Cookie Policy

WHAT ARE COOKIES

Cookies are small text files that are placed on your device (computer, tablet, or mobile phone) by a web server when you visit a website. They allow the website to recognize your device and remember certain information about your session.

In addition to cookies, websites can use localStorage — a browser-based storage mechanism that stores key-value pairs on your device. Unlike cookies, localStorage data is not transmitted to our servers on every request; it is read and written only by client-side JavaScript.

StockLens uses strictly-necessary cookies and localStorage items — those required for authentication, security, and storing your interface preferences — and, subject to your consent, analytics cookies (Google Analytics 4) and advertising cookies (Google Ads). Analytics and advertising cookies are managed through Google Consent Mode v2. Your advertising choice also governs the server-side advertising measurement we describe under “Server-side advertising measurement” below, which involves Meta, TikTok, and Reddit. Whether they start on (until you opt out) or off (until you opt in) depends on where you are browsing from — see “Cookie consent” below — and a choice you make in our cookie banner or the preferences below always overrides that regional default. Strictly-necessary cookies do not require consent.

COOKIES WE USE

The following cookies are set when you use StockLens:

The refreshToken, cf_clearance, and __cf_bm cookies are strictly necessary for the security and operation of the Website. The _ga, _ga_<container-id>, and _gcl_au cookies are analytics and advertising cookies that are set only while they are allowed for you — by your explicit choice, or by the regional default described under “Cookie consent” — and are not set if you decline. Durations shown are Google’s documented values and may be updated by Google over time.

LOCAL STORAGE

In addition to cookies, StockLens stores the following items in your browser's localStorage:

localStorage data is not transmitted to our servers on every request. It is read and written only by client-side JavaScript running on stocklens.com. Your browser’s session storage, which it clears when you close the tab, can also hold the campaign tags and click identifier of your landing address; whether the page saves them there depends on where you are and on your advertising choice: see “In your browser” under “Server-side advertising measurement” below.

THIRD-PARTY SCRIPTS

StockLens loads the following third-party scripts on the Website:

• Cloudflare Turnstile — A privacy-preserving bot verification tool that replaces traditional CAPTCHA. Turnstile confirms that requests originate from human users without tracking you across other websites or building an advertising profile. Cloudflare's privacy policy governs how Turnstile data is handled. This script is strictly necessary and loads regardless of consent.
• Google Analytics 4 (gtag.js) — Measures how visitors use the Website so we can improve it. Google Consent Mode v2 controls analytics storage. Analytics cookies are set only while analytics storage is allowed for you; limited measurement signals without these cookies may still be sent when it is denied.
• Google Ads (gtag.js) — Measures the effectiveness of our advertising and records conversions (such as sign-ups and subscriptions). Google Consent Mode v2 controls advertising storage and data-use signals. Advertising cookies are set only while advertising storage is allowed for you; limited measurement signals without these cookies may still be sent when it is denied.

We use Google Consent Mode v2: until you make a choice, Google’s analytics and advertising storage signals follow the regional default described under “Cookie consent” below — granted in the United States and in Canada outside Quebec, denied everywhere else — and your choice, once made, replaces that default. Google tags can still load when storage consent is denied. Cookie choices do not disable our own usage records or essential security processing; see the Privacy Policy. We do not load a Meta, TikTok, or Reddit browser pixel or tag, a LinkedIn Insight Tag, or other third-party tracking scripts beyond those listed above. Meta, TikTok, and Reddit do not set cookies on stocklens.com through StockLens; see “Server-side advertising measurement” below for what they receive from our servers.

SERVER-SIDE ADVERTISING MEASUREMENT

If you arrive from one of our ads and have allowed advertising cookies, StockLens may record the advertising click identifier in your landing address and later send a small number of conversion events from our servers (not from your browser) to the advertising platform that referred you. The platforms are Google Ads, Meta (Facebook and Instagram, through the Meta Conversions API), TikTok (through the TikTok Events API), and Reddit (through the Reddit Conversions API). We use this to measure which ads lead to sign-ups and purchases and to help those platforms improve ad delivery.

Click identifiers we may store. gclid, gbraid, and wbraid (Google), fbclid (Meta), ttclid (TikTok), rdt_cid (Reddit), and, for possible future use, ScCid (Snap) and msclkid (Microsoft). We store each with the date and time captured, the sanitized landing address, and your connection’s IP address and browser user agent, which the platforms use to match the event to the ad click.

Events we may send. A verified sign-up, completion of onboarding, completion of your first analysis, and a purchase. Each event includes the event name and time, a unique event identifier used to avoid counting it twice, the click identifier, your IP address and browser user agent, a one-way hashed (SHA-256) version of your email address, a hashed StockLens account identifier, and, for a purchase, the amount and currency. We do not send the content of your searches, analyses, portfolios, or payment card details.

Consent. We capture click identifiers, and send events about you, only if your advertising choice was on when the identifier was captured. This follows the regional defaults and Global Privacy Control rules described under “Cookie consent” below: advertising is off until you opt in in Quebec, the European Economic Area, the United Kingdom, Switzerland, and wherever we cannot determine your location. In the United States and in Canada outside Quebec, advertising is on until you opt out, so a missing choice there counts as on. Where it is off, we capture and send nothing. If you turn advertising off while signed in, we delete the identifiers stored for that purpose and cancel events not yet sent. If you turn it off while signed out or on another device, email support@stocklens.com and we will delete them on request; until then events can still be sent.

In your browser. Your landing address can carry a click identifier and campaign tags (the utm_ parameters). The page saves them in your tab’s session storage (the sl_ad_click_ids_v1 and sl_utm_first_touch items, which your browser clears when you close the tab). Where advertising is on until you opt out, it does so as soon as it has read your regional default, whatever you have chosen and whether or not your browser sends Global Privacy Control. Where advertising is off until you opt in, and when the page cannot read your regional default, it keeps them in its memory only and does not save them to your device unless you allow advertising; they are saved if you then allow advertising, and discarded if you decline. If you turn advertising off after allowing it, the click identifier is removed from your tab at once, and where advertising is off until you opt in, the campaign tags are removed with it; where advertising is on until you opt out, the campaign tags stay in the tab until you close it.

Retention. We remove the IP address and user agent stored with a click identifier after 30 days, and delete the click identifier record 90 days after we last saw that identifier. The Google click identifier saved on your account record for Google Ads attribution stays with the account until you ask us to delete it. We delete the content of each outgoing event 14 days after it is sent or abandoned, and keep a minimal delivery record (no email or IP address) for up to 180 days. Events already delivered are held by the receiving platform under its own policy: see the Meta, TikTok, Reddit, and Google privacy policies.

Stripe and the Google click identifier. If advertising cookies are allowed when you start a checkout, we pass the stored Google click identifier through the Stripe Checkout Session and its return address so Google can attribute your purchase to the ad click. Stripe therefore retains that identifier on the Checkout Session record under Stripe’s own retention practices, independently of the periods above.

COOKIE CONSENT

StockLens uses a regional consent model, applied through Google Consent Mode v2 based on the country (and, in Canada, the province) your connection is made from. Strictly-necessary cookies (authentication, security, and preference storage) load everywhere, because the Website cannot function without them. For analytics and advertising cookies:

• United States, and Canada outside Quebec — analytics and advertising cookies are on by default from your first visit, and you can turn them off at any time from the cookie banner, the “Manage cookie preferences” link in the footer, or the button below. If your browser sends a Global Privacy Control signal, we treat it as an opt-out and keep these cookies off unless you switch them on yourself.
• Quebec, the European Economic Area, the United Kingdom, Switzerland, and everywhere else — analytics and advertising cookies are off by default and are set only after you opt in. If we cannot determine where you are, we treat you as being in this group.

A consent banner appears at the bottom of the screen on your first visit. Whatever your regional default, a choice you make there is the one that applies. From it you can:

• Accept all — allow analytics and advertising cookies in addition to strictly-necessary cookies.
• Reject all — keep only strictly-necessary cookies; no analytics or advertising cookies are set. Google tags may still send limited measurement signals without these cookies, as explained in the “Third-party scripts” section above.
• Manage preferences — choose analytics and advertising independently.

Where advertising is off until you opt in, the banner and the preferences also name the advertising partners that may receive data if you allow advertising (Google, Meta and Reddit); every platform that can receive it is listed under “Server-side advertising measurement” above.

Your advertising choice also decides whether we capture click identifiers and send server-side advertising events about you. Your choice is stored in your browser (the sl-cookie-consent localStorage item) so we remember it and do not re-prompt you. Your explicit choice always overrides the regional default, and we honour it through Google Consent Mode v2. You can change your choices at any time using the button below or the “Manage cookie preferences” link in the website footer.

HOW TO CONTROL COOKIES

You can control cookies through your browser settings. Most browsers allow you to:

• View and delete individual cookies.
• Block cookies from specific websites.
• Block all third-party cookies.
• Clear all cookies when you close your browser.

Warning: If you delete or block the refreshToken cookie, you will be logged out of StockLens and will need to sign in again on your next visit. If you block strictly necessary cookies entirely, authentication will not function.

Browser-specific instructions for managing cookies:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

CONTACT

If you have any questions about this Cookie Policy or how we use cookies and localStorage, please contact us at support@stocklens.com.

For information about how we handle your personal information more broadly, see our Privacy Policy at https://stocklens.com/privacy-policy.