Privacy Policy

Account information. Your name and email address to create and manage your account, and, if you sign in with Apple or Google, the account identifier they send us. Optional: a password and your TOTP secret if you enable two-factor authentication. We store passwords only as bcrypt hashes and TOTP secrets encrypted at rest. Face ID on the iPhone app happens on your phone; we never receive your face or fingerprint data.

Your phone number. Asked for on some of our sign-up screens, so we can reach you about your account; the emailed-code, Apple and Google sign-ups and the iPhone app do not ask for it. A number given at signup is stored unverified: we do not send a confirmation code at signup, so it is the one you typed and has not been checked. We verify a number at the point we first send to it, not before.

Your LinkedIn URL. Optional, and only if you choose to give it. It helps us understand who our users are. Nothing in the product depends on it.

Usage and billing metering. Your credit balance and a record of the work you spend credits on, so the usage meter and your invoices are accurate and so a retried request cannot be charged twice.

Stock analyses and research data. Analyses you run on publicly traded companies (DCF models, memos, comps, valuations), your watchlists, custom thesis notes, price alerts, and any written annotations you save. These are scoped to your account and are not shared with other users.

Portfolio data. Positions you manually add (ticker, shares, cost basis, thesis), your practice (paper) accounts and their trades, and, if you connect an account, the positions, balances, orders and activity synced from it (see "Brokerage connection data" below). Tax features read the cost basis and trade history from the same data.

AI agents and trading. For each AI agent: the instructions, limits and mode you give it, its runs and what it found, the trades it suggested or placed and why, and your approvals. For each trade you place: the order, where it went and what your broker reported back. When you agree to the automated trading terms, we record which version you agreed to, when, and the IP address and browser you agreed from, so we can show what you agreed to.

Brokerage connection data. If you connect a brokerage account via our SnapTrade or Finatic integration, we store that provider's user identifier (and, for SnapTrade, an encrypted API secret) that allows us to fetch your positions on your behalf. If you link an OANDA account, we store the access token you paste, encrypted. We also store the institution name, account type, balance, and holdings returned by the provider. We never receive, see, or store your brokerage login credentials, passwords, or MFA codes. For most brokers that authentication happens directly between you and your broker through the provider's OAuth flow; some brokers (for example, Robinhood) take your login on Finatic's own page rather than through OAuth, and Volaren still never receives it. If you connect with trading permission, the orders you confirm in the Service, and the orders your AI agents place inside the limits you set and agreed to, are sent to your broker through that connection.

Plaid and accounts opened through Volaren. If you link accounts through Plaid, we store the accounts, balances, holdings, transactions, and loan and card details (such as balance, APR and payment due date) Plaid returns, and Plaid's access token for the link, encrypted, to show them beside your other accounts; Plaid takes your bank login on its own screens. If you open a brokerage account through Volaren at Alpaca Securities, the details the account form asks for (such as your address, date of birth, Social Security number and employment) are sent to Alpaca to open the account and are not stored by Volaren; we keep the account's identifier, status, holdings and transfers. Bank details for deposits go from Plaid to Alpaca without passing through Volaren. Data from Plaid is never used to train or test AI. If you link Kalshi, we store the API key you paste, encrypted, and read your balance and positions; nothing is traded there.

Payment information. Processed by Stripe on our website, and by Apple for subscriptions bought in the iPhone app. We never see or store card numbers, CVCs, or billing addresses. We receive only a Stripe customer ID and subscription status, and for App Store purchases, Apple's transaction ID.

The iPhone app and texts. The iPhone app sends us a push notification token so we can notify you. If you turn on texts with Volaren, we verify your phone number with a code, record your consent and the words you agreed to, and keep the texts you send and receive, which are handled like your other conversations (below). Reply STOP to stop texts at any time.

Usage metadata. Counts of analyses run per week (for plan limits), timestamps of authentication events, IP addresses associated with login attempts (for security).

Advertising measurement. We load measurement tags from Google Ads and OpenAI so we can tell which of our advertisements bring people to the site and lead to a sign-up. These are third-party advertising vendors: they set their own cookies and can recognise your browser on their own services. They never load for visitors in the European Union, the European Economic Area, the United Kingdom, Switzerland, Brazil, South Korea or Quebec, or when your browser sends a Global Privacy Control signal. Opting out on the cookie policy page stops them and deletes their cookies. We send them no name, email address or other account detail; what they receive is the fact that a sign-up happened and the advertising click it can be matched to.

Referral program data and cookies. To make referral credit work, we can set two first-party cookies in your browser: a random visitor identifier (kept for one year) and, if you arrived through a referral link, the referral code (kept for 30 days, first link wins). We do not set them in the European Union, the European Economic Area, the United Kingdom, Switzerland, Brazil, South Korea or Quebec, when your browser sends a Global Privacy Control signal, or after you opt out; then neither is set and nothing about your visit is recorded. When they are set and someone follows a referral link we also record the code, the landing page, the referring page, the browser's user-agent string, and a salted, truncated hash of the IP address (we do not store the raw address for this purpose), with a timestamp. If you then create an account, we record the referral relationship, which account referred yours, so credits can be granted and self-referral and duplicate-account abuse can be detected. Whatever you chose, signing up from a referral link still credits the person who sent it: the code is read from the link itself. These cookies are first-party only: they are never shared with advertisers or any third party, and they are not used to track you across other websites. The full list of everything we store in your browser, essential and optional, is on our Cookie Policy page, where you can also change your choice.

Activity and conversations. We keep the questions and requests you send on Volaren, the answers you get, and what you do next (such as rating an answer, asking again, or placing a trade). Our team and an automated review read them to check whether each answer gave you what you wanted and to fix the ones that did not. A strong answer may be kept, with personal details left out, as an example that helps answer similar questions. Deleting a conversation removes its words from this record, and deleting your account removes all of it.

Feedback submissions. Product feedback you submit through the credit-earning feedback form is stored with your account identity and is read by our team when we review it. It is used to improve the product and to decide the credit grant, and for nothing else.

Security audit log. Every authentication event, admin action, and billing change is written to an immutable audit log with actor, IP, and timestamp. This is a core security control; see our Security page.

• To provide and improve the Volaren service
• To improve our answers, using your activity and conversations on Volaren
• To manage your account and subscription
• To enforce usage limits and fair-use controls
• To communicate with you about your account (e.g., password resets, security notices, access approval)
• To sync and display your brokerage positions, if you have connected an account
• To run your AI agents, send the orders you confirm or that your AI agents place inside your limits, and tell you what they did
• To operate the referral and feedback credit programs (attribution, credit grants, and fraud prevention)
• To measure which of our advertisements bring people to Volaren, unless you have opted out
• To detect and prevent abuse, fraud, and security incidents
• To meet legal and accounting obligations (billing records, audit retention)

We do not sell or rent your data. Apart from the service providers below, which process it only to run Volaren for you, and the brokers and connection providers you choose to use, we never hand any third party your name, email address, brokerage holdings, or anything you write on Volaren. We use your activity and conversations to improve our answers, and never to train anyone else's AI. Unless you have opted out, the advertising vendors named below can recognise your browser on our site for measurement, which California law calls "sharing"; that is the only sharing for a marketing purpose that happens, and you can opt out at any time.

To deliver the service, we rely on a small number of carefully vetted subprocessors. Each handles a specific, scoped function:

• Railway, application hosting and primary database.
• Vercel, frontend hosting.
• Stripe, all payment processing.
• Twilio SendGrid, transactional email delivery.
• OpenAI and Anthropic, AI model inference for Copilot, Idea to trade, AI agents and other features. A request goes to one of them, and to the other if the first is unavailable. Anthropic's processing is covered by their enterprise no-training agreement, and OpenAI does not use API data to train their models.
• Tavily, web search for research (receives the search query, never your name or email address).
• Google Ads, advertising measurement. Not loaded in the EU, EEA, UK, Switzerland, Brazil, South Korea or Quebec, with Global Privacy Control, or after you opt out; receives that a sign-up occurred and the advertising click it matches, never your name or email address.
• OpenAI, advertising measurement on advertising we run with them. Not loaded in the EU, EEA, UK, Switzerland, Brazil, South Korea or Quebec, with Global Privacy Control, or after you opt out. (Model inference is listed above; this entry is the advertising pixel only.)
• lettervisit (with Maverick Intelligence and Vector), counting visits from AI assistants (for AI agents and crawlers, from our server: their user agent, address and the page read) and identifying the companies and people who visit volaren.ai, for our own outreach. Not loaded in the EU, EEA, UK, Switzerland, Brazil, South Korea or Quebec, with Global Privacy Control, or after you opt out.
• SnapTrade, Finatic and OANDA, brokerage connections (holdings, the orders you confirm, and the orders your AI agents place inside your limits).
• Plaid, linking bank, card, loan and investment accounts to see them, and bank accounts for deposits.
• Alpaca Securities, the broker-dealer that holds brokerage accounts opened through Volaren, and receives the account form.
• Kalshi, prediction-market account balances you choose to link.
• Sendblue, Twilio and Meta (WhatsApp), messages, if you turn them on.
• Apple, In-App Purchase for subscriptions bought in the iPhone app.
• Expo, push notifications to the iPhone app.
• Sentry, error tracking (PII scrubbed before transmission).
• Vercel Web Analytics, cookieless page-view counts (a daily-rotating hash, nothing stored in your browser).
• Google Fonts, typefaces served from Google's CDN (your browser sends its IP address to fetch them; no cookie is set).
• UptimeRobot, uptime monitoring (sees only public URLs).

Current list is also available on our Security page.

• TLS 1.3 encryption for all network traffic
• Database volumes encrypted at rest by our infrastructure provider
• Application-level encryption (Fernet) on sensitive fields: MFA secrets and brokerage API secrets; password reset tokens are stored only as hashes
• Passwords stored as bcrypt hashes with per-password salts
• Logs scrubbed of secrets before reaching our logging provider
• Per-account data isolation: all queries are scoped to your user ID; no data is shared across accounts
• Automatic lockout after repeated failed login attempts; two-factor auth available
• Weekly automated vulnerability scans; annual manual security review

Full control inventory: volaren.ai/security.

• Account data, kept until you delete your account.
• Stock analyses, portfolio positions, watchlists, alerts, notes, and AI agents, kept until you delete them, or until your account is closed.
• Orders and automated trading agreements, kept until your account is closed.
• Brokerage positions, retained as long as your brokerage account is connected. Positions marked as closed (sold) are retained for historical context until you disconnect the account.
• Security audit log, 365 days (may be retained longer where required by law).
• Login attempt history, 30 days.
• Expired password reset tokens, purged within 7 days of expiry.
• Billing records, retained for 7 years as required by US tax law.

Depending on where you live, you have various rights over your personal data:

• Access, download a structured archive of all the data we hold about you. Self-serve at /settings.
• Deletion, permanently erase your account and associated data. Self-serve at /settings.
• Correction, edit profile fields from /settings. For fields you can't edit directly, email support@volaren.ai.
• Portability, the export format (JSON in a ZIP) is interoperable and machine-readable.
• Brokerage disconnection, you can disconnect your brokerage account at any time from your portfolio or settings page. This removes the stored credentials and position data immediately.
• Objection / restriction, contact support@volaren.ai to restrict specific uses of your data.
• Opt out of sale or sharing, including by sending a Global Privacy Control signal: Do Not Sell or Share My Personal Information.
• Complaint, you may lodge a complaint with your local supervisory authority (e.g. an EU Data Protection Authority).

We respond to verified requests within 30 days. We may ask you to re-authenticate before taking irreversible actions.

Our primary infrastructure is in the United States. If you access Volaren from outside the US, your data will be transferred to and processed in the US. We rely on Standard Contractual Clauses and equivalent mechanisms with our subprocessors where required by law.

Volaren is a product for adults. We do not knowingly collect information from anyone under 18. If you believe we have collected information from someone under 18, contact support@volaren.ai and we will delete it.

We may update this policy to reflect new features, legal requirements, or operational changes. Material changes are announced by email to registered users at least 30 days before they take effect. The "last updated" date at the top of this page always reflects the current version.

Privacy, data, and general inquiries: support@volaren.ai
Security issues: support@volaren.ai (see also our vulnerability disclosure policy)

Data controller: Volaren Inc., a Delaware corporation. Written requests, including from EU/UK residents, may be sent to the contact email above.