Privacy Policy
01What we collect
| Data | What it is & why we have it |
|---|---|
| Email address | Your subscription identity. Used for login/access, billing receipts, service notices, and support. It's the one piece of contact data Sigma keeps. |
| Billing — via Stripe | Payments run entirely on Stripe. Your card number never touches Sigma's servers and we cannot see it. We keep only what Stripe reports back: subscription status, invoice/charge history, and similar billing metadata tied to your email. |
| API key hash | We store your API key only as a SHA-256 hash labeled by your email. We can verify your key when you use it, but we cannot read or recover the key itself — lost keys are reissued, not recovered. |
| Server logs / IP | Standard request logs (IP address, timestamp, endpoint) kept for rate limiting, abuse prevention, and debugging. Not used to profile you. |
| Discord user ID | Only if you link your Discord account for members-only role sync. We store the ID to grant/revoke the role; unlink it and it goes. |
| Support email | If you email support, we keep the correspondence so we have context next time. |
02What we don't do
- We don't sell your data. Not to anyone, not "share for value," not anonymized-and-bundled. Ever.
- No ad tracking. No advertising pixels, no third-party ad networks, no cross-site trackers on the service.
- No card data. Stripe holds it; we never do.
- No behavioral profiles. Logs exist to keep the service up and fair, not to build a picture of you.
03Cookies & your browser
A trust point worth spelling out: your watchlist lives in your browser's localStorage, on your machine. It is never transmitted to Sigma's servers — we genuinely cannot see which tickers you watch.
The app sets no advertising or analytics cookies. It sets exactly one functional cookie: sigma_s, a signed member-session token created when you log in with your access key. It exists so you stay signed in (up to 30 days), it is HttpOnly and never readable by page scripts, and it contains no personal information — only a hashed reference to your access key. Log out and it is deleted.
04How we use what we have
- Operate the service: authenticate you, sync your Discord role if linked, serve the API against your key.
- Bill you correctly and handle refunds or disputes via Stripe.
- Answer support and honor deletion requests.
- Protect the service: rate limiting, abuse and fraud prevention.
- Send service email: receipts, billing and terms notices, material product changes. Occasional product updates may be sent to subscribers; every non-essential email has an unsubscribe that works. No third-party marketing, ever.
05Third parties that touch data
| Party | What they get |
|---|---|
| Stripe | Payment processing: your card and billing details, under Stripe's own privacy policy. This is the only place your payment data lives. |
| Discord | Only if you link it: role assignment on the members-only server, under Discord's own terms and privacy policy. |
| Hosting provider | Runs the servers, so requests (and therefore IPs/logs) pass through its infrastructure. Hostinger (VPS hosting). |
| Email provider | Delivers receipts and service notices to your address. Stripe sends billing emails; support correspondence runs through Google (Gmail). |
| Market-data providers | Supply the price data Sigma analyzes. They receive nothing about you — traffic to them carries no subscriber data. |
We disclose data beyond this list only if legally compelled (e.g., a valid legal request), and we keep no partners beyond those needed to run the service.
06Retention
- Account data (email, key hash, Discord ID): kept while you're a subscriber; deleted on account deletion, except as below.
- Server logs: rotated on a short cycle — approximately 90 days.
- Billing records: kept as long as tax and accounting law requires (typically up to 7 years), even after deletion — that part isn't optional for us.
07Deletion & your choices
- Email americanacrypto@gmail.com from your subscription address to delete your account and data. We'll confirm and remove your email, key hash, Discord link, and support history — everything except legally required billing records.
- Unlink Discord anytime; the stored ID is removed.
- Ask the same address for a copy of the data we hold on you — it's short, and you're entitled to see it.
- Unsubscribe from any non-essential email via its unsubscribe link.
08Security
Proportionate and honest: traffic is encrypted in transit (HTTPS), API keys are stored only as hashes, card data is outsourced to Stripe entirely, and the amount of personal data held is kept deliberately small — the best protection for data is not holding it. No system is unbreakable; if a breach ever affects your data, we'll notify you by email as required by law.
09Children
The service is for adults: 18+. We don't knowingly collect data from anyone under 18; if that happens, we delete it.
10Changes to this policy
If this policy materially changes, we'll email you before the change takes effect and update the effective date above. Continued use after that date means you accept the updated policy.
11Contact
Privacy questions, deletion requests, anything: americanacrypto@gmail.com.