Privacy Policy

Last updated October 13, 2026

This policy explains what LEAPSdesk collects, why, and your choices. We keep it short because we collect little.

What we collect

• Account data: username, email address, display name, a salted hash of your password (never the password itself).
• Usage data: the tickers you check, your watchlist, alerts, batch requests and API calls, with timestamps, so the Service can work and enforce plan limits.
• Billing data: handled by Stripe. We store your Stripe customer and subscription identifiers and plan status. We never see or store full card numbers.
• Technical data: IP address, browser and device information, and request logs processed by our hosting provider (Cloudflare) for security, abuse prevention and reliability.

What we do not do

• We do not sell or rent personal data.
• We do not run advertising trackers or third-party analytics pixels.
• We do not connect to your brokerage or place trades.
• We do not use your data to train AI models; the Service does not use language models.

Marketing emails

If you tick the box at signup or leave your email on our site, we may send you product updates, the weekly dip radar and offers. We record the wording you agreed to and when. Every marketing email carries an unsubscribe link, and you can also switch marketing off from your Account page; account and billing emails are unaffected. We do not share your address with other companies for their own marketing.

Why we process it

To provide the Service you subscribed to (contract), to keep it secure and prevent abuse (legitimate interest), to bill you (contract), and to comply with legal obligations such as tax and accounting rules.

Cookies and local storage

We set one strictly necessary session cookie to keep you signed in. Your browser may store small preferences locally. No consent banner is required for strictly necessary cookies, and we set no others.

Who we share with

Service providers who process data on our behalf under contract: Cloudflare (hosting, database, network), Stripe (payments), Alpaca (market data requests are made by our servers, not tied to your identity), GitHub (scheduled jobs; no personal data). We may disclose data if required by law or to protect rights and safety.

Retention

Account and usage data is kept while your account is active and for up to 24 months after closure, unless a longer period is required for tax or legal reasons. Audit and security logs are kept for up to 12 months.

Your rights

Depending on where you live (including under GDPR, UK GDPR and the CCPA/CPRA) you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to lodge a complaint with a supervisory authority. You can change your name and email in the app. To exercise other rights, email privacy@leapsdesk.com from your account email; we respond within 30 days. We do not discriminate against you for exercising your rights.

International transfers

We are based in the United States and process data there and on Cloudflare's global network. Where required we rely on standard contractual clauses or equivalent safeguards.

Children

The Service is not directed to anyone under 18 and we do not knowingly collect data from children.

Security

Passwords are hashed with PBKDF2, all traffic is encrypted with TLS, secrets are stored in Cloudflare's encrypted secret store, and access to production is limited. No system is perfectly secure; report concerns to security@leapsdesk.com.

Changes

We will post updates here with a new date. Contact: privacy@leapsdesk.com.