every one has a one-click unsubscribe, and unsubscribing changes nothing else about your account.
• You can turn each kind of optional email (screen results, news and offers) on or off on your account’s Notifications page, and every optional email carries a one-click unsubscribe. Once an address unsubscribes from a kind of email, it goes on a do-not-email list so that kind of email is not sent to it again, including after the account is deleted. Our email provider may also stop delivering to an address that bounces or reports our email as spam.
• To operate and improve the service, including aggregate statistics about how many screens have been run and what fraction passed. Our staff may read questions to the research desk and its answers, to fix and improve it.
• To keep the service secure, detect abuse, and enforce our Terms. To keep free use fair, we review it per mailbox: the questions, screens and model cost it has used, when it was verified, and whether accounts share a network or are aliases of one mailbox, which we see only as keyed fingerprints. We may block free use for a mailbox.
• To comply with law and to establish or defend legal claims.

Where the law requires a legal basis: we rely on performance of a contract for the first three, legitimate interests for improvement, security, abuse prevention, aggregate statistics and news and offers to account holders (which you can object to at any time by unsubscribing), consent for publication and for analytics cookies where the law asks for it, and legal obligation where one applies.

3. The research record

Every menu screen run through the site is counted in our internal research record and in the aggregate statistics we publish, such as how many specifications have been tested and how many passed. Only counts and aggregate statistics are published. A screen run on the site is never listed in the public ledger, the searchable table of our research record: it is part of the totals and nothing more. Screens written in the Strategy Language are not yet counted. Your identity and your parameters are never published unless you separately opt in.

4. Who we share it with

We share personal information only with service providers that help us run the business, and only for that purpose.

Stripe

PurposePayments, subscriptions, tax

DataEmail, billing details, purchase history

Vercel

PurposeWebsite hosting

DataRequests, IP, logs

Neon

PurposeDatabase

DataAccount, jobs, results

Resend

PurposeEmail: transactional, and news and offers

DataEmail address, message content

Anthropic

PurposeThe AI model behind the research desk

DataWhat you type into the desk, your earlier questions to it, the specification it builds, and a finished screen’s result when it writes the read under a report; no payment data

Google (Google Analytics)

PurposeUsage analytics, with your consent where the law asks for it; never advertising

DataMasked page addresses, page views and product events, device and browser, approximate location; kept 14 months

Your browser’s push service (Google, Apple, Mozilla or Microsoft, depending on your browser)

PurposeOnly if you turn on notifications: tells your browser a screen has finished

DataYour browser’s push address; the notification carries no content

If you make a share link to a report, anyone you give it to sees what the Terms describe: the verdict, the gate that decided it, the market and the rules, never your name or address. Shared pages are not offered to search engines.

We also disclose information if the law requires it, to enforce our agreements, to protect rights and safety, and to a buyer if the business is sold, in which case we will tell you before your information becomes subject to a different policy.

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are used in United States state privacy laws.

5. How long we keep it

Account and email

RetentionWhile your account is open; deleted when you delete your account, except as listed under Your rights

Specifications and reports

RetentionWhile your account is open, so you can come back to your research. When you delete your account, your screens stay in the research record without your name, address or words

The de-identified statistical record of a screen

RetentionIndefinitely, because the integrity of our published pass rate depends on the count never being edited

Research desk conversations saved to your account

Retention90 days after the conversation’s last activity (opening it counts), or sooner if you delete it on your account’s Conversations page or delete your account

Your questions to the research desk and its answers, kept with your account

RetentionWhile your account is open

The research desk’s conversation in your browser

RetentionUp to 7 days in that browser; cleared when you sign out. A Strategy Language draft, with the first message you typed for it, stays in that browser for its 7 days

Problems you report from your account, and the replies

RetentionWhile your account is open

A waitlist sign-up (your address, the page you joined from and any note)

RetentionUntil you ask us to delete it, or delete an account with that address

Study orders (the email and Sierra Chart account name given at checkout, the study, the amount and the payment reference)

Retention7 years, as records of the sale, also after your account is deleted

The security log

Retention400 days, also after your account is deleted, under an anonymous account number

Signed-in devices (each with its browser description, how you signed in and a keyed fingerprint of its network address)

RetentionUntil you sign out, after 14 days without use, or 45 days after you signed in, whichever comes first; a session opened at a signed-out checkout lasts 24 hours

A password hash, two-factor keys and passkeys

RetentionUntil you remove them or delete your account

A change of email address (the old and new address)

Retention90 days after the change

Your browser’s push address

RetentionUntil you turn notifications off, sign out of that browser, or delete your account

The do-not-email list

RetentionIndefinitely, also after your account is deleted, so an address that asked for no more email gets none

The free plan’s desk allowance for your mailbox (the questions and model cost it has used), under a keyed fingerprint rather than your address

RetentionIndefinitely, also after your account is deleted, so the free allowance is given once per mailbox

A block on free use for a mailbox, under the same fingerprint

RetentionUntil we lift it

Counters that limit how often one network address can use the site, under a keyed fingerprint rather than the address

RetentionAbout 2 days

Records of actions our staff take on your account (a credit adjustment, a refund, a suspension)

Retention3 years

Invoices and tax records

Retention7 years, as required

Support email

Retention24 months

Server logs

Retention90 days

Deleting your account removes your identifying information, except what Your rights lists. It does not remove the anonymous fact that a screen was run, because removing it would falsify the statistics we publish.

6. Security

Data is encrypted in transit. Access to production systems is limited to people who need it. No system is perfectly secure and we cannot guarantee absolute security. If a breach affects you we will notify you as the law requires.

Signing in

You sign in by a link or a six-digit code we email you, and email sign-in always keeps working. Your account may also offer these optional ways to sign in or to protect it:

• A password. We never store the password itself: we store a one-way hash of it (scrypt), made with a secret key kept apart from our database, so a copy of the database alone does not reveal it. When you set a password, we check it against Have I Been Pwned’s public list of passwords exposed in other services’ breaches by sending only the first five characters of a one-way (SHA-1) hash of it, never the password. You can remove the password at any time, which deletes the hash.
• Two-factor codes. Then every sign-in, after the email link, code or password, also asks for a six-digit code from an authenticator app on your phone, or, where offered, one of the backup codes we show you once. To check those codes we keep the app’s secret key and any backup codes, encrypted with a key kept apart from our database; we never see your phone or your app. You can turn two-factor codes off at any time, which deletes them.
• Passkeys. Your phone or computer signs you in with its own lock (fingerprint, face or PIN). The secret part of a passkey never leaves your device, or the service that syncs your passkeys: we keep only its public key, which cannot sign anybody in, with the name you give it, when you added it and when it last signed you in. You can remove a passkey at any time, which deletes it.

Signed-in devices

Each device you sign in on keeps a session that holds its browser description, how you signed in and a keyed fingerprint of its network address, never the address itself.

The security log

To protect your account and detect abuse, we keep a record of sign-ins, failed sign-in attempts and sign-outs; of each time we confirm it is you; of changes to how your account signs in (a password, two-factor codes or a passkey added or removed); and of other changes to the account: its email address or email settings, a report shared or unshared, a problem reported, a subscription cancelled or resumed, a payment refunded or disputed, a copy of its data made, and actions our staff take on it. Each entry holds what happened and when, the account, your browser’s description (as your browser sends it), and a keyed fingerprint of your network address made with a secret key, never the address itself; an email address in it is masked. A failed attempt to sign in with your address is recorded in your account’s log. You can see the last 90 days of your own log on your account’s Security page. We keep entries for 400 days, also after the account is deleted, under an anonymous account number.

7. Your rights

Depending on where you live you may have the right to know what we hold about you and get a copy, correct it, delete it, object to or restrict certain processing, withdraw consent you previously gave, opt out of sale or targeted advertising (which we do not do anyway), and not be discriminated against for exercising any of these.

To exercise any of them, email support@waypointquant.com from the address on your account, or write to 100 N Howard St, Ste R, Spokane, WA 99201. We verify your identity through your account email and respond within the time the law allows, normally 45 days. You can use an authorised agent where the law permits.

A copy of your data

When you ask for a copy, we send you one file with what your account holds: your address and plan, your email settings and do-not-email entries, your credit history, every screen with its specification, your own words and its verdict, the inputs you gave to add-ons, your saved research desk conversations, your questions to the desk and its answers, the problems you reported, your security log, your signed-in devices, whether two-factor codes are on, and your passkeys’ names and dates. It never contains a password hash, a key, a secret or a network address.

Deleting your account yourself

You can delete your account from your account’s Profile page, after we confirm it is you (by a code we email you, or by your password or two-factor code if you use one). Deleting ends any subscription at once, without a refund for the current period (see the Refund Policy), signs you out everywhere, and deletes your account, your sessions, credits, saved conversations, questions to the desk, problem reports, waitlist sign-ups, push addresses, password, two-factor codes and passkeys. Your screens stay in the research record without your name, address or words, and you can no longer open them. We then email your address once to confirm, and keep only:

• your address on our do-not-email list, so we never write to it again;
• the security log of your account’s sign-ins and changes, under an anonymous number and no longer than 400 days;
• the free plan’s desk allowance used by your mailbox, and any block on free use for it, under a keyed fingerprint, never your address;
• your study orders, as records of the sale, for 7 years;
• the records of actions our staff took on your account, under an anonymous number, for 3 years;
• the customer record our payment processor keeps, marked deleted, with your address and invoices, as tax law requires.

If you are in the EEA or UK and think we have handled your data badly, you may complain to your local supervisory authority. If you are in California you may also have rights under the CCPA as amended; we do not sell or share your personal information.

8. Cookies and storage in your browser

Cookies the site needs

__Host-pc_session keeps you signed in (HttpOnly; it ends with your session, at most 45 days). wp_in tells the page you are signed in, holds nothing else, and lasts as long as the session. wp_box keeps the news-and-offers box you chose while we email you a sign-in code (signed, HttpOnly, holding the box and not your address, kept for up to 80 minutes and deleted once the code is typed). wp_run ties a Run link we email you to the browser that asked for it (a random identifier, kept for up to 30 days). __Host-wp_co ties a checkout you start while signed out to your browser when you come back from Stripe (HttpOnly, 1 day). wp_consent remembers your analytics choice (13 months).

Counting a step

When you sign in or pay, the site sets wp_evt for up to two minutes, naming that step so the analytics can count it if you have accepted analytics. It holds nothing about you, is deleted as soon as it is read, and nothing from it reaches Google unless you have accepted.

Analytics cookies

Google Analytics sets _ga and _ga_<id>, kept 13 months, to tell one visit from another. In the EEA, the UK and Switzerland, and wherever we cannot tell your country, they are set only after you choose Accept on the banner. Elsewhere they are set unless you say no. You can change your choice at any time with Cookie settings at the foot of every page, which deletes them. If your browser sends Global Privacy Control, we treat it as a no and set none. Google signals and ad personalisation are off, and nothing is used for advertising. We do not run third-party advertising or social media trackers.

Storage in your browser

The site also keeps a few things in your browser’s local storage and session storage: the research desk’s current conversation (7 days; signing out clears it), a Strategy Language draft with the first message you typed for it (7 days), a report’s assistant conversation and your analytics region while the tab is open, the app’s back history while the tab is open, the date you dismissed the install prompt, and the site’s icon for offline use. They stay in your browser; the desk’s conversation reaches us only as you send it.

9. International transfers

We are based in the United States and process data there. If you are outside the United States, using the service involves transferring your information to the United States, where privacy laws differ from your own. Where required we use standard contractual clauses or another approved mechanism with our providers. Google, which provides our analytics, is certified under the EU–US Data Privacy Framework and its UK and Swiss extensions.

10. Children

The service is not for anyone under 18 and we do not knowingly collect information from children. If we learn we have, we will delete it.

11. Changes

We may update this policy. The current version is always at waypointquant.com/privacy with the date at the top. If a change is material we will email you before it takes effect.

12. Contact

Waypoint Quant LLC, 100 N Howard St, Ste R, Spokane, WA 99201, support@waypointquant.com