Privacy policy

This Privacy Policy explains how HexPoint LLC ("HexPoint," "we," "us," or "our"), based in Bettendorf, Iowa, collects, uses, and shares information when you visit our website, request beta access, create an account, or use the HexPoint service.

When you request beta access, we collect your name, email address, primary use case, and any additional context you choose to share. When you create or use an account, we collect the information you provide, such as your email address, any optional profile details you add, and messages you send to support.

If you sign in with Apple, Google, or Discord, we receive the account details that the provider shares with us, such as your name, email address, profile picture, and account identifier. We use this information to create, authenticate, and maintain your HexPoint account and to link an approved beta invitation to the correct account.

If you sign in with an email code, we send a one-time code to your email address through our email delivery provider. Codes expire after 10 minutes and are stored only in hashed form.

When you use the service, we automatically receive technical information such as your IP address, browser and device type, and the pages you visit. We store the IP address and browser information with each signed-in session to help keep your account secure, and we briefly use IP addresses to prevent abuse of public forms.

If you use portfolio features, we store the portfolios, transactions, and holdings you enter or import, and the performance history we calculate from them. When you import a CSV file, it is read in your browser and only the transactions are sent to us. We also store the watchlists, notes, alerts, saved screens, and settings you create. If you save a backtest, we store its name and setup: the date range, starting value, cash flows, and each portfolio’s holdings, weights, and rebalancing and dividend choices. Backtest results are calculated each time you run one and are not stored; to run one, we send the tickers it holds, not your name or account details, to our market-data provider to load their price history. We use this information to provide the features you use, including the AI features and notifications described below.

If you connect a brokerage account, you sign in to your brokerage through our brokerage-connection provider, which gives us read-only access: we cannot place trades or move money, and your brokerage login details never reach us. Through the provider we receive the brokerage’s name and, for each account, its name, account number as the brokerage provides it, holdings, cash balances, and transaction history, such as trades, dividends, deposits, and withdrawals. We use this to build each account you choose into a portfolio and keep it in sync. We store the brokerage’s name, identifiers for the connection and each account, the holdings, cash balances, and transactions we sync, and the account name, or the brokerage’s name and the account number’s last four digits when the account has no name. We do not store full account numbers. You can stop syncing a portfolio or disconnect your brokerage at any time: you choose whether to keep the portfolio, which then becomes an ordinary portfolio you can edit, or delete it, and once no portfolio syncs from a brokerage we revoke our access to it. Deleting your account also removes your connections with the provider.

The research assistant stores your messages and its replies in your account so you can return to them, along with the tickers, portfolios, or watchlists you attach to a question (their names and identifiers), and a summary of what it looked up for each reply (such as the tickers, prices and a year of closing prices, the names and holding weights of the portfolios or watchlists it read, the web pages it linked to, how each claim in the reply was checked, and any price alert it offered at a level you named) and whether you pinned the conversation. A reply keeps being written and saved if you leave the conversation or the page; while it is being written, what the assistant has read so far is saved with it, and once it finishes only the summary above is kept. To answer, we send the conversation to AI model providers through an AI gateway configured to use only providers that do not train on prompts. When a question involves your portfolios, watchlists, or theses, the assistant can read them, including details such as holdings, values, cost, performance, notes, your thesis notes and price levels, and your portfolio briefings, and what it reads is sent to the AI model to produce the answer. When a question needs current information, the assistant may send search queries to a web search provider. To read a company’s filings, it sends the ticker, and any phrase it searches the filings for, to the SEC’s EDGAR system. Conversations are deleted automatically 90 days after they were last updated, and use of the assistant is limited per user and per billing period. When you ask for help writing a thesis, we send the ticker and the text you paste or the point you want reworded (or, to draft from the bull case, our published bull and bear case, or, to save a research conversation to a thesis, the latest messages of that conversation) to AI model providers through the same gateway. The draft it writes is saved in your account as it is written, so it carries on if you close the editor or leave the page; it is deleted when you save your thesis or discard the draft, and otherwise 7 days after it was last updated. The text you paste and the conversation messages are not stored with the draft, and only what you save is kept as your note.

Daily briefings, bull and bear cases, and earnings explanations are generated from market data, filings, and news, not from your personal information. While your plan includes portfolio briefings, we generate a private briefing, after each market close or weekly depending on your plan, for portfolios you have opened recently or receive briefing notifications for. To write it, we send AI model providers, through the same gateway, information about the portfolio such as its holdings, their weights and price moves, the day’s or week’s performance, and related news and upcoming events. We do not send your name, email address, or portfolio name. Portfolio briefings are stored with your portfolio, shown only to you, and deleted when you delete the portfolio. Our team may review generated content, including portfolio briefings, to check its quality and fix problems.

We send account and service emails, such as invitations and sign-in codes, and, depending on your notification settings, alerts and briefings in the app, by email, or by browser push. Notifications shown in the app are stored in your account, with whether you have read them, and deleted automatically 90 days after they arrive. Emails are sent through our email delivery provider, and push notifications through the push service run by your browser’s vendor. If you turn on browser push, we store the subscription your browser provides for each browser you register, which consists of a push address and encryption keys. Notifications can include details of the alerts you set up, and briefing emails include the briefing’s headline and opening points. For a portfolio briefing, that can include how your portfolio and its holdings performed, its value, and what moved it, but not the portfolio’s name. You can choose which notifications you receive, and by which channel, in your notification settings. Emails needed to sign in or secure your account are always sent. While you’re signed in, we show notices about the service and our policies at the top of the site, and mark What’s new when it has an article you haven’t seen. To do this we store when you last opened What’s new and which notices you’ve closed, with your account. When our policies change, we may email a notice to every member with a verified email address, whatever your notification settings. Product updates about new features can reach you in the app, by push, or in a monthly email, as you choose in your notification settings; the monthly email is off unless you turn it on, and we record when you turned it on. Each one has a link that turns it off without signing in.

If you send feedback, we collect what you submit, including any attachments, the page you were on, and your account details so we can follow up. We keep feedback in a workspace tool our team uses, and attachments are stored with our file-storage provider. Anyone with an attachment’s link can open it, so do not attach files that contain sensitive information.

Paid plans are sold through Polar, which acts as merchant of record: it hosts checkout and the billing portal, processes your payment, and handles taxes and refunds. We do not receive or store your card number. We share your name, email address, and account ID with Polar to set up billing, and Polar shares subscription details with us, such as your plan, status, billing period, amount, and any cancellation reason or comments you give. Polar handles your payment information under its own privacy policy.

Our administrators can see the account details they need to support you and run the service: your name, email address, sign-in methods, plan and billing history, usage against your plan’s limits, brokerage connection status, signed-in devices, and notification settings. Our admin tools show how many portfolios, watchlists, theses, saved backtests, and research conversations you have, not what they contain. When an administrator changes your account, for example by giving you a plan at no charge, signing you out, or suspending or restoring your access, we record what changed, which administrator made the change, when, and any reason they noted. These records are kept with your account and deleted with it.

We use cookies and browser storage to keep you signed in, handle invitation links, run the service, and remember preferences such as your theme and recently viewed symbols. We use privacy-focused analytics to measure page views and limited technical information, such as the pages you visit, your referrer, and your browser and device type. We also measure how quickly pages load and respond, recording the timings with the page address and your device type. The landing page also records conversion events, such as beta button clicks and form submissions, which do not include your name, email address, or form responses. We use error monitoring in the browser and on our servers to find and fix problems. Error reports can include technical details such as your browser and device, the page address, and the context of the error, and we configure error monitoring not to collect personal information such as your name, email address, IP address, or cookies.

If you allow optional product analytics, we use PostHog to measure visits to broad sections of the site, newly saved beta applications, account creation, and opening research. These measurements cover only people who consent. We send random visitor identifiers, internal application and account identifiers, and approved campaign, placement, paid-keyword, and referral categories.

We do not send your name, email address, holdings, portfolio values, transactions, research questions or answers, full URLs, or invitation and sign-in credentials. We do not enable session recording or automatic interaction capture.

Your choice is saved for one year; the browser’s first acquisition source is saved for up to 90 days. The source is also retained with your beta application and linked account analytics so we can understand which sources lead to product use. You can withdraw permission using the controls in this section; this stops future collection on this browser and clears its acquisition cookie. We honor browser Do Not Track and Global Privacy Control signals for this optional analytics. Contact us to request deletion of previously collected data.

We do not track you across other websites, and we do not allow third parties to collect information about your activity across other websites through our service. We honor Do Not Track and Global Privacy Control by keeping optional PostHog product analytics off. These signals do not change essential service operation or the existing page analytics and error monitoring described above.

We use information to review beta applications, send invitation and account communications, provide and secure the service, generate the AI features and send the notifications you use, manage subscriptions, respond to support requests, understand how the service is used, improve the product, and comply with applicable legal obligations. We do not use your information to provide personalized investment advice or make investment decisions for you.

We share information with service providers that help us operate the service, such as authentication, hosting, database, and background-job providers; email and push delivery; payment processing; AI model and web search providers; brokerage-connection providers; file storage; analytics and error monitoring; workspace tools we use to manage feedback; and market-data providers. These providers receive information only as needed for the services they provide. We do not sell or rent your personal information, and we do not share it for targeted advertising. We may also disclose information when required by law, to protect the service and its users, or as part of a merger, acquisition, or sale of our business.

We keep information for as long as your account is active and as reasonably needed for the purposes in this policy, such as providing support, resolving disputes, and meeting legal obligations. AI research conversations are deleted automatically 90 days after they were last updated, thesis drafts you haven’t saved or discarded 7 days after they were last updated, and in-app notifications 90 days after they arrive. You can delete your account at any time in your account settings. Deleting your account permanently deletes it and the data associated with it, including your portfolios, watchlists, notes and thesis drafts, saved backtests, alerts, notifications and the notices you’ve closed, research conversations, feedback, and records of changes our administrators made to your account, and cancels any paid subscription. Polar anonymizes your customer record but keeps records of your purchases, including the billing name and address you gave at checkout, as required for tax and legal purposes. Deletion of previously collected optional product analytics is handled separately on request; deleting your account does not automatically delete those analytics records. Limited information may remain in our providers’ logs and backups for a short period before it is removed. To ask about information we hold, including a beta request that did not become an account, contact us at support@hexpoint.net.

We use reasonable administrative, technical, and organizational measures intended to protect information. No online service or transmission method is completely secure, so we cannot guarantee absolute security.

HexPoint is operated from the United States. If you use the service from another country, your information is transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

Depending on where you live, you may have rights to request access to, correction of, deletion of, or restriction of certain personal information, or to object to certain processing. You can update your profile, change your notification settings, and delete your account in your account settings, and you can turn off browser push in your browser. For other requests or questions, contact us. We may need to verify your request before completing it.

The service is intended for adults and is not directed to children under 18. We do not knowingly collect personal information from children under 18.

We may update this Privacy Policy as the service or our practices change. We will post the updated version on this page and change the effective date, and we will notify you by email or in the service before a material change takes effect.

For privacy questions or requests, contact HexPoint LLC at support@hexpoint.net or by mail at 6701 Corporate Dr, Ste N, Johnston, IA 50131, USA.