Legal

Privacy Policy

Version 2026-08-29.3 · EDGEWISE · edgewisedesk.com

Unreviewed draft. This describes what the software actually does, read from the source that runs the site. It has not been reviewed by a lawyer. Have counsel review it before relying on it for a jurisdiction that imposes specific obligations on you.

1. What we collect 2. Why we collect it 3. Site measurement — and what we deliberately do not do 4. Cookies 5. Who we share it with 6. How long we keep it 7. Your rights 8. Deleting your data 9. How it is protected 10. Children 11. Changes to this policy 12. Contact

1. What we collect

Only what the service needs to run. There is no advertising business here, so there is no reason to collect anything beyond it.

What	When	Detail
Email address	Sign-up	Your account identifier and how we reach you about the service.
Name	Sign-up	Display only. A nickname is fine.
Password	Sign-up	Never stored. We keep a scrypt hash with a per-account random salt. It is never logged and no API returns it. We cannot recover your password, only reset it.
Plan and status	Membership	Which plan you are on, whether it is active, cancelled or lapsed.
Terms acceptances	Sign-in	Which version of the Terms you accepted and when.
Sign-in identity	Google / Apple sign-in	If you use social sign-in we receive a stable account identifier, your email, and your name from that provider — nothing else. We never receive your password for that account.
Payment	Checkout	Handled by Stripe. Card numbers never reach our servers and we never store them. We hold the plan, the status and the last four digits.
Support messages	If you write in	What you send us, so we can answer it.
Operational logs	Use of the service	Records of actions taken in your account, so a problem can be traced.

Exchange credentials

If you connect an exchange, we hold the settings you configure and not your exchange credentials or your funds. Your money stays with your exchange, in your account, under your control.

2. Why we collect it

To provide the service — an account, a membership, the pages you signed up to read.
To take payment — through Stripe, for the plan you chose.
To keep records we are expected to keep — which version of the Terms you agreed to, and when.
To answer you when you contact support.
To keep the service working — diagnosing faults, preventing abuse, and knowing roughly how many people visit.

We do not use your personal information to build an advertising profile, because we do not sell advertising.

3. Site measurement — and what we deliberately do not do

We count visits so we know whether anything we publish is working. How that is built matters more than the fact of it:

No raw IP address is ever stored. A visitor is recorded as a salted hash of IP and browser string, truncated. The salt changes daily, so the same person on two different days is two unrelated records and cannot be followed across them. A “unique visitor” here is per-day and deliberately does not try to be a person.
No third-party analytics, tag manager, pixel or advertising script runs on this site. Nothing on these pages reports your visit to Google, Meta, or anyone else. Measurement is a counter on our own server.
We record which page was requested and where the visit came from — a referring site, or a ?ref= tag we put in our own links so we can tell which post brought someone here.

4. Cookies

Functional only. We set no advertising or cross-site tracking cookies.

Cookie	Purpose	Life
`ew_session`	Keeps you signed in. Cryptographically signed so it cannot be forged or edited.	Until it expires or you sign out
Paper-desk cookies	Remember the paper-trading account you started without signing up, so it is still there when you come back.	Up to 12 months

Clearing them signs you out and, for the paper desk, detaches that practice account from your browser.

We do not sell your personal information. We do not share it with advertisers or data brokers. It goes to three places only:

Service providers acting on our behalf — Stripe for payment, our email sender for account and support mail, and our hosting provider.
A sign-in provider you chose — Google or Apple, if you use social sign-in, and only to authenticate you.
Where the law requires it — a valid legal process, or to protect the safety and rights of people using the service.

6. How long we keep it

Account records — while your membership is active and up to 24 months after it ends, so a returning member is not a stranger.
Payment records — as long as tax and accounting rules require.
Terms acceptances — kept as a record of what you agreed to.
Site measurement — aggregate daily counts for up to 400 days. These contain no identifier that can be traced to you.

7. Your rights

Depending on where you live, you may have the right to access a copy of what we hold about you, correct it, delete it, object to or restrict how we use it, and receive it in a portable form. We apply these on request regardless of whether your jurisdiction compels us to.

We do not charge for this and we will not make the service worse for you because you asked.

8. Deleting your data

To have your account and personal data deleted, email [email protected] from the address on the account, with the subject “Delete my data”. You can also ask through the Help Desk inside the product.

We will confirm the request, and within 30 days delete your account record, your name and email, your support history and any settings you saved.

What survives a deletion, and why

Payment and tax records are kept where accounting and tax law requires them. Records of the Terms you accepted are kept as evidence of the agreement. Aggregate site counts are unaffected, because they contain nothing that identifies you in the first place.

Deleting your data ends your membership. It cannot be undone.

If you signed in with Google or Apple, removing our app in that provider's settings stops future sign-ins but does not by itself delete what we hold — send the request above as well.

9. How it is protected

The site is served over HTTPS only.
Passwords are stored as scrypt hashes with a per-account salt, a memory-hard function chosen so a stolen file is expensive to attack. Plain passwords are never written to disk or to a log.
Session cookies are signed, so one cannot be forged or altered.
Card data never touches our servers — Stripe handles it.

No system is perfectly secure, and we will not claim otherwise. If we discover a breach affecting your personal data we will tell you.

10. Children

EDGEWISE is not intended for anyone under 18 and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to this policy

If this policy changes materially we will update the version above and, where the change affects how we use information you already gave us, tell members directly rather than relying on you to re-read this page.

12. Contact

Questions, requests, or anything in this policy you think is wrong: [email protected], or the Help Desk inside the product.