Privacy Policy

Last Updated: Oct 22, 2026

This Privacy Policy explains how MarketCatalyst Analytics LLC ("MarketCatalyst," "we," "us," or "our") collects, uses, and shares personal information when you use marketcatalyst.ai, app.marketcatalyst.ai, and related services (the "Service"). It also explains your privacy choices and rights.

The Service is intended for users in the United States. This Privacy Policy is part of our Terms of Service.

1. Information We Collect

Information you provide to us

• Account information: your email address and, if you create one, a password. Passwords are handled by our authentication provider (Google Firebase Authentication); we do not see or store your password in readable form.
• Sign-in information from Google: if you choose "Continue with Google," Google shares your name, email address, and profile image with us, as permitted by your Google account settings.
• Portfolio and watchlist information: holdings you add (such as tickers, share quantities, and cost basis), watchlists, alert rules, and similar settings.
• Images you upload: for example, screenshots or photos you submit through "Import from photo" so that we can read the holdings shown in them. Please do not upload images that show account numbers or other sensitive information you do not want us to process.
• Messages: your name, email address, company (optional), and message when you use our contact form or email us, along with any support correspondence.
• Payment and subscription information: your plan, billing history, and billing contact details. Payments are processed by our third-party payment processor, Stripe, Inc. ("Stripe"), whose use of your information is governed by its privacy policy at https://stripe.com/privacy. We do not store your full payment card number.
• Marketing preferences: whether you have opted in to or out of marketing emails.

Information collected automatically

• Stock search history: the tickers and terms you search for in the Service.
• Usage data: pages and screens viewed, features used, time spent on the Service, and similar interactions.
• Technical data: IP address, approximate location derived from IP address (such as city or region), browser type, device type, operating system, and device and app identifiers.
• Analytics data: information collected through Google Analytics for Firebase, described in Section 6.
• API usage data: if your plan includes API access, the requests made with your API key, along with timestamps and volumes.
• Error and diagnostic data: stack traces, page context, and device information collected through Sentry when the Service encounters an error.

We do not intentionally collect sensitive personal information such as Social Security numbers, brokerage account credentials, precise geolocation, health information, or biometric information. We do not connect to your brokerage accounts.

2. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Service, including your account, portfolio and watchlist tools, alerts, recaps, and API features;
• Generate AI summaries and extract holdings from images you upload (see Section 3);
• Process payments and manage subscriptions, including renewal, cancellation, and price-change notices;
• Send service-related communications, such as confirmations, alerts you set up, security notices, and changes to our terms;
• Analyze search patterns and usage to understand how the Service is used and to improve it;
• Send marketing communications, which you may opt out of at any time;
• Monitor errors, diagnose problems, and keep the Service secure, including detecting fraud, abuse, and violations of our Terms;
• Respond to your messages and support requests; and
• Comply with our legal obligations and enforce our agreements.

We may create de-identified or aggregated information that cannot reasonably be used to identify you, and we may use it for any lawful purpose. We will keep de-identified information in de-identified form and will not try to re-identify it, except as permitted by law.

3. AI Processing

Some features use third-party AI model providers to generate content. For example:

• Portfolio and watchlist summaries: your holdings or watchlist tickers may be sent to an AI provider to produce summaries of the day's drivers, leaders, and laggards.
• Import from photo: images you upload are sent to an AI provider to read the holdings shown in them. The image is deleted once the holdings are extracted; only the extracted holdings are retained.

We send AI providers only the information needed for the feature, and they process it on our behalf under contracts that restrict how they use it. We do not allow our AI providers to use your personal information to train their models. We do not use AI to make decisions about you that have legal or similarly significant effects.

4. How We Share Information

We share personal information only as described below.

Service providers. We share information with vendors that process it on our behalf, under contracts that limit their use of it to providing services to us:

Other disclosures. We may also share information:

• With legal authorities or other parties when required by law, regulation, subpoena, court order, or other valid legal process, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of MarketCatalyst, our users, or others;
• With a successor entity, or its advisers, in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business or assets; and
• With your consent or at your direction.

5. No Sale of Personal Information; No Targeted Advertising

We do not sell your personal information, and we have not sold it in the past 12 months. We do not "share" personal information for cross-context behavioral advertising, and we do not process personal information for targeted advertising. We do not show third-party ads on the Service. We have configured Google Analytics without advertising features, including Google Signals and ad-personalization features.

6. Cookies, Analytics, and Similar Technologies

We use a small number of cookies and similar technologies (such as browser local storage):

• Essential: a cookie or similar storage that keeps you signed in and protects the sign-in form. Firebase Authentication also stores sign-in tokens in your browser's local storage or IndexedDB. The Service cannot function without these.
• Preferences: your display and app settings (such as light or dark mode) are stored in your browser's local storage, not in a cookie.
• Analytics: the MarketCatalyst web app uses Google Analytics for Firebase, a service provided by Google LLC. It uses cookies (such as _ga and _ga_<ID>) and similar identifiers to collect usage data, device and browser information, and approximate location (derived from IP address), so that we can understand how the Service is used. Google processes this data on our behalf. You can learn more at https://policies.google.com/technologies/partner-sites and opt out with the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout.

We do not use advertising cookies or cross-site advertising trackers.

Your choices. You can block or delete cookies in your browser settings. If you block essential cookies or storage, you may not be able to sign in. Blocking analytics cookies will not affect your use of the Service.

7. Global Privacy Control and Do Not Track

• Global Privacy Control (GPC): we treat a GPC signal from your browser as a valid request to opt out of the sale or sharing of your personal information and of targeted advertising, for that browser and, if you are signed in, for your account. Because we do not sell or share personal information or engage in targeted advertising, no further change to your experience is required.
• Do Not Track: some browsers send "Do Not Track" signals. Because there is no common industry standard for these signals, we do not currently respond to them differently, other than as described above for GPC.

8. Data Retention

We keep personal information only as long as reasonably necessary for the purposes described in this Privacy Policy, or as required by law:

Backup copies may persist for up to 90 days after deletion before they are overwritten. We may keep information longer if needed to comply with law, resolve disputes, prevent fraud or abuse, or enforce our agreements.

9. Data Security

• We use industry-standard encryption (TLS/SSL) to protect data in transit, and our cloud providers encrypt data at rest.
• Payment data is handled by PCI-compliant payment processors.
• We limit access to personal information to people who need it to operate the Service, and we maintain access controls and monitoring around our infrastructure.
• We periodically review our security practices and apply security updates.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials and API keys confidential.

10. Data Breach Notification

If we learn of a security breach that affects your personal information, we will notify you, and any regulators as required, in accordance with applicable law, including the Texas Identity Theft Enforcement and Protection Act and other state breach-notification laws. We will usually notify you by email to the address on your account.

11. Your Privacy Choices and Rights

Choices available to all users

• Access and export: request a copy of the personal information we hold about you, in a portable format where applicable.
• Correction: update your account information in your account settings, or ask us to correct inaccurate information.
• Deletion: delete your account or personal information. You can delete holdings and watchlists in the app at any time.
• Marketing: unsubscribe from marketing emails at any time using the link in any marketing email or by contacting us. We will still send service-related messages.
• Analytics: opt out of Google Analytics as described in Section 6.

How to submit a request. Email contact@marketcatalyst.ai with the subject line "Privacy Request." Tell us which right you want to use and which email address is associated with your account.

Verification. To protect your information, we will verify your identity before acting on a request, usually by confirming control of the email address associated with your account. We may ask for more information if needed. We will use that information only for verification.

Authorized agents. Where permitted by law, you may use an authorized agent to submit a request. We may require written proof of the agent's authority and may ask you to verify your identity directly.

Response timing. We will respond within 45 days of receiving your request. If reasonably necessary, we may extend this by another 45 days, and we will tell you if we do.

Appeals. If we decline your request, you may appeal by emailing contact@marketcatalyst.ai with the subject line "Privacy Appeal" within a reasonable time after our decision. We will respond to your appeal within 60 days (or 45 days where required by law) and explain the reasons for our decision.

No discrimination. We will not discriminate against you for exercising your privacy rights. For example, we will not deny you service or charge you a different price.

12. Texas Residents

If you are a Texas resident, the Texas Data Privacy and Security Act ("TDPSA") may give you the right to:

• Confirm whether we are processing your personal data and access it;
• Correct inaccuracies in your personal data;
• Delete personal data you provided or that we obtained about you;
• Obtain a copy of your personal data in a portable and, where technically feasible, readily usable format; and
• Opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects.

Our practices: we do not sell personal data, do not process personal data for targeted advertising, and do not engage in profiling that produces legal or similarly significant effects. We do not process sensitive data, as defined by the TDPSA, and we do not sell sensitive data.

To use your rights, follow the process in Section 11. You may exercise these rights at no cost up to twice per year. If we deny your request, you may appeal as described in Section 11. If your appeal is denied, you may contact the Texas Attorney General at https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint.

13. California Residents

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), may give you the rights described in this section.

Categories of personal information we collect (in the past 12 months):

Sources: you; your browser or device; Google, if you sign in with Google; and our service providers.

Purposes: the business and commercial purposes described in Sections 2 and 3.

Retention: see Section 8.

Sale and sharing: we do not sell personal information or share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the personal information of consumers under 16.

Sensitive personal information: we use sensitive personal information only to provide the Service and for other purposes permitted by the CCPA, and not to infer characteristics about you. As a result, we do not offer a right to limit its use.

Your rights: you may have the right to know what personal information we collect, use, and disclose; to access it; to delete it; to correct it; and to opt out of its sale or sharing (which we do not do). You also have the right not to be discriminated against for exercising these rights. To use your rights, follow the process in Section 11. An authorized agent may submit a request on your behalf as described there.

Shine the Light: we do not disclose personal information to third parties for their own direct marketing purposes.

14. Residents of Other U.S. States

Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Utah, Virginia, and other states with comprehensive privacy laws may have rights similar to those described in Sections 12 and 13. These may include the rights to confirm, access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, sale, and certain profiling. To use these rights, follow the process in Section 11. If we deny your request, you may appeal as described there, and you may contact your state Attorney General if you are not satisfied with the outcome of your appeal.

Nevada residents: we do not sell covered information as defined by Nevada law.

15. Children's Privacy

The Service is not intended for, or directed at, individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will take steps to delete it. If you believe a child has provided us with personal information, please contact us at contact@marketcatalyst.ai.

16. U.S. Users; International Access

The Service is intended for users in the United States and is not directed to residents of the European Economic Area, the United Kingdom, or Switzerland. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where our servers and service providers are located, and where data protection laws may differ from those in your country.

17. Third-Party Websites and Services

The Service may contain links to, or integrations with, third-party websites and services, such as Google sign-in, our payment processor, and brokers or news sources. This Privacy Policy does not apply to, and we are not responsible for, the privacy practices of those third parties. We encourage you to review the privacy policy of any third-party site or service you use.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on the Service and change the "Last Updated" date above. If we make material changes, such as using personal information in a materially different way, we will notify you by email or by a prominent notice on the Service before the changes take effect, and we will get your consent where required by law.

19. Contact Us

For questions about this Privacy Policy or your personal information, or to submit a privacy request:

MarketCatalyst Analytics LLC
Email: contact@marketcatalyst.ai