Privacy Policy

Last updated: June 2026

Note: We're finalising this policy with professional review. It accurately describes how we handle your data today; contact gallanagh.holdings@gmail.com (or the site contact) with any privacy questions. This interim version has not been legally reviewed.

What we collect

Email address and account credentials (via Supabase Auth)
Subscription status and billing reference (Stripe customer ID stored in our database — card data never touches our server)
Usage data (AI research searches, per-week quota counter)
Your IP address — held transiently to rate-limit our APIs and prevent abuse, and recorded in our hosting provider's (Netlify) server logs
Push-notification subscription tokens, only if you opt in to "morning briefing" notifications (stored so we can send them; you can turn them off any time)
Portfolio and watchlist data you enter, stored against your account so the dashboard can highlight your holdings
Research and theme text you type into the AI Research tools — see "AI research" below

AI research

When you run an AI research search, the theme or commodity text you enter is sent to Anthropic, PBC (United States) to generate the analysis. Don't enter anything sensitive or confidential into these tools.

Card data

Your card details are entered on Stripe's secure hosted checkout, tokenised by Stripe, and never stored on our servers. We only ever see a Stripe customer/subscription reference and your payment status — never the card number.

Third parties & overseas disclosure

Some of the providers we rely on are located overseas. Under Australian Privacy Principle 8 we take reasonable steps to ensure these recipients handle your information consistently with the Privacy Act 1988 (Cth):

Stripe, Inc. (United States) — processes payments and stores tokenised card data. See Stripe's Privacy Policy.
Anthropic, PBC (United States) — generates the AI research analysis from the text you enter. See Anthropic's Privacy Policy.
Supabase (United States) — hosts our database (auth, subscription, portfolio/watchlist records). See Supabase's Privacy Policy.
Netlify (United States) — hosts and serves the web app; its server logs may include your IP address. See Netlify's Privacy Policy.
Supadata (United States) — retrieves YouTube video transcripts for the YouTube-alpha summary pipeline. No personal data about you is sent; only YouTube video IDs are transmitted. See Supadata's Privacy Policy.
Apify (Czech Republic) — retrieves YouTube video transcripts for the YouTube-alpha summary pipeline when Supadata is unavailable. No personal data about you is sent; only YouTube video IDs are transmitted. See Apify's Privacy Policy.

Your rights

Under the Privacy Act 1988 (Cth) you have rights to access, correct, and request deletion of your personal information. Contact us at gallanagh.holdings@gmail.com.

Complaints

If you have a privacy concern, contact us first at gallanagh.holdings@gmail.com and we'll work to resolve it. If you're not satisfied, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

[This is interim wording describing our current practices; a complete policy is being finalised with professional review.]