Privacy Policy

Last updated: 10 September 2026

This Privacy Policy explains what Stratfy does and does not do with your data. The short version: Stratfy runs in your browser, has no accounts, and is built so that we hold as little about you as possible.

1. Summary

2. What we do not collect

We do not operate user accounts and we do not maintain a database of users. We do not collect your name, email address, phone number, postal address, date of birth, government identifiers, brokerage credentials, portfolio positions or financial account data. We do not ask for them and there is nowhere in the software to enter them.

3. Data stored in your browser

Stratfy uses your browser's local storage to keep your saved strategy descriptions and parameters, whether you have dismissed the export-backup reminder, your light or dark theme choice and, on the website, your language preference. This data sits on your device, is readable only by your browser under the Stratfy origin, and is not transmitted to us.

You can delete all of it at any time by clearing site data for stratfy.io in your browser settings. Doing so is irreversible — we hold no copy to restore.

4. Your API key

Your key is held only in your browser's memory for the current session and is erased when you close or reload the page. It is never written to storage. When you analyse a strategy, the key is sent with the request through our Cloudflare Worker proxy, which forwards it to the AI provider you chose. The proxy does not log, store or cache it. Because the key lives in the page while you use it, anyone with access to your unlocked device could read it; use a key with the narrowest scope and spend limit you can, and revoke it if your device is lost.

5. Third parties

AI providers. When you parse a strategy, the text you wrote and your key are sent from your browser through our Cloudflare Worker proxy, which forwards them to Anthropic, OpenAI or Google, depending on the key you supplied. The proxy does not log, store or cache either. What that provider does with the request is governed by its own privacy policy and data-retention terms, which you should read.

Market data sources. Historical price data and interest-rate series are requested through our Cloudflare Worker proxy, which forwards each request to the third-party data provider. Those requests contain the tickers, date ranges and series being tested. Because the proxy makes the request, the data provider sees Cloudflare's network address, not yours; Cloudflare necessarily processes your IP address to relay the request to it. The proxy may cache the provider's response for up to 12 hours, keyed by the request itself, which contains no personal data.

Hosting. The site is served by a hosting provider that processes standard technical request data on our behalf as described below.

6. Server logs

Serving a web page necessarily involves some technical data: IP address, user agent, requested URL, referrer and timestamp. These logs exist for security, abuse prevention and basic reliability, are kept for a short period, and are not used to build a profile of you or combined with anything you type into Stratfy.

7. Cookies and analytics

Stratfy sets no advertising cookies and uses no cross-site tracking, retargeting pixels or data brokers. Preferences are stored in local storage rather than cookies. If privacy-preserving, aggregate analytics are ever added, this page will say so before it happens.

8. Your rights

Depending on where you live, data protection law — including the Brazilian LGPD and the European GDPR — gives you rights to access, correct, delete, port or object to the processing of your personal data, and to complain to your supervisory authority. Because we hold essentially no personal data about you, most of these rights you can exercise directly: clearing your browser's site data deletes everything Stratfy holds about you. For anything else, write to us and we will respond within the period the applicable law requires.

Where we do process technical data, we rely on our legitimate interest in operating and securing the software; where you supply data to an AI provider through Stratfy, you are doing so under your own agreement with that provider.

9. International transfers

Requests your browser makes to AI providers, data sources and our host may be processed on servers outside your country, including in the United States. Those transfers are governed by the terms and safeguards of the provider concerned.

10. Children

Stratfy is not intended for anyone under 18, and we do not knowingly collect data from children.

11. Security

The site is served over HTTPS and is built to minimise the data that exists to be breached in the first place. No system is perfectly secure, and you remain responsible for the security of your own device, browser and API key.

12. Changes to this policy

If this policy changes, the revised version appears on this page with a new "last updated" date. Material changes to how data is handled will be described here rather than made quietly.

13. Contact

Privacy questions or requests: arthurcroce@protonmail.com.