Privacy

Last updated September 11, 2026

What it holds

• Your Google account identity — the email address and account identifier Google returns at sign-in, stored by Supabase Auth. WheelTheta never sees or stores your Google password.
• Your settings — expiry and delta preferences, exit thresholds, and optionally an account size used only to size positions. Account size is a sizing input, not a financial record: it is not displayed outside the settings page and is not written to any log.
• The positions you enter — the trades you choose to track, with the fills you record for them, and the marks computed against them.
• Billing state — subscription status and Stripe identifiers. Card details go to Stripe directly and never reach WheelTheta.
• A push subscription, only if you turn on notifications — the endpoint your browser issues, which is what an alert is delivered to. Turning notifications off removes it.

What it never holds

No brokerage connection, no brokerage credentials, and no account data of any kind from a broker — no balances, buying power, positions, orders or transactions.WheelTheta cannot place a trade and has nothing to place one with. See the disclaimer.

Who processes it

• Google — sign-in. WheelTheta receives an email address and an account identifier, and nothing else from your Google account.
• Supabase — the database and the authentication service. Everything in the list above is stored there.
• Stripe — payments. Card details are collected by Stripe on its own pages; WheelTheta stores only the identifiers needed to tell whether a subscription is active.
• Vercel — hosting, and privacy-friendly page analytics that count visits without cookies or cross-site tracking.
• Market data and filings vendors — prices, option chains, implied volatilities, economic series and SEC filings. These are queried about securities, never about you: no request to any of them carries a subscriber identity.
• Anthropic — the daily review pass reads the scored candidate list. It is sent symbols, scores and factor detail. No subscriber data is sent to it, and the review runs once for everybody rather than per account. The buttons on the scan page that open ChatGPT, Claude or another assistant open an empty chat for you to paste into; nothing is transmitted on your behalf.

Cookies

WheelTheta sets a session cookie so you stay signed in, and stores your color scheme and a couple of interface preferences in your browser. There are no advertising cookies and no third-party trackers.

How long it is kept

Your account data is kept while your account exists. Deleting your account removes your identity, settings, positions and push subscriptions. Billing records are retained by Stripe for as long as tax and accounting law requires, which is outsideWheelTheta’s control. The published candidate lists and the app’s own paper record are about securities rather than subscribers and are not affected.

Your choices

• Delete everything. The settings page deletes your account and the data above. It is immediate and there is no undo.
• Turn off notifications at any time, from settings or from your browser.
• Ask for a copy, or ask a question. Write to support@wheeltheta.com. Depending on where you live you may have rights to access, correct, export or restrict the use of your data; WheelTheta honors those requests from anyone who asks, rather than only from those who can cite a statute.

Security

Every table is protected by row-level security, so one account cannot read another’s rows even if the application were wrong. Traffic is encrypted in transit. No system is perfectly secure, and nothing here is a warranty that it is.

Children

WheelTheta is not for anyone under 18 and does not knowingly collect their data.

Changes

If this policy changes materially you will be told before the change takes effect, and the date at the top of this page will be updated.