Privacy

This describes what Orenth actually does with data. It is written to be checkable against the source rather than to be comprehensive, and where a thing does not happen it says so plainly instead of staying silent.

What is collected

If you sign in with Google, Orenth receives and stores:

• Your email address, used as the identity of your account.
• Your name and profile picture, used to show who is signed in.
• A Google account identifier, so that the account still resolves if your email address changes.

That is the whole of it. Orenth asks Google only for the openid, email and profile scopes. It cannot read your Gmail, Drive, contacts or calendar, and it never sees your Google password.

If you sign in with a code instead:

• By email: your email address, used as the identity of your account. The code is kept only as a keyed hash, for ten minutes, and can be used once.
• By text: your phone number, used as the identity of your account. The code is created and checked by Twilio and never stored here.
• For either, the time of each code request and the network address it came from, kept so that nobody can flood an inbox or a phone with codes.

There are no passwords, so there are none to leak.

If you subscribe to Pro, Orenth stores the customer number Stripe gives it and whether your plan is active. It never sees or stores your card.

If you press Share on an analysis, Orenth makes a public page with that stock, the call, its counts and the date. It does not show your name or email. Deleting your account deletes these pages.

Your invite link records who joined through it, so both of you can be given the free week. If you turn on the weekly email, Orenth sends it to your sign-in address every Monday until you turn it off, with a link in every one to stop it.

What you create

Anything you enter is stored against your account: trades, watchlist, alerts, saved theses, and the history of analyses you have run. Only you can see it. Other people signed into the same installation cannot read it, and that separation is enforced by the database query rather than by the interface hiding things.

One thing is deliberately shared: the measured strategy record, which says how a given strategy has behaved on a given instrument. It contains no personal information, describes markets rather than people, and is what makes the analysis better as more of it accumulates.

Where data goes

To produce an analysis, Orenth sends the instrument you asked about to the sources it reads. It does not send your identity, your positions or your journal to any of them.

What does not happen

• No advertising, and no advertising identifiers.
• No tracking scripts. The pages load no third-party JavaScript at all. Visits are counted only while you are not signed in, as described above, with no cookie.
• No selling, renting or sharing of personal data with anyone.
• No cookies except the one that keeps you signed in. It holds an opaque session token and nothing else.

Keeping and deleting

Your data stays until you remove it. Every dataset can be downloaded as CSV or JSON from the Account page at any time, without asking anyone. Deleting your account removes your trades, watchlist, alerts, theses and analysis history immediately and permanently; the shared strategy record stays, because it was never yours alone and contains nothing about you.

Sessions expire after 30 days. Signing out ends the session on the server rather than only in the browser.

Security

Google sign-in uses the authorization code flow with PKCE, exchanged between servers. Code sign-in limits how many codes one address and one network can ask for, locks a code after five wrong tries, and caps how many texts can be sent in an hour in total. Session tokens are random, opaque and stored, so they can be revoked. Credentials are read from the environment and are never written to a configuration file.

Questions about this page: mousihleb@gmail.com