Privacy Policy

QuantGPT LLC, a Florida limited liability company, 15350 N Florida Ave, Tampa, FL 33613, decides how your information is used and is responsible for it (the "controller"). Questions about this policy go to desk@quantgpt.co, or by mail to QuantGPT LLC, 15350 N Florida Ave, Tampa, FL 33613.

• Your account: your name, your email and your password. We keep the password only as a scrambled hash (PBKDF2-SHA256, with its own salt), never the password itself. We also keep your answer to the market data question (personal or professional use), your plan and billing status, when you joined and last signed in, and failed sign-in counts.
• Two-factor sign-in: if you turn it on, your authenticator secret, locked with our server key.
• What you agreed to (consent records): the box you ticked at sign-up and its exact words, the versions of the Terms, Privacy Policy, Cookie notice and Risk Disclosures, the time, and the IP address and browser it came from.
• Your cookie choice: counted in our activity log, with whether Global Privacy Control made it and the notice version. If you are signed in, it also goes in our consent records, with the time, IP address and browser.
• Activity log: sign-ins and sign-outs, the backtests and futuretests you run (the rule and dates, never a key), sandbox orders (the symbol, side, size and order type, never an account number), the takes you save, share and copy, forum posts and comments (their first 280 characters), searches you open, which AI provider you used and whether it answered (never what you asked), the plans you pick, and page errors (a short error code).
• Order approvals: when you approve an order, we keep the time and the IP address it came from with that approval.
• Only if you allow analytics: the pages you open, presses on sign-up buttons and the Discord link, how far you scroll the home page (50% and 90%), and where you came from (the site's name and any utm_source, utm_medium and utm_campaign on the link). See the Cookie notice.
• Visitors who are not signed in are counted with a pseudonymous code that changes every day. We make it from the IP address and browser with our secret key. The log does not keep the IP address itself.
• Takes: the takes you save (your words, the stocks and their weights, and who built it), with the name on your account as the author.
• Saved work, when you are signed in: what you save in the app, so it follows you to your other devices. That is your saved backtests and their books, saved screens, the names you watch, your Ask conversations (the words of each question and answer), the lines and notes you draw on charts, the stocks you opened lately, and your Terminal boards with their panels' tickers and notes. Your AI key is never part of it. Signed out, it stays in your browser only.
• Billing: Stripe keeps your card and billing details. We keep only your Stripe customer and subscription ids and the plan status Stripe reports.
• Founders' notes: QuantGPT's founders may keep short support notes about an account, and may set a plan or pause an account by hand.
• The founders' desk (HQ): if you open HQ or try its password, we log who, when, the IP address and the browser.
• Rate limits: to stop abuse, we count requests from each address and each account. The counts are kept under a code made with our secret key, never the address or email itself.
• Reddit ad match record, only if you are signed in and choose "Allow analytics and ads": the Reddit ad click id and the Reddit pixel's browser id if we have them, the cookie choice it was made under, and when. It lets our servers tell Reddit about your later purchases.

What we do not collect: your brokerage login, your money, or your AI key. Your AI key stays in your browser. Sandbox accounts are opened with the broker's test identity, so your name and email are not sent to the broker.

Each use below names its legal basis, for visitors in places (like the EU and UK) whose law asks for one.

• To run your account: sign you in, keep it safe and bill your plan. Basis: our contract with you.
• To keep your saved work on your account, so it is there on every device you sign in on. Basis: our contract with you.
• To keep a record of what you agreed to and when. Basis: our legal duties, and our interest in being able to prove it.
• To find and fix errors, keep the Service safe and see how members use it. Basis: our legitimate interest in running and improving the Service.
• To count page views, clicks and where visitors come from, only with your OK in the cookie banner. Basis: your consent, which you can take back at any time.
• To measure our ads on Reddit, only with "Allow analytics and ads". Basis: your consent, which you can take back at any time.

We do not use the activity log for advertising.

These companies handle information for us, only to run the Service:

• Vercel: hosts the app and runs its servers.
• Cloudflare: stores accounts, consent records, the activity log, takes, saved work and founders' notes in its D1 database.
• Stripe: takes payments and runs the billing page. It gets your name and email to set up your billing.
• Anthropic: answers the founders' questions in HQ, their private desk, from our own numbers. Member emails are swapped for short codes before anything is sent. It also reads the documents you upload to Check a document in Ask AI and the links you paste into Research, to list their claims; we do not keep an uploaded file, and only what you save to Research is kept, until you delete it.
• Profound (AI search analytics), only when we turn it on: when an AI crawler, or a visitor who arrives from an AI answer such as ChatGPT or Perplexity, opens a page, we send Profound the time, the page address, the response status, the IP address, the browser and, for a visit from an AI answer, the referring page and its utm_ tags. We do not send records of any other visit.
• Alpaca: runs the broker sandbox where your orders go. It sees the orders, not your name or email.

Your browser also talks to these sites directly. They see your IP address and browser, like any website, and their own policies apply:

• Map hosts (OpenFreeMap, Amazon Web Services terrain tiles, NASA GIBS): map pictures on the futuretest map.
• YouTube: University videos and the Terminal's TV panel play through the youtube-nocookie.com player, only after you press play.
• The AI provider you choose (for example Anthropic, OpenAI, Google or OpenRouter): your browser calls it with your own key when you use Ask AI, build a take or run your AI trader. Before Ask AI sends a question you typed, our server looks up its words in QuantGPT's own record (library strategies, studies, forum threads and the glossary) and hands back plain text and links that go with it to your provider. We do not keep the question, except in your own Ask conversations when you are signed in (see Saved work above).

Reddit, Inc. gets information for its own use, only after you choose "Allow analytics and ads", and never when your browser sends Global Privacy Control. The Reddit pixel in your browser sends Reddit each page you visit here, a sign-up, a press of Start your trial, and a paid plan's first charge (only its amount and currency). With them go a random browser id kept in Reddit's cookies on our site, your IP address and your browser.

Our servers also send Reddit the same events, through Reddit's Conversions API: a sign-up, a press of Start your trial, and each paid plan charge, renewals included (only its amount and currency). Each carries the same event id the pixel uses, so Reddit counts it once, plus the Reddit ad click id and the pixel's browser id when we have them, and, for a sign-up or a press of Start your trial, your IP address and browser.

We never send Reddit your email, phone number or name, and advanced matching is off. Reddit uses this under its own privacy policy to tell us how our ads did. Nothing is sent from HQ or for founders, and nothing at all for you if you choose "Only needed" or your browser sends Global Privacy Control.

We may also share information when the law requires it, to protect the Service and its members, or with a company that takes over QuantGPT, under this policy.

• Activity log: 180 days. A daily cleanup deletes older entries.
• Consent records: 5 years from the day they were made, so we can show what was agreed, even after an account is deleted.
• HQ access log: 2 years.
• Password reset links: until they expire after 24 hours, then the daily cleanup deletes them.
• Reddit ad match records, and the record of what our servers sent to Reddit: 180 days at most. An ad match record is deleted at once if you choose anything other than "Allow analytics and ads" or delete your account.
• Rate limit counts: until their time window ends, then the daily cleanup deletes them.
• Your account, your takes and founders' notes: as long as you have the account. See below for what deleting it removes.
• Saved work: until you remove it (removing a saved item removes it from your account too) or delete your account. Each account keeps at most 600 saved items and about 1.5 MB.
• Billing records at Stripe: as long as Stripe and tax law require.

Download: in Settings, Your data, Download my account data gives you a file with your account record (without the password hash or two-factor secret), your activity log, notes about you, your consent records, your takes with their stocks and weights, your saved work, and your Reddit ad match record if there is one. Download my data gives you what this browser keeps: your profile, portfolios, watchlist, notification settings and the saved work in this browser.

Delete: in Settings, Your data, Delete my account deletes your account, its activity log, notes about you, its reset links, your takes, your saved work and your Reddit ad match record right away. Copies of your takes that other members made stay theirs, without your name. It also ends any paid plan at once, with no refund for the rest of the period. It cannot be undone.

Deleting your account does not remove: your consent records (kept 5 years, with one more line saying the account was deleted), the HQ access log (kept 2 years), a plan or pause a founder set for your email, or billing records at Stripe. Write to us to have any of these removed, and we will remove what the law lets us.

Other requests: you can ask us to see, correct or delete your information, or object to how we use it. Write to desk@quantgpt.co, or to QuantGPT LLC, 15350 N Florida Ave, Tampa, FL 33613, from the email on your account (or tell us how to confirm it is you). We answer within 30 days. We will not treat you differently for using your rights.

Clearing this site's data in your browser removes everything your browser keeps for QuantGPT. Signing out removes your saved work from that browser; it stays on your account.

Choose "Only needed" in the cookie banner, or later with Cookie settings or Your privacy choices (in the footer of every page, or in Settings, Your data). Then no analytics are collected and nothing is shared with Reddit.

Global Privacy Control: if your browser sends it, we record "Only needed" for you and never share anything for ads. Analytics run only if you press "Allow analytics".

In the last 12 months we have not sold personal information for money. Letting the Reddit pixel run, and sending Reddit the same events from our servers, counts as "sharing" for cross-context behavioral advertising under California law. It shares identifiers (the browser id, the ad click id and the IP address) and internet activity on this site, and it happens only with your OK.

To opt out of sale and sharing, use Your privacy choices in the footer and pick "Only needed", or turn on Global Privacy Control, which we honor as an opt-out.

Residents of California and some other states have the right to know what we hold, to get a copy, to correct it, to delete it and to opt out. Use the steps above or write to us. Someone you authorize in writing may ask for you.

We do not knowingly sell or share the information of anyone under 16. We use your password and sign-in details only to sign you in, never to learn things about you.

You have the right to see, correct, delete, limit or move your information, to object to how we use it, and to take back your consent at any time. You can also complain to your data protection authority.

We are in the United States, and so are our providers' main systems. If you use the Service from somewhere else, your information is handled in the United States.

No. The Service is for adults 18 and older. We do not knowingly collect information from anyone younger. If you think we have, write to us and we will delete it.

Passwords are hashed. Sign-in cookies are sealed, page scripts cannot read them, and the server refuses a sign-in older than 30 days. Two-factor sign-in is available, and sign-in, sign-up and other actions are rate limited. Only our servers can reach our database, with a limited key. No system is perfectly secure. If a breach affects you, we will tell you as the law requires.

Yes. Each version has its own number and date at the top. We will tell you before an important change takes effect.