Privacy Policy

1. Introduction

CNC Conviction OS (“CNC”, “we”, “us”) is a financial research and analysis tool. This Privacy Policy explains how we collect, use, and protect your information when you use our web and mobile applications.

Important: CNC is not a financial advisor, broker-dealer, or investment company. CNC provides data analysis tools only. Nothing in CNC constitutes financial, investment, tax, or legal advice.

2. Information We Collect

Account Information

• Email address (for authentication)
• Hashed password (bcrypt, never stored in plaintext)
• Account creation date

Usage Data

• Watchlist selections (tickers you choose to track)
• Portfolio preferences and display settings
• Application settings (language, theme, notification preferences)
• Feature usage patterns (pages visited, features used)

Information We Do NOT Collect

• Brokerage account credentials or connections
• Bank account or payment card numbers
• Social Security numbers or government IDs
• Actual trading or transaction data
• Location data or device identifiers

3. How We Use Your Information

• Authenticate your account and maintain your session
• Display your personalized watchlist and portfolio analysis
• Send notifications you have opted into (conviction changes, signals)
• Improve application performance and fix bugs

We do not use your data for advertising, profiling, or selling to third parties.

4. Data Storage & Security

• Database: Neon PostgreSQL with encryption at rest (AES-256)
• Authentication: JWT tokens stored as HttpOnly, Secure, SameSite cookies
• Passwords: Bcrypt-hashed with per-user salt (never stored or transmitted in plaintext)
• Transport: All connections use TLS 1.3
• API security: CSRF protection, rate limiting, input validation on all endpoints

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days. Aggregated, anonymized analytics data may be retained indefinitely.

6. Third-Party Data Sharing

We do not sell, rent, or trade your personal information, and we do not share it with third parties for advertising or marketing purposes. We have never done so.

We use the service providers below to operate CNC. Each acts as a processor on our behalf, is bound by its own privacy policy and by a data processing agreement, and may use your data only to provide its service to us. This list is exhaustive as of the date at the top of this page.

We also obtain market and company data from Polygon, FRED, SimFin, Alpha Vantage and public SEC filings. These are sources we read from, not recipients of your data: we send them company identifiers such as ticker symbols, and they receive no information about you.

Beyond the providers above, we disclose personal data only:

• Legal requirements: when required by law, subpoena, or court order
• Safety and fraud: to investigate or prevent fraud, abuse, or threats to the security of the service or its users
• Business transfer: if CNC is involved in a merger, acquisition, or sale of assets, your data may transfer to the successor entity, which would remain bound by this policy until you are notified of any change

If we add, remove, or change a provider that processes your personal data, we will update this section and the date at the top of this page. Where the change materially affects how your data is handled, we will notify you by email before it takes effect.

7. Your Rights

All Users

• Access your personal data via the Settings page
• Update or correct your information at any time
• Delete your account and all associated data
• Export your watchlist and portfolio data

California Residents (CCPA)

You have the right to:

• Know what personal information we collect and why
• Request deletion of your personal information
• Opt out of the sale of personal information (we do not sell personal information)
• Non-discrimination for exercising your CCPA rights

EU/EEA Residents (GDPR)

In addition to the above, you have the right to:

• Data portability (receive your data in a structured format)
• Restrict processing of your personal data
• Object to processing based on legitimate interests
• Lodge a complaint with your local data protection authority

Our legal basis for processing is contract performance (providing the service you signed up for) and legitimate interest (improving the application).

8. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users via email within 72 hours of discovering the breach, in accordance with GDPR and applicable state laws.

9. Children's Privacy

CNC is not intended for users under 18 years of age. We do not knowingly collect personal information from minors. If we learn that we have collected data from a minor, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or in-app notification. Continued use of CNC after changes constitutes acceptance of the updated policy.

11. Contact

For privacy-related inquiries, data access requests, or to exercise your rights under CCPA/GDPR, contact us at:

privacy@cncconviction.com