Privacy Policy

Who operates Mentioned

Stromatic Labs operates Mentioned and is accountable for its privacy practices. Contact the Stromatic Labs Privacy Lead at mentioned@stromaticlabs.com for privacy requests.

Data you provide

• The email address on your Mentioned account is used for sign-in, alerts, and account communication.
• Supabase processes the one-time sign-in code or optional account password you use to authenticate. Mentioned does not retain those credentials in readable form. Never send a one-time code or password to Mentioned support.
• If you separately join the website updates list, the email address you submit there is used to send product updates. You can leave that list using the instructions in the message or by contacting us.
• Watchlist tickers, alert thresholds, delivery preferences, and other settings you choose to save to your account.
• Optional profile fields you provide for onboarding or support.
• On the website, an optional webhook endpoint and server-generated signing key if you configure Premium webhook alerts.
• On the website, trader profile or tier interest if you submit those optional fields.
• Messages you send to us by email, forms, or support channels.
• Subscription and purchase records handled by Apple and RevenueCat in the iOS app, or by Stripe on the website, when you use paid access. Mentioned does not receive your full payment-card or bank-account details.
• If you use referrals, your account's random referral code, referral attribution, qualification status, reward status, and the provider transaction identifiers needed to prevent duplicate, refunded, disputed, or fraudulent rewards. Referral summaries do not disclose either person's email address.

Technical data

• Account and customer identifiers used to authenticate requests, keep entitlements attached to the correct account, and sync saved features.
• IP address, coarse request region, and request metadata for rate limiting, security, logs, diagnostics, and abuse prevention.
• Device, browser, request-region, referral, page, and event data used for security, operational diagnostics, performance measurements, and privacy-conscious aggregate analytics. Vercel Analytics and Speed Insights run on the website, not in the iOS app.
• Cookie or local storage values needed for site preferences, such as theme choice.
• The iOS app keeps Firebase Messaging token generation off until you explicitly enable push. After opt-in, Firebase processes an installation identifier and device/app configuration; the resulting push token is linked to your account so Mentioned can deliver Premium notifications.
• If you enable push on the website, your browser's push service creates a subscription endpoint and delivery encryption keys. Mentioned stores that subscription with your account and sends encrypted alert payloads through the push service operated by Google, Mozilla, Microsoft, or Apple, as applicable to your browser. Turning website push off removes the linked server record before asking the browser to unsubscribe. Account deletion also removes the linked server record. A browser-side subscription may remain until the browser finishes unsubscribing or you clear it in site settings, but Mentioned cannot deliver to it without the server record.

App Lock and on-device security

App Lock is optional. The app stores a one-way salted hash of the app passcode and its retry state on your device; the passcode itself is not retained or sent to Mentioned. Face ID or Touch ID is evaluated by iOS. Mentioned does not receive or store your face, fingerprint, biometric template, or Apple Account credentials. On iOS, the signed-in session is stored in the device Keychain.

Ticker and company searches

When you use add-ticker search, the ticker or company text you enter is sent to Mentioned and to Yahoo's public symbol-search service to return matching listings. Results may be cached for up to 20 minutes. Infrastructure request logs may retain the search term with technical metadata such as IP address, user agent, and request region for security, diagnostics, and abuse prevention. Yahoo receives the search query from Mentioned's server, not your Mentioned email address, account identifier, or push token.

Public-discussion data

Mentioned processes public online posts and limited public metadata to generate aggregate discussion metrics. The ingestion pipeline accepts post IDs, timestamps, scores, titles, body text, and source labels used for deduplication and filtering. It does not collect source-profile usernames or post permalinks.

Public product output is aggregate and paraphrased. Mentioned does not republish individual user posts verbatim in public channels. Raw public post titles and text are retained only for the short operational period described below.

How we use data

• Operate product updates and send confirmation emails.
• Run the Mentioned site, app, alerts, summaries, and support.
• Detect duplicate submissions, investigate abuse, and improve data quality controls.
• Measure aggregate usage and improve the product.
• Comply with legal, security, tax, accounting, or platform obligations.

Legal grounds and your choices

Where applicable law requires a legal basis, we process account, watchlist, alert, and subscription data to provide the service you request and perform our agreement with you. We process security, abuse-prevention, reliability, and limited aggregate analytics data for our legitimate interests in protecting and improving Mentioned, balanced against your rights. We use consent where required, including when you enable push notifications or separately join the website updates list. We also process limited records when necessary to comply with legal, tax, accounting, fraud-prevention, or platform obligations.

You can withdraw an optional consent at any time by disabling the related feature, changing your device permission, leaving the updates list, or contacting us. Withdrawal does not affect processing that was lawful before it took effect. Core account and security processing is necessary to provide a signed-in service; you can stop that processing by deleting your account.

Model providers

If a ticker summary uses a third-party model provider, Mentioned sends only the ticker symbol, an aggregate mention count, and a short list of recurring aggregate keywords. Raw public post text, email addresses, watchlists, payment details, private account credentials, and service-role keys are not included in that request.

Mentioned does not train or fine-tune models on public discussion data. If that changes, we will update this policy before the change ships.

Under Anthropic's standard commercial API policy, API inputs and outputs are deleted from its backend within 30 days, subject to its safety, legal, and contractual exceptions. Mentioned does not opt API data into model training.

Service providers

We use Supabase for authentication and database services, Vercel for hosting, aggregate website analytics, and performance measurements, Firebase and Apple for native notifications, Google, Mozilla, Microsoft, or Apple browser push services for website notifications as applicable, RevenueCat and Apple for iOS subscriptions, Stripe for web subscriptions, Resend for email, Yahoo for symbol lookup, Cloudflare Turnstile for abuse prevention on protected forms and the iOS sign-in challenge, and model providers for the summary processing described above. They process data to provide services to us. We do not sell personal data and do not share product-update emails with advertisers.

We require service providers that handle personal data on our behalf to use it only for the contracted service and to protect it consistently with this policy and applicable law. We review the data sent to integrated providers and remain responsible for configuring our integrations appropriately.

When a protected form or the iOS sign-in screen shows Turnstile, Cloudflare processes the one-time challenge token, IP address, coarse request region, browser or device information, and request metadata needed to distinguish people from abusive automated traffic. The iOS challenge does not receive your sign-in email or password.

In the iOS app, RevenueCat receives your pseudonymous Mentioned account identifier and Apple purchase and entitlement status so Premium can follow the correct account across devices. Mentioned clears the email attribute rather than sending your account email to RevenueCat. RevenueCat also processes subscription analytics used to understand purchase, renewal, cancellation, and entitlement activity.

For website checkout, Mentioned sends Stripe your account email and Mentioned account identifier so the subscription can be attached to the correct account. Stripe Checkout directly processes the contact or billing information, payment method, transaction, device or network information, and fraud-prevention data needed to complete and protect the payment under the terms of the Stripe Privacy Center. Mentioned receives customer, subscription, transaction-status, and entitlement records, but not your full payment-card or bank-account details.

International processing

Stromatic Labs operates from Canada. Mentioned and its service providers may process data in Canada, the United States, and other countries where they operate. Privacy laws in those countries may differ from those where you live. Where required, we rely on provider contractual commitments and other lawful transfer safeguards. Contact us if you want more information about safeguards relevant to your data.

No advertising or cross-app tracking

Mentioned does not include an advertising SDK, sell personal data, share personal data with data brokers, or combine app activity with other companies' data for targeted advertising or advertising measurement. The iOS app does not request App Tracking Transparency permission because Mentioned does not perform that kind of tracking.

Retention

Product-update and account data is kept until deletion is requested or it is no longer needed for product, legal, or operational reasons. Mentioned and its billing providers may retain limited pseudonymous transaction, entitlement, and event records after account deletion for purchase restoration, entitlement integrity, tax, accounting, referral integrity, fraud or security prevention, and other legal obligations. Billing providers may also retain payment, account, transaction, and security records under their own policies. Raw public-discussion titles and post text become eligible for deletion at seven days and are removed by an hourly cleanup, ordinarily within about an hour after that point. This short retention supports the 48-hour chatter window, deduplication, and operational review. We do not retain source-profile usernames or post permalinks. Derived, non-user-identifying aggregate counts and snapshots may be kept longer for trend comparisons and methodology review. Terminal notification-delivery history is kept for no more than 30 days unless account deletion removes it sooner. Mentioned's aggregate ticker-summary cache is removed after 90 days if it has not already been replaced by a current summary. Logs may be kept for security and debugging.

Deletion and access requests

Email mentioned@stromaticlabs.com to request access, correction, or deletion of personal data you provided. Signed-in users can also delete their account from the app's You tab. We may need to verify your identity. Some records may be retained where required for legal, security, fraud-prevention, accounting, backup, or operational reasons.

The Privacy Choices page explains how to manage alerts, push permission, App Lock, subscriptions, and account data.

Deleting a Mentioned account deletes the linked Stripe customer and cancels any website subscription, so web Premium access may end immediately; account deletion does not itself issue a refund. Before deleting, cancel any active App Store subscription in your Apple Account. Otherwise Apple may keep renewing it while Premium remains tied to the deleted Mentioned account, and a new account cannot restore that active subscription automatically. Recover the original account or contact support for ownership help.

Depending on where you live, you may also have rights to receive a copy of your data, correct it, restrict or object to certain processing, request portability, withdraw consent, and complain to your privacy regulator. These rights can have legal exceptions. We will not discriminate against you for making a privacy request.

Security

We use reasonable technical and administrative safeguards. No online service is perfectly secure. Do not send secrets, brokerage credentials, seed phrases, private keys, wallet keys, tax records, or other sensitive financial information to Mentioned.

Children

Mentioned is not intended for children under 18. Do not use Mentioned or submit data if you are under 18.

Changes

We may update this policy as the product changes. The updated date shows when the current version was posted.