Privacy Policy
Last updated: October 5, 2026
Market Scanner is operated by James Lewis in the United States. This policy explains what information the site collects, why, who else handles it, and the choices you have.
What we collect
- Browsing without an account: nothing personal is collected by us. Our host keeps standard server logs, including your IP address (see "Services we use").
- Creating an account: your email address, mobile phone number and password. We store only a one-way bcrypt hash of your password, never the password itself.
- Using your account: your watchlist, any trades you stage or approve, and whether you've verified your phone.
- Alpaca paper-trading keys (optional): if you add them, they're encrypted before being stored and are never shown again.
- Alert notifications (optional): if you turn them on, your browser gives us a delivery address and encryption keys for that device, and we store your choice (all signals, or only your watchlist). If you're signed in, it's linked to your account.
We don't use analytics, advertising trackers or tracking pixels. The site's fonts and code are served from our own host, so your browser doesn't contact other companies when you load a page.
How we use it
- To create and secure your account, sign you in, and verify your phone with a one-time code at sign-up and password reset.
- To show your watchlist and staged trades, and to send the paper trades you explicitly approve to your own Alpaca account.
- To protect the site, for example by limiting repeated sign-in attempts from the same IP address.
We do not sell, rent or share your information for marketing or advertising.
Services we use
These companies process information only as needed to run the site:
- Render hosts the website and database in the United States (Oregon). Its server logs include IP addresses. If a text fails to send, the log shows only the last four digits of the phone number. Render keeps these logs for a limited time.
- Your browser's push service delivers alert notifications if you turn them on: Google for Chrome and Android, Mozilla for Firefox, Apple for Safari and iPhone, Microsoft for Edge. The notification content is encrypted so only your device can read it. The service sees only that a notification was sent.
- Twilio receives your phone number to send verification codes (Twilio Verify) and to process STOP replies.
- Alpaca receives your encrypted-at-rest API keys and the orders you approve, sent to your own paper-trading account. Alpaca's own privacy policy covers information it holds.
- ElevenLabs turns market summaries into speech. It receives only the text of those summaries, never your personal information.
- Yahoo Finance and Alpaca supply market data. No personal information is sent to get it.
Cookies and browser storage
- Sign-in cookie (
ms_session): keeps you signed in. It's essential, can't be read by page scripts, and expires after 30 days or when you sign out.
- Theme setting (
scanner_theme, stored in your browser): remembers whether you chose light or dark mode. It never leaves your device.
If you turn on alert notifications, the site also installs a small background script (a "service worker") that only displays those notifications. It stores no data. We don't use advertising, analytics or tracking cookies. Blocking the sign-in cookie will prevent you from signing in.
Text messages
Today we text only one-time verification codes you request at sign-up or password reset. Stock and crypto alert texts are paused. We aren't sending them or taking new alert sign-ups, and we've deleted the phone numbers people gave us for alerts. Reply STOP to any of our texts to opt out, or HELP for help. Message and data rates may apply. The service itself is free.
Alert notifications
Browser alerts are optional and off by default. When on, you get at most one notification every 15 minutes, bundling any new strong signals. Turn them off at any time with the Alerts button on the Scanner page or in your browser's site settings.
How we protect it
The site is served only over encrypted HTTPS. Passwords are stored as bcrypt hashes, Alpaca keys are encrypted at rest, and sign-in attempts and verification codes are rate-limited. No system is perfectly secure, but we take reasonable steps to protect your information.
How long we keep it
- Account data (email, phone, password hash, Alpaca keys, watchlist, trades): until you delete your account or ask us to.
- Alert notification subscriptions: until you turn alerts off, block notifications, or delete your account. Subscriptions your browser reports as expired are deleted automatically.
- Verification-code records: deleted automatically after one day.
- Unfinished sign-ups (phone never verified): deleted automatically after one day.
- Backups: our host keeps short-term recovery copies, and we keep periodic private backups. Deleted data can remain in backups for a limited time until they're replaced.
Your choices and rights
- Remove your saved Alpaca keys at any time on the Account page.
- Delete your account and everything linked to it at any time from the Account page. Deletion is immediate and permanent. Backup copies roll off as described above.
- Ask us for a copy of your data or to correct it. Email us from your account's email address, and we'll respond within 30 days.
Children
Market Scanner is intended for adults 18 and older. It isn't directed at children, and we don't knowingly collect information from anyone under 13. If you believe a child has given us information, contact us and we'll delete it.
Changes to this policy
If this policy changes, we'll post the new version here with a new "last updated" date.
Contact
Questions about this policy or your data? Email jelewis50@comcast.net.