The fine print

Privacy Policy

Effective August 21, 2026

We collect the minimum needed to run the pond, and we never sell any of it. This page says exactly what that minimum is, where it goes, and how to take it back.

The short version

Signing in with Google gives us your email address, name and profile picture. That is how an account exists.
What you add — a watchlist, sector follows, a timezone, a game handle and your calls — is stored so the Service can work for you.
Your data is processed by Google Cloud (sign-in, database, analytics, hosting) and Resend (email). We never sell it and there are no ad networks on the site.
Every email has an unsubscribe link; push alerts and your profile's visibility are switches on your settings page; deletion is one button there, processed by a human.

1. What we collect

Your Google account: When you sign in with Google we receive your email address, your name and your profile picture. We never receive or store your Google password. The email address is the key for everything below.
Your preferences: Your watchlist (the tickers you follow), the sectors you follow, your alert switches, your timezone if you set one so the letter reads in local time, whether the game recap rides in your email, and whether you are subscribed to the morning letter.
The game: Your player handle, each of your calls (ticker, direction, time placed), how each call graded against the market and against the AI analysts, your points and streaks, and whether your profile is public.
Push alerts: If you turn on alerts, your browser creates a push subscription — an endpoint URL and encryption keys unique to that browser on that device. We store it with the watchlist it should alert on and a device label derived from your browser's name, so you can tell your devices apart and revoke one.
Feedback: If you use the feedback pill, we store the feedback text, the page you sent it from, your email if you were signed in (or the one you typed), and your browser's user-agent string.
How you found us: The first page you landed on and any campaign tags in its address (utm_source, utm_medium, utm_campaign) and the referring site's hostname, kept in your browser and attached to your account once, when you subscribe.
Usage analytics: We use Google Analytics to understand which pages get read: pages viewed, clicks on a few named controls, device type and approximate region. Its cookies are off until you allow them in the cookie banner; until then it runs without cookies and cannot tell one visit from the next. See Cookies.
Server logs: Like every website, our servers keep server logs of requests — the address requested, the time, your IP address and browser user-agent. Your IP address is also used for short-lived rate limiting on the feedback form.

2. How we use it

To run your account: sign you in, keep a session, show your watchlist and settings across devices.
To send you the morning letter, if you subscribed, and to personalise it with the names you follow.
To send flip alerts to the devices you turned them on from.
To run the game: grade your calls, keep your record, and — if your profile is public — show your handle and record on the board and on share pages.
To keep a public track record: the AI analysts' calls are logged and graded in public; your game calls are logged so your record is reproducible.
To understand how the site is used and to fix it when it breaks.
To answer you when you write to us.

We do not use your data for advertising, we do not build profiles of you for anyone else, and we do not make automated decisions about you that have legal or similarly significant effects.

3. Who processes it

We run on third-party infrastructure. These companies process data on our behalf under their own terms and security commitments:

Google Cloud — hosting, server logs, and the databases behind the site. Firebase Authentication handles Google sign-in; Firestore stores accounts, sessions, watchlists, subscriptions, push subscriptions, game profiles and feedback.
Google Analytics — usage analytics (see Cookies).
Resend — delivery of the morning letter and of account emails, which means Resend receives your email address and the content of each letter sent to you.
BigQuery (Google Cloud) — the analytical store for game records and the AI analysts' rating logs, which is how the public track record is computed.

4. How long we keep it

Account data (your Google profile fields, preferences, watchlist, subscriptions) — for as long as your account exists, and until a deletion request is processed.
Sessions — a sign-in session lasts 30 days and is renewed each time you use the site, so it ends 30 days after your last visit; signing out deletes it immediately.
Game records and rating logs — kept for the life of the public track record, because a record that can be quietly edited is not a record. When an account is deleted, your handle is removed from public surfaces; graded call rows may be kept in de-identified form so historical leaderboards still add up.
Push subscriptions — until you revoke them or the browser's endpoint stops accepting delivery, at which point we drop them.
Feedback — until it has been read and acted on.
Server logs and analytics — on our providers' standard retention schedules.

We never sell your personal information, and we do not share it with anyone for their own marketing. We share it only:

with the processors listed above, to run the Service;
publicly, only the parts you have chosen to make public: your handle and game record appear on the public board and on share pages only while your profile is set to public. Your email address is never shown publicly;
if the law requires it, or to protect the rights, safety or property of StreetAI, its readers or others;
with a successor if StreetAI is ever acquired or reorganised, under this same policy.

6. Your choices

Email. There is an unsubscribe link in every letter we send, and a morning-letter switch on your settings page. Either one stops the letter.
Push alerts. Each device you enabled is listed on your settings page and can be revoked there, one at a time; you can also turn alerts off with the bell, or in your browser's site settings.
Profile visibility. A switch on your settings page makes your handle and record private, which removes you from the public board and share pages.
Watchlist and preferences. Edit or clear them on your settings page at any time.
Deletion. Press "Request deletion" on your settings page. That files a deletion request; a human at support reviews it, removes your account data, and emails you when it is done. You can also email support@street.ai.
Access and correction. Email support@street.ai and we will tell you what we hold about you and fix anything that is wrong.

7. Cookies and local storage

Session cookie. Signing in sets one cookie that identifies your session. It is needed for the account to work.
Google Analytics cookies. These are off until you allow them. The cookie banner asks once; "Allow" lets Google Analytics set its own cookies to tell returning visits apart, "No thanks" keeps them off, and either way the site works the same. Without cookies, Google Analytics still receives anonymous, cookieless page pings that cannot be tied to you across visits. Your answer is remembered in your browser's local storage; to change it, Reset cookie choice and the banner asks again. Blocking the cookies in your browser also works.
Local storage. Your cookie choice, dismissed banners, display preferences and the how-you-found-us note live in your browser's local storage; apart from that note, which is attached to your account once when you subscribe, they stay on your device.

There are no ad networks, no advertising cookies and no cross-site tracking on StreetAI.

8. Children

StreetAI is not for anyone under 18. We do not knowingly collect personal information from anyone under 18; if you believe we have, email support@street.ai and we will delete it.

9. California privacy rights

If you live in California, the California Consumer Privacy Act (CCPA, as amended) gives you the right to know what personal information we collect and how we use and share it (this page), to access a copy of it, to ask us to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share your personal information for cross-context behavioural advertising, so there is nothing to opt out of. To exercise any of these rights, use the deletion button on your settings page or email support@street.ai; we will verify the request against the email address on the account.

10. Where your data lives

StreetAI is operated from the United States and hosted on Google Cloud in the United States. The Service is for US residents; if you use it from elsewhere, your data will be transferred to and processed in the United States, where privacy law may differ from your own country's.

11. Security

Sign-in is delegated to Google, so we never handle a password. Data in transit is encrypted, access to the databases is limited to the people who run the Service, and push delivery is encrypted end to end by the browser's push protocol. No system is perfectly secure; if we learn of a breach that affects you, we will tell you.

12. Changes

We will update this policy as the Service changes. The effective date at the top tells you which version you are reading; for a material change we will post a notice on the site or email subscribers before it takes effect.

13. Contact

StreetAI · 3901 Lick Mill Blvd, Santa Clara CA 95054 · support@street.ai — or reply to any morning letter.