Privacy Policy

About this policy

Stock Lens Inc. ("StockLens", "we", "us") operates StockLens, a stock research platform, and is responsible for the personal information described here. We are based in Ontario, Canada. This policy covers stocklens.com, your StockLens account, and related services. It explains what we collect, why we use it, who receives it, and your choices.

We collect information you provide, information returned by sign-in and payment providers, and information generated when you use the service. Browsing the public site does not require a StockLens account.

Google sign-in and other account information

When you choose Sign in with Google, Firebase Authentication, operated by Google, receives your Google account identity, including your email address, display name, profile picture (avatar), account identifier, and email verification status. These profile fields may be available in your Firebase sign-in session. StockLens verifies the Firebase identity token and uses your email address to create or find your StockLens account and sign you in. Your Google display name and avatar are not required to be saved in our application database to sign you in.

We use this identity information to authenticate you, keep your account secure, and send account and service messages. Google sign-in does not give StockLens access to your Gmail messages, contacts, calendar, or Google Drive files. We do not sell your Google account information or use your Google display name, email address, or avatar for advertising targeting.

If you register directly, we collect your email address and password, and store a password hash rather than the password itself. Apple sign-in also uses Firebase; we receive the email address and any name Apple supplies. We keep account details such as your profile name if provided, verification and login status, plan, and consent records.

Your research, portfolio, and preferences

We collect the companies and tickers you search for, analysis requests and saved results, saved screens and filters, portfolio names, companies you follow, and any holdings or transactions you enter. We use these records to provide your research history, portfolio views, saved searches, and analysis features.

We store alert rules, notification and email preferences, digest settings, analysis settings, and onboarding choices to deliver the alerts and summaries you request and remember how you use StockLens. Theme and other interface preferences may also be stored in your browser.

If you choose to connect a brokerage account, SnapTrade and your broker handle the connection authorization. StockLens receives connection and account identifiers, holdings, balances, and transaction information made available through that connection to show and synchronize your portfolio. Connecting a broker is optional.

Email subscriptions, support, and payments

If you opt in to marketing emails or product updates, we use your email address and record your consent and subscription preferences for that purpose. This choice is separate from Google sign-in. You can unsubscribe using the link in an email or change your email preferences in your account. Account verification, password reset, security, and billing messages are separate from optional marketing emails.

If you contact support, we receive your email address and the information you include so we can answer and resolve your request. Avoid sending passwords or payment card details.

If you make a purchase, Stripe collects payment and billing details through its checkout and customer portal. StockLens keeps Stripe customer and subscription identifiers, plan and payment status, credit purchases, and transaction or invoice references to provide access, manage subscriptions, and handle billing. StockLens does not store full payment card numbers.

Cookies, analytics, and advertising

We use cookies and browser storage for sign-in, security, preferences, and remembering cookie choices. Our Cookie Policy describes these technologies and lets you manage analytics and advertising preferences.

Our own analytics record page views and product actions, including searches, article views, analysis use, and billing activity. Records can include a session identifier, your internal account identifier when signed in, event details and timestamps, browser information, and a hashed IP address. We use these records to understand usage, diagnose problems, protect the service, and improve it. Hashing an identifier does not make all related activity anonymous.

We use Google Analytics 4 to measure visits and product use and Google Ads to measure advertising and conversions such as sign-ups and purchases. Data sent to Google can include pages and events, browser and session identifiers, a hashed StockLens account identifier, subscription tier, sign-up method, campaign and ad-click information, and conversion value and currency. Server-side sign-up measurement can also send your IP address, country, and browser language to attribute the visit. We retain referral and campaign information associated with sign-up to understand how people find StockLens.

Advertising platforms (Meta, TikTok, Reddit, and Google Ads). If you arrive from one of our ads and your advertising choice is on, we store the ad click identifier (for example gclid, gbraid, wbraid, fbclid, ttclid, or rdt_cid), the date captured, the sanitized landing address, and your IP address and browser user agent. From our servers we may then send these events to the platform that referred you: verified sign-up, onboarding completion, first analysis completed, and purchase. An event includes the event name and time, a unique event identifier, the click identifier, your IP address and user agent, a SHA-256 hash of your email address, a hashed StockLens account identifier, and, for a purchase, the amount and currency. Meta (Conversions API), TikTok (Events API), and Reddit (Conversions API) receive these events for ad measurement and delivery; Google Ads receives the Google click identifier and conversion details. We do not send the content of your research or portfolios, or payment card details.

We capture these identifiers and send these events only if your advertising choice was on when the identifier was captured; where it is off, we do not. It counts as on by default in the United States and in Canada outside Quebec until you opt out, and as off until you opt in elsewhere, including where we cannot determine your location. We remove the IP address and user agent stored with a click identifier after 30 days and delete the click identifier record 90 days after we last saw it; the Google click identifier saved on your account record stays with the account until you ask us to delete it. We delete the content of each outgoing event 14 days after it is sent or abandoned, and keep a minimal delivery record (no email or IP address) for up to 180 days. If you start a checkout while advertising is allowed, we pass the Google click identifier to Stripe on the Checkout Session, and Stripe retains it under its own practices. Events already delivered are held by each platform under its own privacy policy. If you turn advertising off while signed in, we delete the stored identifiers and cancel unsent events; otherwise email us as described under “Your choices and privacy requests” and we will delete them on request.

Google Consent Mode v2 controls analytics storage, advertising storage, advertising data use, and ad personalization signals. Analytics and advertising cookies are on by default in the United States and Canada outside Quebec until you opt out. In Quebec and everywhere else, including the EEA, United Kingdom, and Switzerland, they are off until you opt in. An unresolved region uses the off default. Global Privacy Control is treated as an opt-out unless you make an explicit choice that overrides it.

You can change your choices in the cookie banner, the footer’s “Manage cookie preferences” link, or the Cookie Policy. Google tags may still load and send limited measurement signals without analytics or advertising cookies when consent is denied. Cookie choices do not disable the first-party usage records described above or essential security processing.

Sharing and service providers

We use service providers to operate StockLens. The information they receive depends on their role:

• Google / Firebase: account authentication and sign-in profile information; Google Analytics and Google Ads receive the measurement information described above.
• Meta, TikTok, and Reddit: server-side advertising conversion events and click identifiers, only under the advertising choice described above.
• Amazon Web Services: website hosting through Amplify, messaging, and email delivery through Amazon SES. Email delivery includes recipient addresses and message content.
• Microsoft Azure: application, database, and model-service hosting, including stored account and research records.
• Cloudflare: content delivery, traffic security, and Turnstile bot protection, which process connection and request information such as IP addresses and browser details.
• Stripe: payment processing and subscription management. Stripe also holds the Google click identifier we attach to a Checkout Session when advertising is allowed.
• SnapTrade and your connected broker: brokerage authorization and portfolio synchronization when you enable that feature.
• Financial data providers and AI service providers: company symbols and financial information used to retrieve market data and generate analysis. Cloud-based AI generation uses company financial and news information; your Google sign-in profile is not needed for stock scoring.

Authorized StockLens personnel may access information needed for support, security, and service operations. We may disclose information when required by law, to address fraud or threats to safety, to enforce our agreements, or as part of a business transfer subject to applicable privacy requirements.

StockLens is based in Canada, but service providers may process information in other countries, including the United States. Information processed abroad may be subject to those countries’ laws.

Retention and deletion

We keep account and research records while they are needed to provide your account and saved features. When you delete your account, the service deactivates it, removes or replaces identifying profile fields, and starts cleanup of associated portfolio, preference, notification, and other feature records. Provider-side cleanup and background processing may take additional time.

Account deletion does not immediately erase every record. Billing and transaction references, consent records, security and anti-abuse records (including a hash of a deleted email address), and some usage records may be retained for accounting, dispute resolution, security, and legal obligations. Analytics records can remain linked to internal identifiers; they are not necessarily anonymous. Advertising IP addresses and user agents are kept for up to 30 days, and advertising click identifier records for up to 90 days after last seen. Backups and providers’ records follow their own retention cycles. Contact us to ask about retention or deletion of a specific category of information.

Security

We use encrypted connections, password hashing for direct registration, authenticated access controls, and restricted database access to protect information. Firebase handles provider authentication and Stripe handles payment details. No internet service or security measure can guarantee complete protection. Keep your sign-in credentials private and contact us if you suspect unauthorized access.

Your choices and privacy requests

You can update available account and email settings, remove portfolio entries, disconnect a broker, manage cookie preferences, or delete your account through account settings. You can also remove StockLens access through your Google account’s connection controls; doing so does not by itself delete records already held by StockLens.

For access to your personal information, a copy, a correction, deletion, withdrawal of consent, or a privacy complaint, email support@stocklens.com with the subject “Privacy request”. Tell us what you want to access or change. We may ask for information needed to verify your identity before releasing or changing account records; do not send your password.

We will explain any information we must retain or any effect on your ability to use the service. Your applicable privacy rights depend on where you live, including rights under Canadian privacy law (PIPEDA). You may also raise a complaint with the privacy authority in your jurisdiction.

Children, updates, and contact

StockLens is not intended for children under 13. If you believe a child has provided personal information, contact us so we can investigate and remove it as appropriate.

We publish policy changes here with an updated modification date. For material changes to how personal information is used, we provide notice and seek consent where required.

Privacy Officer, Stock Lens Inc.
Toronto, Ontario, Canada
support@stocklens.com