Account data (only if you sign up). Creating an account requires an email address, a username, and a password. Authentication is handled by our infrastructure provider Supabase; passwords are stored hashed and are never visible to us. If you follow accounts while signed in, the list of accounts you follow is stored against your user ID so it syncs across your devices.
Early-access requests. If you submit the waitlist form, we collect what you enter there (email, optional X handle, and your answers) to manage invitations.
Automatic technical data. Like nearly every website, our hosting infrastructure (Vercel) produces standard server logs — IP address, user-agent, requested URLs, and timestamps — used for security, debugging, and abuse prevention. We do not build behavioral profiles from these logs.
On-device storage (localStorage).Your theme preference and, when signed out, your follow list live only in your browser’s localStorage on your device. When you open your personal track feed, the follow list is sent with that request so we can build the feed. The application does not store it beyond serving the response (unless you are signed in and it syncs to your account as described above) — but because it travels in the request URL, it appears in the standard server logs described above for their short retention window (section 05).
What we do NOT collect: no payment information, no brokerage or exchange connections, no government IDs, no precise location, no contacts, no advertising identifiers. We use no third-party analytics, advertising SDKs, or tracking pixels, and we set no advertising cookies. (Embedded media players on episode pages are third-party content and may set their own cookies — see section 04.)
The Service indexes publicly available content and records: public podcasts, streams, videos, posts, and newsletters published by creators, and public government records such as SEC filings and congressional financial disclosures. From these we display names, handles, avatars, quotes, summaries of expressed market views, and derived figures.
We process this information for journalistic, research, and indexing purposes on the basis of legitimate interest in making already-public financial commentary searchable and comparable. If information about you appears on the Service and you believe it is inaccurate, misattributed, or should be removed, contact legal@paste.trade — we review all requests promptly.
We do not use your personal information for advertising, we do not sell it, and we do not “share” it for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act.
Beyond the providers and embedded platforms above, no other third parties receive your personal information.
We use industry-standard measures: TLS encryption in transit, hashed passwords, row-level security on our database, and least-privilege service credentials. No system is perfectly secure, and we cannot guarantee absolute security — please use a unique password. If we learn of a breach affecting your personal information we will notify you as required by applicable law.
Everyone: you can use the Service without an account; you can clear on-device data in your browser; you can delete your account yourself from your profile page at any time; and you can contact legal@paste.trade to access, correct, export, or delete data we hold about you. We respond to all requests within the time required by applicable law and never discriminate against you for exercising rights.
European Economic Area / United Kingdom (GDPR): where GDPR applies, our legal bases are contract (providing the Service you request), legitimate interests (security, indexing public information), and consent where required. You have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your supervisory authority. We do not use automated decision-making that produces legal or similarly significant effects about you.
California (CCPA/CPRA): you have the rights to know, delete, correct, and port your personal information, and to opt out of sale or sharing — we do not sell or share personal information, so there is nothing to opt out of. We honor these rights without discrimination. The categories we collect are described in section 01; we disclose them only to the processors in section 04.
Do Not Track / Global Privacy Control: because we run no cross-site tracking at all, the Service behaves the same whether or not these signals are present.
The Service is operated from and hosted in the United States, and our providers may process data in other countries. Where required, transfers rely on appropriate safeguards such as standard contractual clauses offered by our processors. By using the Service you understand your information will be processed in the United States.
The Service is not directed to children and, per our Terms, users must be 18 or older. We do not knowingly collect personal information from anyone under 13 (or the equivalent minimum age in your jurisdiction); if you believe a child has provided us information, contact legal@paste.trade and we will delete it.
We may update this Policy as the Service evolves. Material changes will be reflected by updating the date at the top; significant changes will be highlighted on the Service. Continued use after a change means you accept the updated Policy.
Contact for anything in this Policy — including access, correction, deletion, creator/public-figure removal requests, and complaints: legal@paste.trade