Privacy Policy
Last updated: July 26, 2026
OwlScore, a fully owned company of CarmeAI ("we," "us"), operates the OwlScore website and Service. This policy describes what personal data we collect, how we use it, and your choices.
1. Data we collect
- Account data: email address, and password hash if not using magic-link/OAuth (via Supabase Auth).
- Usage data: watchlist tickers, saved scans, natural-language scanner queries, feature usage — collected to operate the Service (e.g., render your watchlist) and to improve it.
- Billing data: for Pro subscribers, Stripe processes and stores your payment method; we do not receive or store full card numbers. We retain your Stripe customer ID, plan, and billing history.
- Analytics data: aggregate, privacy-friendly analytics via Plausible (or self-hosted Umami), which does not use cookies or track individuals across sites.
- Communications data: if you email us, we retain that correspondence.
We do not collect brokerage account credentials, portfolio holdings, or financial account information — OwlScore does not link to brokerage accounts (see Disclaimer §2).
2. How we use data
- Operate and maintain your account, watchlist, and subscription.
- Send transactional email (weekly scorecard, score-change alerts, billing notices) via Resend.
- Improve the Service (aggregate usage patterns, not individual profiling for advertising — we do not run ads or sell data).
- Detect abuse and enforce our Terms of Service.
- Comply with legal obligations.
3. Data sharing (subprocessors)
We share data with the following categories of service providers, solely to operate the Service:
| Provider | Purpose | Data shared | |---|---|---| | Supabase | Database, authentication | Account data, usage data | | Stripe | Payment processing | Billing data (Stripe is PCI-compliant; we never see full card numbers) | | Resend | Transactional email | Email address | | Anthropic | LLM-powered scanner and research memos | Your natural-language query text; ticker context (not your identity) | | Tiingo / SEC EDGAR | Market data | Inbound market data only (no user data shared) | | Plausible / Umami | Privacy-friendly analytics | Aggregate, non-personally-identifying usage data | | Vercel | Hosting | Standard request logs (IP address, for security/abuse purposes) |
We do not sell your personal data. We do not share individual watchlists or query history with any third party except as listed above or as required by law.
4. Cookies and tracking
We use only essential cookies for authentication (session management via Supabase Auth). Our analytics provider does not use cookies or cross-site tracking.
5. Data retention
We retain account data for as long as your account is active, plus 12 months after closure for legal/accounting purposes, unless you request earlier deletion (see §6). Aggregate/anonymized usage data may be retained indefinitely.
6. Your rights
Depending on your jurisdiction, you may have the right to:
- access the personal data we hold about you,
- request correction or deletion of your data,
- export your data in a portable format,
- object to or restrict certain processing.
To exercise these rights, contact support@carmeai.com. We will respond within 30 days.
7. Children's privacy
The Service is not directed to individuals under 18. We do not knowingly collect data from anyone under 18.
8. Security
We use industry-standard measures (encryption in transit, access controls via Supabase Row Level Security) to protect your data, but no system is perfectly secure. Notify us at support@carmeai.com if you believe your account has been compromised.
9. International data transfers
We host our servers and database within the United States. If you access the Service from outside the United States, you consent to the transfer and storage of your personal data in the United States.
10. Changes to this policy
We may update this policy from time to time. Material changes will be notified via email or in-app notice.
11. Contact
Questions about this policy or your data: support@carmeai.com.